334.1 Network Hardening

Topic 334: Network Security

Weight: 4

Description: Candidates should be able to secure networks against common threats. This includes analyzing network traffic of specific nodes and protocols.

Key Knowledge Areas:

  • Understand wireless networks security mechanisms

  • Configure FreeRADIUS to authenticate network nodes

  • Use Wireshark and tcpdump to analyze network traffic, including filters and statistics

  • Use Kismet to analyze wireless networks and capture wireless network traffic

  • Identify and deal with rogue router advertisements and DHCP messages

  • Awareness of aircrack-ng and bettercap

The following is a partial list of the used files, terms and utilities:

  • radiusd

  • radmin

  • radtest

  • radclient

  • radlast

  • radwho

  • radiusd.conf

  • /etc/raddb/*

  • wireshark

  • tshark

  • tcpdump

  • kismet

  • ndpmon

FreeRADIUS

What is the RADIUS Protocol?

Remote Authentication Dial-In User Service or RADIUS is a networking protocol that offers centralized Authentication, Authorization and Accounting (AAA) management for users who connect and network service.

  • Authentication is the process of determining whether the client (user, device, or process) is a genuine user of the system.

  • Authorization is the process of determining what the client is allowed to do on the network.

  • Accounting is the process of monitoring the client’s activity on the network and providing the information necessary to calculate the cost for services.

You don't have to use all three of the AAA protocols, but only the ones you need. For example, you may not need accounting but only client authentication, or perhaps all you want is accounting, and client authorization is managed by something else.

It is extremely efficient and manages thousands of requests on modest hardware. Of course it works for all network protocols and not just dialup, but the name remains the same.

FreeRADIUS

FreeRADIUS is the open source RADIUS implementation, and is the most widely-used RADIUS server.

Install Freeradius

Start Freeradius Service

radiusd

As you can see above, FreeRADIUS provides the radiusd daemon which provides an authentication service.

/etc/raddb/*

For every part of FreeRADIUS, in the configuration directory (/etc/raddb, /etc/freeradius or similar) there is a fully commented example file included, that explains what it does, and how to use it. Read those sample files too!

Again, many of the configuration files are ONLY documented in the comments included in the files.

Reading the configuration files is REQUIRED to fully understand how to create complex configurations of the server.

Main configuration files

radmin

radmin - FreeRADIUS Administration tool, is a FreeRADIUS Server administration tool that connects to the control socket of a running server, and gives a command-line interface to it.

At this time, only a few commands are supported. Please type "help" at the command prompt for detailed information about the supported commands.

WARNING

The security protections offered by this command are limited to the permissions on the Unix domain socket, and the server configuration. If someone can connect to the Unix domain socket, they have a substantial amount of control over the server.

radmin have a long list of commands, read it man page, this was only a part of that!

Additional utilities ship with the freeradius-utils package.

Basic Configuration

Always start with the "default" configuration. It will work everywhere, and do almost everything you need. The only change you will need to make is to define users and passwords.

Making a lot of changes to the configuration files is the best way to break the server. Don't do that.

Define a Client IP

For initial testing from localhost with radtest(see in this lesson), the server comes with a default definition for 127.0.0.1 and ::1

For testing from external machines, edit /etc/raddb/clients.conf and add an entry. There are many examples and the syntax is easy:

where:

example:

Define a User and Password

Edit /etc/raddb/users and create an example user account as the first entry. i.e. at the top of the file, such as:

Start the server in debugging mode

At this point you should be able to manually start radiusd. You should do this with the debugging enabled so that you can see what happens:

The location and the name of the FreeRADIUS server executable may vary, for example it could be /usr/sbin/freeradius. But the -X parameter is essential, always use it!

Lots of output will scroll by, and it will eventually say:

Sometimes people want to change default port to run on 1645, the old RADIUS port (the new one is 1812), if replacing a legacy RADIUS server. Other than that, it's possible that the EAP Module initial setup will fail.

radtest

Once the FreeRADIUS server is operational, you can use radtest to test an account from the command line,command format:

our example:

Where testing is the user name configured above, and mypass is the password for the user. These can be real user names and passwords, of course.

You should see output like:

The key is to get an 'Access Accept' response.

At this point you should have text-file authentication working in FreeRADIUS. Also based on the default settings, the authentication methods now work for the testing user

  • PAP

  • CHAP

  • MS-CHAPv1

  • MS-CHAPv2

  • PEAP

  • EAP-TTLS

  • EAP-GTC

  • EAP-MD5.

If you made changes to the default configuration, odds are that one or more of these authentication methods will stop working.

The next step is to add more users, and/or to configure directories and databases.

radclient

radclient is a radius client program included as part of FreeRADIUS. It can send arbitrary RADIUS packets to a RADIUS server, then shows the reply. It can be used to test changes you made in the configuration of the radius server, or it can be used to monitor if a radius server is up.

radclient reads radius attribute/value pairs from it standard input, or from a file specified on the command line. It then encodes these attribute/value pairs using the dictionary, and sends them to the remote server.

The User-Password and CHAP-Password attributes are automatically encrypted before the packet is sent to the server.

examples:

radlast

The FreeRADIUS server can write an accounting log in the wtmp format of the local system.

wtmp

On the Linux, Solaris, and BSD operating systems, wtmp is a file containing a history of all logins and logouts. On Linux systems, it is located at /var/log/wtmp. Various commands access wtmp to report login statistics, including the who and lastb commands.

The "w" in "wtmp" stands for "who" — as it does in the w command, which displays what users are currently logged in to the system.

radlast is a frontend for the systems last command ( it just calls last with the -f path_to_radwtmp_file argument, and passes all options on the command line to the system last command.)

radwho

The FreeRADIUS server can be configured to maintain an active session database in a file called radutmp. This utility shows the content of that session database.

What is NAS?

In a RADIUS Access-Request packet, the NAS-IP-Address attribute provides the identifying IP Address of the requesting Network Access Server (NAS).

For example,

will result in all an Accounting-Request packet being sent to the RADIUS server, which tells the server that the NAS rebooted. i.e. It "kills" all of the users on that NAS.

To "kill" one user, specify NAS, username, and NAS port:

Other combinations are also possible. let's warp it up:

Administering FreeRADIUS:

  • radmin: radmin is used to connect to, and administer a running RADIUS server.

  • radtest: The configuration may be tested using the radtest command. It is a wrapper around radclient which may be used to interface with a RADIUS server.

Using radtest:

radtest user password radius-server nas-port-number secret

  • radclient: radclient is the client-side program used to interact with a RADIUS server.

  • radlast: radlast is a wrapper around the last command that targets /var/log/radius/radwtemp instead of the default.

  • radwho: radwho shows currently logged on users.

Man pages are available for radtest, radclient, radlast, and radwho and provide more detailed information.

Network Utilities

tcpdump

tcpdump is a packet sniffing and packet analyzing tool for a System Administrator to troubleshoot connectivity issues in Linux. It is used to capture, filter, and analyze network traffic such as TCP/IP packets going through your system. It is many times used as a security tool as well. tcpdump also give us a option to save the captured information in a pcap file, these pcap files can then be opened through Wireshark or through the command tool itself.

Tcpdump continues to capture packets until it receives an interrupt signal. You can interrupt capturing by pressing Ctrl+C. In this case, since I am connected to this server using ssh, tcpdump captured all these packets. To limit the number of packets captured and stop tcpdump, i have used the -c (for count) option.

By default, tcpdump resolves IP addresses and ports into names, as shown in the previous example. When troubleshooting network issues, it is often easier to use the IP addresses and port numbers; disable name resolution by using the option -n and port resolution with -nn:

some use full tcpdump commands:

tcpdump command
Description

tcpdump -D

Display available interfaces

tcpdum -i ens33

Capture Packets from specific interface

tcpdump -c 10 -i ens33

Capture only N neumber of packets

tcpdump -w myfile.pcap -i ens33

Capture and save packets in a file

tcpdump -r myfile.pcap

Read captured packets file

tcpdump -n -i ens33

Capture IP address Packets

tcpdum -i ens33 tcp

Only TCP Packets are captured

tcpdump -i ens33 port 22

Capture packets from specific port

tcpdump portrange 21-23

use a range of ports to find traffic

tcpdump -i eth0 src 192.168.10.150

Capture packets from source IP

tcpdump -i eth0 dst 209.85.144.139

Capture packets from destination IP

tcpdump -i ens33 ipv6

Sniffing for IPv6

What is PCAP?

Packet Capture or PCAP (also known as libpcap) is an application programming interface (API) that captures live network packet data from OSI model Layers 2-7. Network analyzers like Wireshark create .pcap files to collect and record packet data from a network. PCAP comes in a range of formats including Libpcap, WinPcap, and PCAPng.

These PCAP files can be used to view TCP/IP and UDP network packets. If you want to record network traffic then you need to create a .pcapfile. You can create a .pcapfile by using a network analyzer or packet sniffing tool like Wireshark or tcpdump.

to get familiar with pcap-filters try man pcap-filter. The most important filters to know for the exam are:

• host IP

• port PORT

• portrange PORT-PORT

• tcp portrange PORT-PORT

wireshark

Wireshark is a popular open source graphical user interface (GUI) tool for analyzing packets. However, it also provides a powerful command-line utility called TShark for people who prefer to work on the Linux command line.

While wireshark is a GUI tool, it has a CLI equivalent knowns as tshark

tshark

tshark. The terminal version of Wireshark supports similar options and is a lot useful when a Graphical User Interface (GUI) isn’t available. Without any switches, tshark performs similarly to tcpdump:

tshark examples:

tshark Command
Description

tshark -D

get a list of the available network interfaces

tshark -i enp0s3

capture specific network interface traffic

tshark -i enp0s3 -c 5

capture 5 number of packets

tshark -i enp0s3 -i usbmon1 -i lo

capture multiple interfaces traffic

tshark -i enp0s3 -f "port 80 or port 53" -c 3

only capture packets from ports 80 or 53

tshark -i enp0s3 -w /tmp/test_capture.pcap

Saving Captured Traffic to a File

tshark -i enp0s3 -a duration:120 -w /tmp/test_capture.pcap

auto stop after 120 sec

tshark -i enp0s3 -a filesize:50 -w /tmp/test_capture.pcap

auto stop after 50K file size

tshark -i enp0s3 -f "port 53 or port 21" -b filesize:15 -a files:2 -w /tmp/test_capture.pcap

use “-b” with a filesize flag to save each file of size 15 Kb, maximum number of files=2

tshark -r /tmp/test_capture.pcap | head

reading .pacap files

tshark -r /tmp/test_capture.pcap -T fields -e frame.number -e ip.src -e ip.dst | head

Selecting Fields to Output via -T fields

tshark -i enp0s3 -c 1 -V host 104.26.10.240

show entire packets

ndpmon

• Neighbor Discovery Protocol Monitor

• Compiled versions available for BSD, OSX, and Debian

• Used for monitoring ICMPv6 packets

• Writes output to syslog

kismet

Kismet is a wireless network and device detector, sniffer, wardriving tool, and WIDS (wireless intrusion detection) framework. Kismet works with Wi-Fi interfaces, Bluetooth interfaces, some SDR (software defined radio) hardware like the RTLSDR, and other specialized capture hardware.

kismet_client

kismet_drone

kismet_server Usage Example

Start the Kismet server, using the wireless interface as the capture source (-c wlan0) and use the external GPSD option (–use-gpsd-gps):

aircrack_ng

Aircrack-ng is a complete suite of tools to assess WiFi network security.

It focuses on different areas of WiFi security:

  • Monitoring: Packet capture and export of data to text files for further processing by third party tools

  • Attacking: Replay attacks, deauthentication, fake access points and others via packet injection

  • Testing: Checking WiFi cards and driver capabilities (capture and injection)

  • Cracking: WEP and WPA PSK (WPA 1 and 2)

All tools are command line which allows for heavy scripting. A lot of GUIs have taken advantage of this feature. It works primarily on Linux but also Windows, macOS, FreeBSD, OpenBSD, NetBSD, as well as Solaris and even eComStation 2.

bettercap

The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks.

bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and attacking WiFi networks, Bluetooth Low Energy devices, wireless HID devices and Ethernet networks.

Network Threads

Rogue Router Advertisements

• This is a problem on IPv6 networks where malicious router advertisements may be used to hijack traffic on unsecured networks.

• It can be mitigated by adjusting your kernel to not accept router advertisements:

  • /proc/sys/net/ipv6/conf/<interface>/forwarding

  • /proc/sys/net/ipv6/conf/<interface>/accept_ra

Rouge DHCP Messages

• This is an issue that is best dealt with at the switch level.

• DHCP traffic should be restricted to solely the switch port running the DHCP server that is trusted.

• This is done using DHCP snooping.

.

.

.

resources:

https://cloudinfrastructureservices.co.uk/radius-server-linux/

https://documentation.suse.com/sles/15-SP2/html/SLES-all/cha-security-freeradius.html

https://wiki.freeradius.org/config/Configuration-files

https://wiki.freeradius.org/guide/basic-configuration-howto#simple-test

https://wiki.freeradius.org/guide/Radtest

https://wiki.freeradius.org/config/Radclient

https://freeradius.org/radiusd/man/radlast.html

https://freeradius.org/radiusd/man/radwho.html

https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/

https://www.geeksforgeeks.org/tcpdump-command-in-linux-with-examples/

https://www.tecmint.com/12-tcpdump-commands-a-network-sniffer-tool/

https://opensource.com/article/18/10/introduction-tcpdump

https://www.comparitech.com/net-admin/pcap-guide/

https://opensource.com/article/20/1/wireshark-linux-tshark

https://linuxhint.com/wireshark-command-line-interface-tshark/

https://www.kali.org/tools/kismet/

https://www.aircrack-ng.org/

https://www.kali.org/tools/bettercap/

.

Previous333.2 Mandatory Access ControlNext334.2 Network Intrusion Detection

Last updated