Upload
thanawan-tuamyim
View
107
Download
1
Tags:
Embed Size (px)
DESCRIPTION
Citation preview
In-depth Understanding Network Security
(Hardening CISCO Router/Switch)
CIS Level 1 & 2 Benchmarks and Audit Tool
for Cisco IOS Routers and PIX firewalls
IOS/PIX Benchmarks and RAT for Windows
Features of the 2.2 version of the Router Audit Tool (RAT): – Ability to score Cisco Router IOS.– Ability to score Cisco PIX firewalls.– Includes benchmark documents (PDF) for both
Cisco IOS and Cisco ASA, FWSM, and PIX security settings.
RAT for Windows
RAT for Windows
To run any RAT programs, you'll need to know the drive and pathname where RAT was installed.
You can put this directory onto your PATH:
C:\> set PATH=D:\CIS\RAT\bin;%PATH%
RAT for Windows
To run the rat program and see a list of its options, you could type the following:
C:\> rat --help
RAT for Windows
Before you use RAT, you should use the ncat_config program to create a rule file specific to your routers.
Here is how to run ncat_config:
D:\> ncat_config... lots of questions appear here ...
After all QUESTIONS we will get a template named
“D:\CIS\RAT/etc/configs/cisco-ios/local.conf"
RAT for Windows
1. Copy Template to Test Directory
2. Copy configuration files from your router
3. Run rat to audit your configuration file:
D:\>cd \Test
D:\Test> rat -r local.conf cisco-router-confg
RAT for Windows
RAT for Windows
RAT for Windows
RAT for Windows
RAT for Windows
Hardening Cisco Router
Based on NSA Router Security Configuration Guide
Router Security Configuration Guide of NSA’s SNAC
(Based on version 1.1c)
Physical Security
Network equipment, especially routers and switches, should be located in a limited access area.
This area should be under some sort of supervision 24 hours a day and 7 days a week.
A room where routers are located should be free of electrostatic and magnetic interference. The area should also be controlled for temperature and humidity.
If at all possible, all routers should be placed on an Uninterruptible Power Supply (UPS), because a short power outage can leave some network equipment in undetermined states.
Cisco IOS routers have the ability to define internal virtual interfaces, called loopback interfaces. It is considered best practice, in configuring Cisco routers, to define one loopback interface, and designate it as the source interface for most traffic generated by the router itself.
Cisco IOS routers have the ability to define internal virtual interfaces, called loopback interfaces. It is considered best practice, in configuring Cisco routers, to define one loopback interface, and designate it as the source interface for most traffic generated by the router itself.
Router Network Traffic and the Loopback Interface
Banner Rules
Banner Rules
Router1#configure terminal
Router1(config)#banner motd ^C
*************************************************************!! ONLY AUTHORIZED USERS ARE ALLOWED TO LOGON UNDER PENALTY OF LAW !!This is a private computer network and may be used only bydirect permission of its owner(s). The owner(s) reserves the right to monitor use of this network to ensure network security and to respond to specific allegations of misuse. Use of this network shall constitute consent to monitoring for these and any other purposes. In addition, the owner(s) reserves the right to consent to a valid law enforcement request to search the network for evidence of a crime stored within this network.*************************************************************^C
Stopping SYN Flooding Attacks
(config)#normal TCP 3-Way Handshake
TCP SYN flooding attack
Attack Demonstration:
E(config)#nough illegitimate TCBs are in SYN-RECEIVED that a legitimate connection can(config)#not be initiated.
Attack Demonstration:
E(config)#nough illegitimate TCBs are in SYN-RECEIVED that a legitimate connection can(config)#not be initiated.
Countermeasures: TCP SYN flooding attack
You can configure a router to protect your servers against TCP SYN attacks by enabling the ip tcp intercept command:
Router1#configure terminal
Router1(config)#access-list 109 permit ip any host 192.168.99.2
Router1(config)#ip tcp intercept list 109
Router1(config)#ip tcp intercept max-incomplete high 10
Router1(config)#ip tcp intercept one-minute high 15
Router1(config)#ip tcp intercept max-incomplete low 5
Router1(config)#ip tcp intercept one-minute low 10
Router1(config)#end
Router1#
You can configure a router to protect your servers against TCP SYN attacks by enabling the ip tcp intercept command:
Router1#configure terminal
Router1(config)#access-list 109 permit ip any host 192.168.99.2
Router1(config)#ip tcp intercept list 109
Router1(config)#ip tcp intercept max-incomplete high 10
Router1(config)#ip tcp intercept one-minute high 15
Router1(config)#ip tcp intercept max-incomplete low 5
Router1(config)#ip tcp intercept one-minute low 10
Router1(config)#end
Router1#
TCP Intercept feature
When you enable the TCP Intercept feature, the router doesn't forward the initial SYN packet to the server.
Instead, it responds directly to the client with a SYN-ACK packet, as if it were the server.
If the client is legitimate and begins the TCP session, then the router quickly opens a session to the server, knits the two ends of the connection together, and steps into its more usual role of simply forwarding packets.
When you enable the TCP Intercept feature, the router doesn't forward the initial SYN packet to the server.
Instead, it responds directly to the client with a SYN-ACK packet, as if it were the server.
If the client is legitimate and begins the TCP session, then the router quickly opens a session to the server, knits the two ends of the connection together, and steps into its more usual role of simply forwarding packets.
TCP Intercept feature
Router1(config)#access-list 109 permit ip any host 192.168.99.2 Router1(config)#ip tcp intercept list 109
TCP Intercept feature
By default, the router allows 1,100 half-open sessions before going into aggressive mode.
Configure this value using the ip tcp intercept max-incomplete high command.
Router1(config)#ip tcp intercept max-incomplete high 10
When we deliberately initiate a series of half-open sessions, we see this log message:
(config)#nov 15 13:56:38.944: %TCP-6-INTERCEPT: getting aggressive, count (10/10) 1 min 0
A short time later, the attack ended, and the router went back into its (config)#normal mode:
(config)#nov 15 13:58:14.367: %TCP-6-INTERCEPT: calming down, count (0/5) 1 min 11
By default, the router allows 1,100 half-open sessions before going into aggressive mode.
Configure this value using the ip tcp intercept max-incomplete high command.
Router1(config)#ip tcp intercept max-incomplete high 10
When we deliberately initiate a series of half-open sessions, we see this log message:
(config)#nov 15 13:56:38.944: %TCP-6-INTERCEPT: getting aggressive, count (10/10) 1 min 0
A short time later, the attack ended, and the router went back into its (config)#normal mode:
(config)#nov 15 13:58:14.367: %TCP-6-INTERCEPT: calming down, count (0/5) 1 min 11
TCP Intercept feature
you can also set thresholds on the number of TCP sessions initiated per minute:
Router1(config)#ip tcp intercept one-minute high 15
The conditions for returning to (config)#normal mode are defined by these two commands:
Router1(config)#ip tcp intercept max-incomplete low 5
Router1(config)#ip tcp intercept one-minute low 10
The first command sets the low-water mark for the total number of half-open sessions, while the second command sets the low-water mark for the number of session-initiation attempts per minute.
you can also set thresholds on the number of TCP sessions initiated per minute:
Router1(config)#ip tcp intercept one-minute high 15
The conditions for returning to (config)#normal mode are defined by these two commands:
Router1(config)#ip tcp intercept max-incomplete low 5
Router1(config)#ip tcp intercept one-minute low 10
The first command sets the low-water mark for the total number of half-open sessions, while the second command sets the low-water mark for the number of session-initiation attempts per minute.
TCP Intercept feature
By default, the router will allow a TCP session to be inactive for 24 hours (86,400 seconds).
However, you can change this using the ip tcp intercept connection-timeout command, which accepts an argument in seconds. Here we set a maximum value of one hour:
Router1(config)#ip tcp intercept connection-timeout 3600
By default the aggressive mode of the TCP Intercept feature will drop the oldest half-open connection each time it receives a new connection attempt.
However, you can instead configure it to drop a randomly selected connection out of the table:
Router1(config)#ip tcp intercept drop-mode random
By default, the router will allow a TCP session to be inactive for 24 hours (86,400 seconds).
However, you can change this using the ip tcp intercept connection-timeout command, which accepts an argument in seconds. Here we set a maximum value of one hour:
Router1(config)#ip tcp intercept connection-timeout 3600
By default the aggressive mode of the TCP Intercept feature will drop the oldest half-open connection each time it receives a new connection attempt.
However, you can instead configure it to drop a randomly selected connection out of the table:
Router1(config)#ip tcp intercept drop-mode random
TCP Intercept feature
You can configure how long the router will watch a session, waiting for it to complete the TCP session initiation.
By default, it waits 30 seconds, but you can change this value with the following command, which specifies this timeout value in seconds:
Router1(config)#ip tcp intercept watch-timeout 15
You can configure how long the router will watch a session, waiting for it to complete the TCP session initiation.
By default, it waits 30 seconds, but you can change this value with the following command, which specifies this timeout value in seconds:
Router1(config)#ip tcp intercept watch-timeout 15
TCP Intercept feature
And one final option allows you to set whether the router actively intercepts and responds to TCP SYN packets, or instead allows these packets to pass through (config)#normally, but watches the session to ensure that it connects properly.
By default the router will completely protect the server by taking over all responsibility for setting up the session. You can configure it to let the server handle the call, and only step in if there is a problem by configuring watch mode:
Router1(config)#ip tcp intercept mode watch
And one final option allows you to set whether the router actively intercepts and responds to TCP SYN packets, or instead allows these packets to pass through (config)#normally, but watches the session to ensure that it connects properly.
By default the router will completely protect the server by taking over all responsibility for setting up the session. You can configure it to let the server handle the call, and only step in if there is a problem by configuring watch mode:
Router1(config)#ip tcp intercept mode watch
Other IP stack Tune-ups
Nagle congestion control algorithm
The Nagle Algorithm prevents excessive bandwith utilization by applications that send many small packets.
It allows slight delays before sending individual small packets in order to combine them into a single larger packet.
Router1#configure terminal
Router1(config)#(config)#service nagle
Limit embryonic TCP connections
To help limit the vulnerability to TCP SYN-Flood attacks, use the global configuration ip tcp synwait-time command to limit the seconds that the router spends waiting for the ACK before giving up on a half-open connection
Router1#configure terminal
Router1(config)#ip tcp synwait-time 10
TCP selective acknowledgment
The TCP selective acknowledgment mechanism helps overcome these limitations.
The receiving TCP returns selective acknowledgment packets to the sender, informing the sender about data that has been received. The sender can then retransmit only the missing data segments.
Router1#configure terminal
Router1(config)#ip tcp selective-ack
Access
Before deciding how to control router access, ask these questions?• Who needs access?• When do they need access?• From where do they need
access?• During what time schedule
do they need access?
Basic Authentication
Basic authentication stores passwords as clear text Use(config)#service password-encryption
– Encrypts passwords using a Vigenere cipher.– Can be cracked relatively easily– Does not encrypt SNMP community strings– no enable password
Use (config)# enable secret <password>
– Encrypts passwords using a MD5 hash
“Enable” Passwords
Demo: Crack Password
Line Authentication (VTY, CON, AUX)
Use Access List to control VTY accessaccess-list 1 permit host 10.1.1.2line vty 0 4 password 7 12552D23830F94 exec-timeout 5 0 access-class 1 in login transport input telnet ssh
Control CON accessline con 0 password 7 12552D23830F94 exec-timeout 5 0 login
Control AUX accessline aux 0 no exec exec-timeout 0 0 no login transport input none transport output none
AAA
Secure user logins with AAA on all ports, virtual and physical
– Local AAA (username)– RADIUS (Steel Belted Radius)– TACACS+ (Cisco Secure ACS)
Use privilege levels to control granular access to commands
AAA Example for TACACS/RADIUS
Secure user logins with AAA on all ports, virtual and physical
aaa new-modelaaa authentication login default group tacacs+|radius localaaa authorization exec default group tacacs+|radius localusername backup privilege 7 password 0 backuptacacs-server host 171.68.118.101tacacs-server key ciscoradius-server host 171.68.118.101radius-server key ciscoprivilege configure level 7 snmp-server hostprivilege configure level 7 snmp-server enableprivilege configure level 7 snmp-serverprivilege exec level 7 pingprivilege exec level 7 configure terminalprivilege exec level 7 configure
Demo: Crack RADIUS KEY
You can do with the Cisco IOS service command
The TCP keepalive capability
allows a router to detect when the host with which it is communicating experiences a system failure, even if data stops being transmitted (in either direction). This is most useful on incoming connections.
For example, if a host failure occurs while talking to a printer, the router might never notice, because the printer does not generate any traffic in the opposite direction. If keepalives are enabled, they are sent once every minute on otherwise idle connections. If five minutes pass and no keepalives are detected, the connection is closed.
(config)#service tcp-keepalives-in
(config)#service tcp-keepalives-out
You can do with the Cisco IOS service command
service timestamps
You can use the service timestamps command to create timestamps on the router’s log files.
Since version 11.3, the Cisco IOS has enabled certain timestamps by default, so most of us have this on.
However, there are additional timestamps options that you can enable as well as places where timestamps are probably off by default.
(config)#service timestamps message-type [uptime]
(config)#service timestamps message-type datetime [msec] [localtime] [show-timezone]
Verify that the EXEC process is disabled on the auxiliary (aux) port
Unused ports should be disabled, if not required, since they provide a potential access path for attackers.
The auxiliary port is primarily used for dial-up administration, which is rarely used, via an external modem.
Verify that the EXEC process is disabled on the auxiliary (aux) port
Unused ports should be disabled, if not required, since they provide a potential access path for attackers.
The auxiliary port is primarily used for dial-up administration, which is rarely used, via an external modem.
Disable Login Through AUX Port
VTYs and Remote Administration
Forbid CDP (Cisco Discovery Protocol) Run Globally
The Cisco Discovery Protocol is a proprietary protocol that Cisco devices use to identify each other on a LAN segment.
It is useful only in specialized situations, and is considered a security risk.
There have been published denial-of-service (DoS) attacks that use CDP. CDP should be completely disabled unless there is a need for it.
The Cisco Discovery Protocol is a proprietary protocol that Cisco devices use to identify each other on a LAN segment.
It is useful only in specialized situations, and is considered a security risk.
There have been published denial-of-service (DoS) attacks that use CDP. CDP should be completely disabled unless there is a need for it.
Forbid tcp-small-servers, udp-small-servers
TCP small services: echo, chargen and daytime (including UDP versions) are rarely used.
Services that are not needed should be turned off because they present potential avenues of attack and may provide information that could be useful for gaining unauthorized access.
TCP small services: echo, chargen and daytime (including UDP versions) are rarely used.
Services that are not needed should be turned off because they present potential avenues of attack and may provide information that could be useful for gaining unauthorized access.
Forbid Finger Service
Finger is used to find out which users are logged into a device.
This service is rarely used in practical environments and can potentially provide an attacker with useful information.
Additionally, the finger service can exposed the device Finger of Death denial-of-service (DoS) attack.
The HTTP server allows remote management of routers.
Unfortunately, it uses simple HTTP authentication which sends passwords in the clear.
This could allow unauthorized access to, and [mis]management of the router.
The HTTP server allows remote management of routers.
Unfortunately, it uses simple HTTP authentication which sends passwords in the clear.
This could allow unauthorized access to, and [mis]management of the router.
Forbid IP HTTP Server
HTTP Server with Access Control(Not Recommended)
the async line BOOTP service should be disabled on your system if you do not have a need for it in your network the async line BOOTP service should be disabled on your system if you do not have a need for it in your network
Disable Bootp Server
Forbid Remote Startup Configuration
Service config allows the device to autoload its startup configuration from a remote device (e.g. a tftp server).
The protocols used to transfer configurations files. Since these methods are insecure, an attacker could potentially compromise or spoof the remote configuration service enabling malicious reconfiguration of the device.
Service config allows the device to autoload its startup configuration from a remote device (e.g. a tftp server).
The protocols used to transfer configurations files. Since these methods are insecure, an attacker could potentially compromise or spoof the remote configuration service enabling malicious reconfiguration of the device.
PAD Service(The packet assembler/disassembler service supports X.25 links)
To not accept incoming/outgoing X.25 Packet Assembler/Disassembler (PAD) connections this global configuration command should be used.
It is important to make sure this is disabled by default.
To not accept incoming/outgoing X.25 Packet Assembler/Disassembler (PAD) connections this global configuration command should be used.
It is important to make sure this is disabled by default.
Forbid IP source-route
Source routing is a feature of IP whereby individual packets can specify routes. This feature is used in several kinds of attacks.
Cisco routers normally accept and process source routes. Unless a network depends on source routing, it should be disabled.
Source routing is a feature of IP whereby individual packets can specify routes. This feature is used in several kinds of attacks.
Cisco routers normally accept and process source routes. Unless a network depends on source routing, it should be disabled.
Forbid IP Proxy ARP
Proxy ARP breaks the LAN security perimeter, effectively extending a LAN at layer 2 across multiple segments.
Disable proxy ARP on all interfaces.
Proxy ARP breaks the LAN security perimeter, effectively extending a LAN at layer 2 across multiple segments.
Disable proxy ARP on all interfaces.
Forbid IP Unreachable, Redirects, Mask Replies
• Disable translation of directed to physical broadcasts on the same interface. This configuration prevents against “smurf” attacks.
• Don’t allow redirect messages to pass through the router. ICMP redirects should be disabled
• Make it more difficult for someone to scan for valid IP addresses by turning off ip unreachables on all interfaces.
• To prevent the Cisco IOS software from responding to Internet Control Message Protocol (ICMP) mask requests by sending ICMP mask reply messages
• Disable translation of directed to physical broadcasts on the same interface. This configuration prevents against “smurf” attacks.
• Don’t allow redirect messages to pass through the router. ICMP redirects should be disabled
• Make it more difficult for someone to scan for valid IP addresses by turning off ip unreachables on all interfaces.
• To prevent the Cisco IOS software from responding to Internet Control Message Protocol (ICMP) mask requests by sending ICMP mask reply messages
Forbid MOP
The Maintenance Operations Protocol (MOP) was used for system utility services in the DECnet protocol suite.
The Maintenance Operations Protocol (MOP) was used for system utility services in the DECnet protocol suite.
Forbid NTP Service
Forbid SNMP Services
Disable Router Name and DNS Name Resolution
Configure DNS Server
Set a default DNS domain name (needed for SSH)
Disable Unused Interfaces
Filtering Traffic to the Router Itself
Remote Login (Telnet) Service
SNMP Service(Recommend only SNMPv3 AuthNoPriv & AuthPriv)
Routing Service
Filtering Traffic through the Router
IP Address Spoof Protection (Inbound Traffic)
IP Address Spoof Protection (Outbound Traffic)
Exploits Protection
TCP SYN Attack
Limiting External Access with TCP Intercept (If your IOS support it.)
Land Attack
Land Attack
Smurf Attack
ICMP Message Types and Traceroute
Distributed Denial of Service (DDoS) Attacks
Routing Protocol Security
OSPF MD5 Authentication
RIP MD5 Authentication
EIGRP MD5 Authentication
EIGRP MD5 Authentication
Disabling unneeded routing-related services
Passive Interfaces (OSPF)
Using filters to block routing updates
First Define Access Control List
Filter Distributed List (OSPF)
Filter Distributed List (RIP)
Not enable OSPF on certain interfaces,
Passive Interfaces (RIP)
Audit and Management
Overview and Motivations for Logging
Recording router configuration changes and reboots
Recording receipt of traffic that violates access lists
Recording changes in interface and network status
Recording router cryptographic security violations
Logging Types
Console logging Terminal Line logging Buffered logging Syslog logging SNMP trap logging
Cisco Log Message Severity Levels
Format of a Cisco IOS Log Message
Turning on logging services
Setting up Console and Buffered Logging
Buffered logging
Setting up Terminal Line Logging
Setting up Syslog Logging
A Small Syslog Configurationserver host
Centralized Syslog Configuration
Syslog and access list
SNMP Trap Logging
Time Services, Network Time Synchronization and NTP
Setting the Time Manually
The NTP Hierarchy
Configuring Basic NTP Service
NTP and access-list
Configuring NTP Authentication
SNMP Security
SNMPv3 Security
Configuring SNMP - Getting Started
SNMPv3 with limited view
Cisco IOS Software Updates
Show version
Update Procedure
TFTP See Cisco web sites concerning particular
model of router or switch
Router Status and Configuration Commands
show logging
show ip protocol summary
show arp
show users
show host
show ip interface brief.
show ip socket
Viewing the current configuration
show startup-config show running-config
Viewing currently running processes
show process
Router Throughput and Traffic Commands
Clear counter
Viewing IP Protocol Statistics
show ip traffic.
Viewing SNMP Protocol Statistics
configure debugging and turn on debugging messages for ICMP.
Security for Router Network Access Services
AAA
Authentication Authorization Accounting
Types of accounting
There are several types of accounting which can be enabled and configured separately: exec, network, connection, command, system.
All types are supported by TACACS+, but RADIUS does not support command or system.
network accounting– Provides information for PPP, SLIP, and ARAP
protocols. The information includes the number of packets and bytes.
EXEC accounting– Provides information about user EXEC sessions
on the router. The information includes the username, date, start and stop times, IP address of access server, and telephone number the call originated from for dial-in users.
Connection accounting– Provides information about all outbound
connections made from the network access server. This includes telnet, rlogin, etc.
Command accounting– This applies to commands which are entered in an EXEC
shell. This option will apply accounting to all commands issued at the specified privilege level. If accounting is turned on for level 15 and user logged in at enable level 15 runs a level 1 exec command no accounting event will be generated. Account records are generated based upon the level of the command not the level of the user. Accounting records will include the command, date, time, and the user. Cisco IOS does not support command acccounting with RADIUS.
System– Provides information about system-level events. This
would include information like system reboots, accounting being turned on or off, etc. Note that system accounting will only use the default list. Cisco’s implementation of RADIUS does not support system accounting.
AAA accounting requirement
AAA accounting requires that – AAA is enabled, – security servers are defined, and – that a security server is specified for each
accounting type which is desired.
Method Lists and Server Groups
Authentication
The authentication commands used for defining messages
The default method list designates RADIUS
RADIUS security server
Authorization
Authorization
There are two primary scenarios where authorization is useful.
First, if the router is used for dial in access, authorization is useful for controlling who can access network services, etc. and who can access and configure the router.
Second, authorization can control different administrators who have access to different privilege levels on the router.
Accounting
Configuration of TACACS+ accounting:
Configuration of RADIUS accounting
Security Server Protocols
RADIUS
TACACS+
Hardening Cisco Switch(Based on NSA Cisco IOS
Switch Security Configuration Guide)
Port Security
Restricting a port statically on a Catalyst 3550 switch.
A strict security “unused” macro
A strict A strict security security
“host” macro“host” macro
Configure access ports of the switch
Virtual Local Area Networks(VLAN)
Create the out-of-band management VLAN.
Create a management IP address
Assign the management VLAN to the dedicated interface.
Ensure all trunk ports will not carry the management VLAN
Assigned the following name for VLAN 1.
Assign all inactive interfaces to an unused VLAN (not VLAN1)
Virtual Trunking Protocol (VTP)
If VTP could be disabled
If VTP is necessary
Trunk Auto-Negotiation
Dynamic Trunking Protocol (DTP)
A port may use the Dynamic Trunking Protocol (DTP) to automatically negotiate which trunking protocol it will use, and how the trunking protocol will operate.
DTP-related security issues
DTP-related security issues
VLAN Hopping
VLAN Hopping
In certain situations it is possible to craft a packet in such a way that a port in trunking mode will interpret a native VLAN packet as though it were from another VLAN, allowing the packet to become a member of a different VLAN.
This technique is known as VLAN hopping.
Spanning Tree Protocol
STP Portfast Bridge Protocol Data Unit (BPDU) Guard
STP Root Guard
205
(config)#no ip bootp server(config)#no tcp-small-servers(config)#no udp-small-servers
(config)#service time log datetime localtime show-timezone msec(config)#service time debug datetime localtime show-timezone mseclogging x.x.x.xlogging trap debugginglogging source loopback0logging buffered 64000 debugging
ntp authentication-key 10 md5 <key>ntp authenticatentp trusted-key 10ntp server x.x.x.x [key 10]ntp access-group peer 20access-list 20 permit host x.x.x.xaccess-list 20 deny any
(config)#no (config)#service finger(config)#no (config)#service pad(config)#no ip http server(config)#no ip source-route
(config)#no cdp run(config)#no boot network(config)#no (config)#service config(config)#no ip subnet-zero
(config)#no ip identd(config)#no ip finger(config)#service nagle
Configuration basics (1)
Turn off all the unneeded (config)#services
Use syslog
Use (authenticated) NTP