쫑콩아빠의 지금 이 순간...

DefensePro 장비 주로 쓰는 CLI
system logfile : 장비 LOG 확인
system cpu-temp : 장비 CPU 온도 확인
system config immediate : 장비 config 확인
system total-in-traffic-peak : 유입되는 최대 트래픽 확인(Mbps)
system os buffer : Memory 사용량 확인
system hardware temperature-show : DP장비 CPU온도확인(= system cpu-temp)
system internal fans : Fan 상태 확인
system internal port-stats : 가장 최근에 들어오는 트래픽 용량 확인(5초, 30초, 60초)
system sw-version : DP 버전 확인
system utilization cpu : CPU 사용량 확인
system inf-stats : 인터페이스에 들어오는 트래픽량 확인
system license application : DP 라이선스 키 및 MAC address 확인
system device-info : 장비 정보 확인
system date : DP 날짜 및 시간 확인
device static-forwarding-table : Inline 상태 확인
services ntp server-name : NTP 주소 확인
services ntp status : NTP 서버 상태 확인
manage web status : 웹 데몬 상태 확인
net arp table : ARP 테이블 확인
net l2-interface : 포트 링크 상태 확인
net l2-information : 포트 정보 확인
net physical-interface : 포트 Speed, Duplex, Autonego 확인
net route table : 매니지먼트 라우팅 테이블 확인
net ip-interface : 매니지먼터 IP 정보
shutdown : 장비 shutdown
reboot : 장비 rebooting
dp attack-database version : DP 시그니쳐 버전
Apsolute Vision CLI
net ip get : Vision 서버 IP 확인
system hadware status get : FAN 상태 및 온도 확인
system vision-server status : Vision 서버, Reporter 서버 데몬 상태 확인
system version : Vision 서버 버전 확인

기본 Hadware 정보 및 주요 명령어

uptime : 장비 업타임 확인(부팅이 되고 지난 일 수)

TMOUT=0 : 장비 접속 세션 유지
=> 분 단위이며, 0을 입력하면 시간 제한이 없음

top : IPS의 현재 CPU 정보 확인

cat /proc/cpuinfo : IPS의 CPU 정보 확인

df -h : IPS의 현재 DISK 용량 상태 정보 확인

free : IPS의 현재 Memory 용량 정보 확인

cat /proc/meminfo : IPS의 현재 Memory 사용량 확인

ps -ef : 현재 사용중인 Process 확인

lsmod : 데몬 활성화 / 비활성화 확인
=> IPS의 2세그먼트 기준으로 NIC정보 값이 8이면 데몬 활성화 / 0일 경우 데몬 비활성화 상태

init 0 : 장비 전원 OFF

init 6 : 장비 리부팅

cd /home1/sniper/sniper 디렉토리 이동 후
./sniper : 장비 데몬 ON/OFF
./sniper -v : 현재 IPS 버전 정보 확인
./sniper -O : 현재 IPS SSL버전 정보 확인

Traffic 관련

cd /home1/sniper/sniper 디렉토리 이동 후
./isconfig 혹은 ./wgconfig
=> 장비의 NIC에 따라 명령어 달라짐
=> In, Out 트래픽, 인터페이스 에러, 정책에 의한 Drop 카운트 확인 가능
./isconfig |grep error
=> 점검 시, error값으로 sort하여 이상 유무 확인

Config 백업 관련

cd /home1/sniper 디렉토리 이동 후
cp -rfp config config_YYMMDD : config 파일 복사
tar -cvzf config_YYMMDD.tar.gz config_YYMMDD : config 파일 압축
mv config_YYMMDD.tar.gz /backup : 압축한 config 파일을 /backup 디렉토리로 이동

Log 확인

cat /var/log/messages : IPS 로그 전체 정보 확인

cd /var/log 이동 후
tail -n 숫자 messages : 최근 로그부터 숫자만큼 정보 확인
=> 예를 들어 tail -n 100 messages 명령어인 경우 최근 100개의 로그 메세지 확인 가능

dmesg : 장비 부팅 로그 확인

기타

#df -h
#more /home1/sniper/config/sniper.dat ->제품의 S/N, License 정보
#more /home1/sniper/config/sniper.cfg -> 각종 운영 설정 관련 정보
#sniper_network.sh
#ps -ef|grep sniper
#netstat -na
#cd /home1/sniper/sniper -> #./skill sniper
#cd /home1/sniper/sniper -> #./sniper
#cd /home1/sniper/sniper -> #./nic_setup.sh
#cd /home1/sniper/sniper -> #./wgconfig

WD -i eth0 -s 1600 -w packet.pcap -> 관리포트 패킷 수집

tcpdump -i eth0 -s 1600 -w filename.pcap -> 패킷덤프

auto_create_partition.sh -> HDD장애 시 HDD 교체 후 해당 스크립트를 이용하여 자동으로 Partition 설정함

config_gather -> 설정 정보 확인(결과는 /backup/Config_Gathering/에 txt 파일로 저장됨)

#lspci -> 장착되어 있는 NIC 정보 확인

more /home1/sniper/sniper/is_insmode.sh_ -> mode/speed 등

more /home1/sniper/sniper/sn_insmode.sh_

#/home1/sniper/sniper/sniper -v

rm -rf /home1/sniper/config/master.dat ->> Sniper Daemon Restart 관리자 접속 안될경우

sniper_network.sh eth1

1. Afreeca TV

F-SBID( --protocol tcp; --service http; --flow from_client; --pattern ".afreeca."; --context host; --no_case; --app_cat 5; )

2. Naver Café

F-SBID( --protocol tcp; --service http; --flow from_client; --pattern "cafe.naver.com"; --context host; --no_case; --app_cat 23; )

F-SBID( --protocol tcp; --service http; --flow from_client; --pattern "cafe"; --context host; --no_case; --within 10,context; --pattern ".naver.net"; --context host; --no_case; --app_cat 23; )

3. KakaoStory

F-SBID( --protocol tcp; --service SSL; --pattern "story.kakao.com"; --context host; --no_case; --app_cat 23; )

F-SBID( --protocol tcp; --service SSL; --pattern "story."; --context host; --no_case; --pattern ".kakaocdn.net"; --context host; --no_case; --app_cat 23; )

F-SBID( --protocol tcp; --service SSL; --pattern "story-"; --context host; --no_case; --pattern ".kakao"; --context host; --no_case; --app_cat 23; )

F-SBID( --protocol tcp; --service http; --flow from_client; --pattern "User-Agent: "; --context header; --no_case; --pattern "KakaoStory"; --context header; --no_case; --within 20; --app_cat 23; )

FG # sh ips custom Apache.Struts.CVE.2017.5638.Custom config ips custom    edit "Apache.Struts.CVE.2017.5638.Custom"        set signature "F-SBID( --attack_id 7386; --name Apache.Struts.CVE.2017.5638.Custom; --protocol tcp; --service HTTP; --flow from_client; --pattern Content-Type:; --context header; --no_case; --pattern multipart/form-data; --context header; --no_case; --within 64; --pattern %{; --context header; --distance -32; --within 64; --pcre /%{[^x0a]*([^x0a]*)/i; --context header; --distance -2;   )"        set log-packet enable        set action block        set comment "CVE-2017-5638"    next

# Fortigate IPS DoS configuration Sample

Fortigate $ show ips DoS block_dos
config ips DoS
    edit "block_dos"
            config anomaly
                edit "tcp_syn_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "tcp_port_scan"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "tcp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "tcp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "udp_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "udp_scan"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "udp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "udp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "icmp_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "icmp_sweep"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "icmp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "icmp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "ip_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
                edit "ip_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 100
                next
            end
    next
end

Fortigate $ sh firewall interface-policy
config firewall interface-policy
    edit 1
        set interface "dmz"
            set srcaddr "all"
            set dstaddr "all"
            set service "ANY"
        set ips-DoS-status enable
        set ips-DoS "block_dos"
    next
end

## Default

Fortigate # show firewall DoS-policy
config firewall DoS-policy
    edit 2
        set interface "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set service "ALL"
            config anomaly
                edit "tcp_syn_flood"
                    set threshold 2000
                next
                edit "tcp_port_scan"
                    set threshold 1000
                next
                edit "tcp_src_session"
                    set threshold 5000
                next
                edit "tcp_dst_session"
                    set threshold 5000
                next
                edit "udp_flood"
                    set threshold 2000
                next
                edit "udp_scan"
                    set threshold 2000
                next
                edit "udp_src_session"
                    set threshold 5000
                next
                edit "udp_dst_session"
                    set threshold 5000
                next
                edit "icmp_flood"
                    set threshold 250
                next
                edit "icmp_sweep"
                    set threshold 100
                next
                edit "icmp_src_session"
                    set threshold 300
                next
                edit "icmp_dst_session"
                    set threshold 1000
                next
                edit "ip_src_session"
                    set threshold 5000
                next
                edit "ip_dst_session"
                    set threshold 5000
                next
                edit "sctp_flood"
                    set threshold 2000
                next
                edit "sctp_scan"
                    set threshold 1000
                next
                edit "sctp_src_session"
                    set threshold 5000
                next
                edit "sctp_dst_session"
                    set threshold 5000
                next
            end
    next
end

Fortigate #

# Fortigate IPS DoS configuration Sample

qvrexhqfw2 $ show ips DoS block_dos
config ips DoS
    edit "block_dos"
            config anomaly
                edit "tcp_syn_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "tcp_port_scan"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "tcp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "tcp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_scan"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_sweep"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "ip_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "ip_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
            end
    next
end
qvrexhqfw2 $ sh firewall interface-policy
config firewall interface-policy
    edit 1
        set interface "dmz"
            set srcaddr "all"
            set dstaddr "all"
            set service "ANY"
        set ips-DoS-status enable
        set ips-DoS "block_dos"
    next
end