| ëÁÔÁÌÏÇ ÄÏËÕÍÅÎÔÁÃÉÉ / òÁÚÄÅÌ "òÕËÏ×ÏÄÓÔ×Á ÐÏ FreeBSD ÎÁ ÁÎÇÌÉÊÓËÏÍ" / ïÇÌÁ×ÌÅÎÉÅ ÄÏËÕÍÅÎÔÁ |
| |
|
4500 003c 0a66 4000 4006 a320 c0a8 0001
c0a8 0002 04c5 0016 801e 78e3 0000 0000
a002 3fc4 fe70 0000 0204 05cc 0402 080a
0014 7e59 0000 0000 0103 0300
* paquets TCP avec flags
SYN : tcp[13] & 2 != 0
ACK : tcp[13] & 16 != 0
FIN : tcp[13] & 1 != 0
RST : tcp[13] & 4 != 0
PSH : tcp[13] & 8 != 0
URG : tcp[13] & 32 != 0
* Christmas Tree Scan
($:~)=> tcpdump -Xni ed0 '(tcp[13] & 1 != 0) and (tcp[13] & 8 != 0) and
(tcp[13] & 32 != 0)'
* capture ICMP echo request and fold up
($:~)=> tcpdump -Xni ed0 '(icmp[0] = 8) or (icmp[0] = 0)'
* fragmented packages IP
MF : ip[6] & 32 != 0
DF : ip[6] & 64 != 0
offset : ip[6:2] & 0x1fff != 0
($:~)=> lsof -ni
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
portmap 156 daemon 3u IPv4 0xc3dabf00 0t0 UDP *:sunrpc (LISTEN)
ssh 259 root 16u IPv4 0xc3ddcd80 0t0 TCP *:ssh (LISTEN)
sendmail 287 daemon 4u IPv4 0xc3dddb60 0t0 TCP *:smtp (LISTEN)
|------------------------|
| arguments |
|------------------------|
| return adress |
|------------------------|
| previous frame pointer |
|------------------------|
| guard |
|------------------------|
| arrays |
|------------------------|
| local variables |
|------------------------|
($:~)=> sysctl -w net.inet.ipsec.esp_trans_deflev=1
($:~)=> sysctl -w net.inet.ipsec.esp_net_deflev=1
($:~)=> sysctl -w net.inet.ipsec.ah_trans_deflev=1
($:~)=> sysctl -w net.inet.ipsec.ah_net_deflev=1
($:~)=> sysctl -w net.inet.ipsec.def_policy=0
($:~)=> sysctl -w net.key.prefered_oldsa=0
($:~)=> sysctl -w net.inet.ipsec.ecn=1
($:~)=> setkey -c << EOF
spdadd internal_net/24 remote_internal_net/24 any -P out ipsec
esp/tunnel/localhost_public_IP-remote_public_IP/default;
spdadd remote_internal_range/24 internal_range/24 any -P in ipsec
esp/tunnel/remote_public_IP-localhost_public_IP/default;
flush
spdflush
# SAD entry
# SA AH avec cle 160 bits
add localhost_public_IP remote_public_IP ah 1500 -A hmac-sha1 123ABC456EFG789HIJ10
add remote_public_IP localhost_public_IP ah 1600 -A hmac-sha1 123ABC456EFG789HIJ10
# SA ESP avec cle 128 bits
add localhost_public_IP remote_public_IP esp 1500 -E blowfish-cbc 123ABC456EFG789H
add remote_public_IP localhost_public_IP esp 1600 -E blowfish-cbc 123ABC456EFG789H
# SPD entry
spdadd internal_net/24 remote_internal_net/24 any -P out ipsec
esp/tunnel/localhost_public_IP-remote_public_IP/default;
spdadd remote_internal_range/24 internal_range/24 any -P in ipsec
esp/tunnel/remote_public_IP-localhost_public_IP/default;
($:~)=> cat /etc/racoon/psk.txt
remote_public_IP shared_key
path pre_shared_key "/etc/racoon/psk.txt" ;
path certificate "/usr/local/openssl/certs/";
# Padding options
padding
{
maximum_length 20;
randomize off;
strict_check on;
exclusive_tail off;
}
# Timing Options. They can be modified by the distant host.
timer
{
counter 5;
interval 10 sec;
persend 1;
phase1 1 min;
phase2 30 sec;
}
# Phase 1. anonymous means that this phase is applied to all the hosts.
# You can configure phases 1 and 2 for particular hosts.
remote anonymous
{
exchange_mode main,aggressive ;
# mode of negotiation, aggressive is faster, but hand offers
# a mechanism of cookie, the protéction of identity and the fixing of
# Diffie-Hellman group id
doi ipsec_doi;
situation identity_only;
nonce_size 16;
lifetime time 1 min; # sec,min,hour
lifetime byte 2 MB; # B,KB,GB
initial_contact on;
proposal_check obey; # obey, strict or claim
#support_mip6 on; # support of Mobile IPv6 (cf snapshots KAME)
proposal
{
encryption_algorithm blowfish;
hash_algorithm sha1;
authentication_method pre_shared_key ;
# group Diffie-Hellman
dh_group 2 ;
}
}
# Phase 2.
sainfo anonymous
{
pfs_group 2;
lifetime time 2 hour ;
lifetime byte 100 MB ;
encryption_algorithm 3des, blowfish, rijndael, twofish ;
authentication_algorithm hmac_sha1, hmac_md5 ;
# compression IPCOMP
compression_algorithm deflate ;
}
($:~)=> openssl req -new -nodes -newkey rsa:1024 -sha1 -keyform PEM -keyout
privkey.pem -outform PEM -out request.pem
|
|