User:Mhavela: Difference between revisions

From Alpine Linux
(Adding notes on howto test HSDPA modem (still just testing))
 
(17 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Monitor traffic using Snort and bridged nics =
= Work in progress docs =
== Prepare ==
* Nothing at the moment
=== Hardware ===
Hardware used in this example:
* Computer with 1 nic
* Switch that handles vlan
* A computer that would be analyzed
=== Setup analyzer/snort box ===
Sets up standard settings - But '''''skip''''' nic-settings
setup-alpine
Sets up and start webconf
setup-webconf
Install needed packages
apk_add bridge-utils
apk_add acf-snort
Because we will use vlan's in this example, we need to install vlan support
modprobe 8021q
 
=== Switch setup ===
We need to configure vlans on the ports
* Port X = Untagged=vlan1
* Port Y = Untagged=vlan1, Tagged=vlan2
* Port Z = Untagged=vlan2
Attach equipment into each port
* Port X = Gateway for the 'infected' box
* Port Y = Analyzer/Snort box
* Port Z = The 'infected' box
 
== Configure ==
Configure bridge. /etc/conf.d/bridge would look like this:
BRIDGES="br0=eth0+eth0.2"
Add vlan2 to nic
vconfig add eth0 2
In our case we have a dhcp running on the system, so we configure br0 to get a lease (edit /etc/network/interfaces file)
auto br0
iface br0 inet dhcp
Start bridge
/etc/init.d/bridge start
Bring up bridge
ifup br0
Start snort
/etc/init.d/snort start
 
= Use 'Huawei E220' HSDPA modem with Alpine =
'''Note:''' Don't plug in the modem yet<BR>
Notes are based on [http://gentoo-wiki.com/HARDWARE_HUAWEI_E220_HSDPA_USB_MODEM gentoo] wiki<BR>
To make this work, you will need 'libusb-dev', so you would need Alpine-1.7.21 (or later)
 
== Initial checks ==
Doing some preparations before starting
apk_add usbutils
lsusb -v > /root/lsusb.org
dmsesg > /root/dmesg.org
ls -1 /dev > /root/ls.dev.org
 
'''Note:''' This step might not be needed in the future (it's here while trying to figure out how this thing works)
 
Lets check how the kernel is configured
modprobe configs
zcat /proc/config.gz | grep "CONFIG_USB_SERIAL_GENERIC="
zcat /proc/config.gz | grep "CONFIG_USB_SERIAL_OPTION="
zcat /proc/config.gz | grep "CONFIG_PPP="
zcat /proc/config.gz | grep "CONFIG_PPP_ASYNC="
As I understand, all above checks should result in '=m' values.<BR>
If not, kernel should be recompiled.<BR>
[http://gentoo-wiki.com/HARDWARE_HUAWEI_E220_HSDPA_USB_MODEM#Kernel Gentoo] wiki saids: "''The USB Generic Serial Driver should be disabled altogether.''".<BR>
Might be CONFIG_USB_SERIAL_GENERIC should be '=y' (but I'm not sure about that)
 
== Congigure modem ==
Now lets '''plug in the modem''' and do some checks
lsusb -v > /root/lsusb.new
diff /root/lsusb.org /root/lsusb.new > /root/lsusb.diff
grep id /root/lsusb.diff
 
apk_add libusb-dev
modprobe usbserial vendor=0x12d1 product=0x1003
ls -1 /dev > /root/ls.dev.new
diff /root/ls.dev.org /root/ls.dev.new | grep '^+'
'''Note:''' At this moment I don't know howto make the above 'modprobe' action to be done automatically at next reboot.
 
== Configure software ==
Install programs
apk_add ppp
mkdir -p /etc/ppp/peers
 
=== Create configfiles ===
'''''/etc/ppp/peers/E220'''''
/dev/ttyUSB0
460800
crtscts
modem
noauth
usepeerdns
defaultroute
noipdefault
debug
noccp
nobsdcomp
novj
user "irrelevant"
password "irrelevant"
connect '/usr/sbin/chat -f /etc/ppp/chat-E220-pin || /usr/sbin/chat -f /etc/ppp/chat-E220-nopin'
 
'''''/etc/ppp/chat-E220-pin'''''
ABORT BUSY
ABORT ERROR
ABORT 'NO CARRIER'
REPORT CONNECT
TIMEOUT 10
"" "ATZ"
OK "AT+CPIN='''''pin'''''"
OK AT+CGDCONT=1,"ip","'''''internet'''''"
OK "ATE1V1&D2&C1S0=0+IFC=2,2"
OK "AT+IPR=115200"
OK "ATE1"
TIMEOUT 60
"" "ATD*99***1#"
CONNECT \c
 
'''''/etc/ppp/chat-E220-nopin'''''
ABORT BUSY
ABORT ERROR
ABORT 'NO CARRIER'
REPORT CONNECT
TIMEOUT 10
"" "ATZ"
OK AT+CGDCONT=1,"ip","'''''internet'''''"
OK "ATE1V1&D2&C1S0=0+IFC=2,2"
OK "AT+IPR=115200"
OK "ATE1"
  TIMEOUT 60
  "" "ATD*99***1#"
  CONNECT \c
'''Note:''' The above highlighted word(s) ''''''pin'''''' is the PIN of your card (typically a four digit code)<BR>
'''Note:''' The above highlighted word(s) ''''''internet'''''' is the Access Point Name (APN) of the service you use (for instance mine is "web.omnitel.it"). If you don't know the Internet APN, ask your service provider.<BR>
 
== Test connection ==
Start connection
pon E220
Stop connection
poff E220

Latest revision as of 16:04, 14 August 2012

Work in progress docs

  • Nothing at the moment