|
|
| Line 41: |
Line 41: |
| Start snort | | Start snort |
| /etc/init.d/snort start | | /etc/init.d/snort start |
|
| |
| = Use 'Huawei E220' HSDPA modem with Alpine =
| |
| '''Note:''' Don't plug in the modem yet<BR>
| |
| Notes are based on [http://gentoo-wiki.com/HARDWARE_HUAWEI_E220_HSDPA_USB_MODEM gentoo] wiki<BR>
| |
| To make this work, you will need 'libusb-dev', so you would need Alpine-1.7.21 (or later)
| |
|
| |
| == Initial checks ==
| |
| Doing some preparations before starting
| |
| apk_add usbutils
| |
| lsusb -v > /root/lsusb.org
| |
| dmesg > /root/dmesg.org
| |
| ls -1 /dev > /root/ls.dev.org
| |
|
| |
| '''Note:''' This step might not be needed in the future (it's here while trying to figure out how this thing works)
| |
|
| |
| Lets check how the kernel is configured
| |
| modprobe configs
| |
| zcat /proc/config.gz | grep "CONFIG_USB_SERIAL_GENERIC="
| |
| zcat /proc/config.gz | grep "CONFIG_USB_SERIAL_OPTION="
| |
| zcat /proc/config.gz | grep "CONFIG_PPP="
| |
| zcat /proc/config.gz | grep "CONFIG_PPP_ASYNC="
| |
| As I understand, all above checks should result in '=m' values.<BR>
| |
| If not, kernel should be recompiled.<BR>
| |
| [http://gentoo-wiki.com/HARDWARE_HUAWEI_E220_HSDPA_USB_MODEM#Kernel Gentoo] wiki saids: "''The USB Generic Serial Driver should be disabled altogether.''".<BR>
| |
| Might be CONFIG_USB_SERIAL_GENERIC should be '=y' (but I'm not sure about that)
| |
|
| |
| == Congigure modem ==
| |
| Now lets '''plug in the modem''' and do some checks
| |
| lsusb -v > /root/lsusb.new
| |
| diff /root/lsusb.org /root/lsusb.new > /root/lsusb.diff
| |
| grep id /root/lsusb.diff
| |
|
| |
| apk_add libusb-dev
| |
| modprobe usbserial vendor=0x12d1 product=0x1003
| |
| ls -1 /dev > /root/ls.dev.new
| |
| diff /root/ls.dev.org /root/ls.dev.new | grep '^+'
| |
| '''Note:''' At this moment I don't know howto make the above 'modprobe' action to be done automatically at next reboot.
| |
|
| |
| == Configure software ==
| |
| Install programs
| |
| apk_add ppp
| |
| mkdir -p /etc/ppp/peers
| |
|
| |
| === Create configfiles ===
| |
| '''''/etc/ppp/peers/E220'''''
| |
| /dev/ttyUSB0
| |
| 460800
| |
| crtscts
| |
| modem
| |
| noauth
| |
| usepeerdns
| |
| defaultroute
| |
| noipdefault
| |
| debug
| |
| noccp
| |
| nobsdcomp
| |
| novj
| |
| user "irrelevant"
| |
| password "irrelevant"
| |
| connect '/usr/sbin/chat -f /etc/ppp/chat-E220-pin || /usr/sbin/chat -f /etc/ppp/chat-E220-nopin'
| |
|
| |
| '''''/etc/ppp/chat-E220-pin'''''
| |
| ABORT BUSY
| |
| ABORT ERROR
| |
| ABORT 'NO CARRIER'
| |
| REPORT CONNECT
| |
| TIMEOUT 10
| |
| "" "ATZ"
| |
| OK "AT+CPIN='''''pin'''''"
| |
| OK AT+CGDCONT=1,"ip","'''''internet'''''"
| |
| OK "ATE1V1&D2&C1S0=0+IFC=2,2"
| |
| OK "AT+IPR=115200"
| |
| OK "ATE1"
| |
| TIMEOUT 60
| |
| "" "ATD*99***1#"
| |
| CONNECT \c
| |
|
| |
| '''''/etc/ppp/chat-E220-nopin'''''
| |
| ABORT BUSY
| |
| ABORT ERROR
| |
| ABORT 'NO CARRIER'
| |
| REPORT CONNECT
| |
| TIMEOUT 10
| |
| "" "ATZ"
| |
| OK AT+CGDCONT=1,"ip","'''''internet'''''"
| |
| OK "ATE1V1&D2&C1S0=0+IFC=2,2"
| |
| OK "AT+IPR=115200"
| |
| OK "ATE1"
| |
| TIMEOUT 60
| |
| "" "ATD*99***1#"
| |
| CONNECT \c
| |
| '''Note:''' The above highlighted word(s) ''''''pin'''''' is the PIN of your card (typically a four digit code)<BR>
| |
| '''Note:''' The above highlighted word(s) ''''''internet'''''' is the Access Point Name (APN) of the service you use (for instance mine is "web.omnitel.it"). If you don't know the Internet APN, ask your service provider.<BR>
| |
|
| |
| == Test connection ==
| |
| Start connection
| |
| pon E220
| |
| Stop connection
| |
| poff E220
| |
Monitor traffic using Snort and bridged nics
Prepare
Hardware
Hardware used in this example:
- Computer with 1 nic
- Switch that handles vlan
- A computer that would be analyzed
Setup analyzer/snort box
Sets up standard settings - But skip nic-settings
setup-alpine
Sets up and start webconf
setup-webconf
Install needed packages
apk_add bridge-utils
apk_add acf-snort
Because we will use vlan's in this example, we need to install vlan support
modprobe 8021q
Switch setup
We need to configure vlans on the ports
- Port X = Untagged=vlan1
- Port Y = Untagged=vlan1, Tagged=vlan2
- Port Z = Untagged=vlan2
Attach equipment into each port
- Port X = Gateway for the 'infected' box
- Port Y = Analyzer/Snort box
- Port Z = The 'infected' box
Configure
Configure bridge. /etc/conf.d/bridge would look like this:
BRIDGES="br0=eth0+eth0.2"
Add vlan2 to nic
vconfig add eth0 2
In our case we have a dhcp running on the system, so we configure br0 to get a lease (edit /etc/network/interfaces file)
auto br0
iface br0 inet dhcp
Start bridge
/etc/init.d/bridge start
Bring up bridge
ifup br0
Start snort
/etc/init.d/snort start