Practical Exercises of Computer system security course Laboratory for the class Computer system security (02KRQ) Politecnico di Torino AA 2011/12 Prof. Antonio Lioy prepared by: Diana Berbecaru (diana.berbecaru@polito.it) v. 0.9 (24/10/2011) 1 Working environment The laboratory exercises make use of the live Linux distribution GRML version 2011.05 (codename: Just Mari). You can download the ISO image of this Linux distribution in two ways: 1. from the official web site: http://grml.org/ 2. from the course web site: security.polito.it/ lioy/02krq/ At the boot of GRML you should see a menu as the one shown in Figure 1. Figure 1: Initial menu of GRML 2011.05 (Just Mari) Choose grml Standard (2011, 05 i386) to start up the operating system. At home, if you use GRML with CD-ROM from physical machine you could load the entire GRML image in in RAM (this operation is not convenient if you use an USB key and it is useless if you use virtual machines). Choose Boot options for grml or successively grml - Load to RAM. This will avoid the delays due to the time required to access the CD-ROM device and will allow you also to remove the CD from the drive. But pay attention that in this case you will need much more RAM (about 690 MB more) and some minutes to load it. Given the time required to perform the exercise proposed in this laboratory (<1h30min), we recommend you not to load the GRML image in RAM. 1
To configure the Italian keyboard, you can use the following commands: loadkeys it (in console); setxkbmap it (in graphical mode). Alternatively, you can choose at boot time the option Isolinux prompt and insert grml grml-lang = it (if you have an italian keyboard, the character - corresponds to the symbol and the symbol = corresponds to ì). At the end of the boot, GRML 2011.05 will show you a menu that allows to perform easily common operations, such as to configure the network interface and to start up the graphical environment. To start up rapidly the graphical X server, press first the key x, and then f, to select the FluxBox window manager. Alternatively, from the console, you can start up the graphical X server with the following command: grml-x --mode 1024x768 fluxbox To start up the textual menu, use the command grml-quickconfig. The working environment will look like in Figure 2. Figure 2: Working environment of GRML We remind you some useful Linux commands required throughout the exercises (note: the square brackets indicate something optional, the angle brackets indicate a choice, the words in Italic need to be replaced with specific data required by the command). to change user, and to acquire root privileges: su [- username ] if you don t specify username, it assumed root by default to get more info on the use of a command/program: man program name to start/stop/restrat services: /etc/init.d/servicename { start stop restart } to view the network configuration of your machine (IP address, netmask,... ): ifconfig 2
2 Setting up the laboratory environment at home... The exercises described in the text of the laboratories will require you to use at most 3 PCs at the same time. This environment is easy to be created in the laboratory, but it could be more difficult to you to create it at home. In the following section, we ll describe how you can create at your home such a working environment (either using 3 different PCs or using a single PC) similar to the one used in the lab. 2.1... with different PCs If you have 3 PCs at your disposal, you can interconnect them in a network with a switch, as illustrated in Figure 3. The connection to Internet is not necessarily required, but it could be useful to you in case you want to find out other useful materials and detailed documentation. Figure 3: Domestic network topology In case you don t have a DHCP server that assigns automatically the IP addresses to the machines, you need to specify the configuration manually (refer to the ifconfig man page for more details). You could also use a WiFi network (an ADSL router behaves both as switch and as router), pay attention because some drivers of wireless cards have some limitations (for capturing and inserting packets) that could compromise the results/behaviour of some specific exercises. These limitations can be typically solved out by using a different version of the driver, of by configuring it in a proper manner. 2.2... with virtual machines You can create and use virtual machines in order to start up one or more GRML distributions (in practice to simulate various machines), which are all running in parallel on a unique physical machine. The solution that we adopt requires to use the ISO image of GRML as virtual CD-ROM for the machines that we are going to create: consequently, you must have a local copy of the GRML distribution file.iso. Pay attention however that, as for the WiFi networks, the virtualization could compromise the output of some exercises, because we are dealing with a software that simulates the behaviour of a real physical device. 2.2.1 VMware Server Next we will describe how to use VMware Server, which is a virtualization product freely available for Linux and Windows platforms. The version of the VMware Server used in this document is 2.0.2. Recently, VMware announced that it will not support any more the Server version, however, among the free products we found VMware Server to be the most flexible and efficient. To manage the virtual machines efficiently (3 or 4 as required by some laboratory exercise), you need to install also Tomcat for its easy-to-use web management interface. Other free VMware products are non considered appropriate for the exercise proposed, VMware Player does not support a sufficient number of virtual machines (it supports at maximum 2 VMs) and VMware vsphere Hypervisor (ESXi) is too large for the scope of our 3
Figure 4: Main page of VMware Server proposed practical exercises. In case you have a license, VMware Workstation is a product appropriate for the purpose of our laboratories. You can download the last version of VMware Server from the URL http://downloads.vmware.com/d/ details/server202/dcpizcvqdgjkzwrq. Before proceeding with the installation, you have to register to get a serial number. Refer to the documentation VMware Server User s Guide VMware Server 2.0 available at the following link http://www.vmware.com/support/pubs/server_pubs.html, to get more information on the installation take a look at the Chapter 2 in the guide, Installing VMware Server. Starting from version 2.0, VMware Server is not any more a stand alone program but is a web service (running on Apache Tomcat) and thus reachable both from localhost and from remote. Once you have installed and started VMware Server, you need to create the virtual machines. Start the VMware Server Home Page (for further info take a look at the Chapter 3 in the guide VMware Server). The window should appear as in Figure 4, select from the menu: Virtual Machine > Create Virtual Machine. You should see a Wizard (window), composed of the following phases: 1. insert the name of the VM, then click Next (in the exercises proposed, the 3 participants are called Alessandro, Beatrice, Claudio; thus, for convenience you could call the VM PCAlessandro, PCBeatrice, PCClaudio; 2. select the operating system Linux Operating, version Other 2.6x (32-bit) and proceed; 3. select the RAM (256 should be enough) and the processors/core to be used by the VM (typically one core should be sufficient), then click Next;; 4. choose the settings for the virtual disk: click Create New Virtual; since at the end of the process we will eliminate the disk, specify a low value (e.g. 1 GB), and leave the standard location ; 5. click on Virtual Device Mode and select an Adapter of type IDE0 ( because occasionally there have been encountered problems with the SCSI devices when using GRML), then click on Next; 6. click on Add Network to add a local network; for the laboratory exercises, it is fine to select a Network Connection of type NAT (sometime indicated as VMnet8); for more complex configurations, to need to consult 11 of the VMware Server guide; 4
7. choose the CD/DVD by clicking on Use Physical Drive. To avoid access conflicts, we have created virtual devices (e.g with DAEMON Tools available at http://www.daemon-tools.cc/eng/downloads) and we have associated a virtual drive to each VM; in any case, by associating more VMs to the same drive should not create problems; 8. click on Don t add a floppy; 9. click on Add a USB Controller if you want to use an USB key (for example, to transfer data between the physical PC and the virtual machines, even though we have used SSH); 10. click on Finish; you should see the newly created virtual machine.. The network configuration explained in this document allows the virtual machines to exchange data between themselves (with the help of the virtual switch), and to exchange data with the outside world (Internet) via a Network Address Translation (NAT). Before starting the virtual machine, remember to insert the CD of GRML into the physical CD/DVD drive, or to mount the ISO image of GRML. Since the ISO image of GRML is used in read-only, you can share it among all the virtual machines, without wasting space on the physical disk. Nevertheless, as explained above, you should mount the ISO image on different virtual devices. When you start the virtual machine for the first time, you need to change the boot sequence to start GRML from the CD-ROM: 1. in the frame Inventory of VMware Infrastructure Web Access, you should have the list of all virtual machines; click on the one you want to start; 2. in the frame Commands (to the right), choose Configure VM; 3. select the checkbox Enter the BIOS setup screen the next time this virtual machine boots. To start up a Virtual Machine (VM): 1. in the frame Inventory of VMware Infrastructure Web Access, you should have the list of all virtual machines; click on the one you want to start;; 2. click and choose Power from the frame Commands and press the green button (meaning Play ) in the toolbar; 3. click on the tab Console (the first time you click on the console, you will be asked to download a plug in); 4. click on any point in the window and the VM will be started in a new window. The first time you start the VM you will see the BIOS menu, set the CD-ROM as the first device in the boot sequence (by using the keys + and - ). By repeating the procedure above, you can create several GRML replicas (the only limit, at this point, is the RAM you have at disposal). 2.2.2 Oracle VM VirtualBox A valid alternative to VMware Server us VirtualBox, it has less configuration options and it does not support the management o virtual machines remotely, but is lighter from the computational point of view in case just one virtual machine is used, but it requires more resources when more VMs need to be used (e.g. managing 2 VMs on a PC with only 2 GB of RAM could become quite difficult). In case you decide to use VirtualBox, we recommend you to install the VirtualBox Extension Pack. The procedure for the creation of a new virtual machine is similar to the one followed for VMware Server. Press the New button to create a new Virtual Machine (guided wizard), consisting of the following phases (for the values refer to the Section 2.2): 5
choose the name and the type of the operating system; choose the dimension of the RAM to allocate to the virtual machine; choose the Hard Disk, deselect Boot Hard Disk and continue (we will set the boot from the CD-ROM in one of the follwoing steps). Figure 5: Select the file ISO with VirtualBox By selecting the virtual machine you have just created and by pressing afterwards the button Settings, it is possible to add a CD/DVD and create a virtual Hard disk: select Storage (it will show up a window as the one illustrated in Figure 5); click with the right key on IDE Controller and choose ADD CD/DVD Device. A window should show up, choose Choose Disk, which allows you to select the GRML ISO file; 6