Free Essay

Construct a Linux Host Firewall and Monitor for Ip Traffic

In:

Submitted By mylinelder
Words 665
Pages 3
130

LAB #9 | Construct a Linux Host Firewall and Monitor for IP Traffic

LAB #9 – ASSESSMENT SPREADSHEET

Construct a Linux Host Firewall and Monitor for IP Traffic
Course Name and Number: Student Name: Instructor Name: Lab Due Date:

Internal Firewall Policy Definition
Configure your “TargetUbuntu02” desktop Linux internal host IP stateful firewall according to the following policy definition. Test and validate your implementation after you configure it based on the policy definition. The following is your Ubuntu internal firewall policy definition: Deny incoming traffic Deny the following specific applications: TFTP Telnet SNMP ICMP FTP Allow the following specific applications under “Advanced” settings: SSH SMTP POP3 HTTPS HTTP Make a screen capture of the changes you made to the configuration and paste it into the text document. Use the File Transfer button to download the text file to your local computer and submit it as part of your deliverables.

Assessment Worksheet

131

9
Construct a Linux Host Firewall and Monitor for IP Traffic

LAB #9 – ASSESSMENT WORKSHEET

Construct a Linux Host Firewall and Monitor for IP Traffic
Course Name and Number: Student Name: Instructor Name: Lab Due Date:

Overview
In this lab, you configured the Gufw Ubuntu host IP stateful firewall as an internal service running on the Linux desktop. By defining what IP traffic is allowed and what IP traffic is denied, you implemented another layer of security in your overall layered security strategy. In addition, you explored some useful network management and security operation tools, which can be enabled to monitor your IP traffic and security functions.

Lab Assessment Questions & Answers
1. Briefly explain how the Gufw internal Ubuntu host IP stateful firewall can be used in a layered security

strategy at the workstation domain level.

2. Briefly explain how each of the Linux-based tools demonstrated in this lab can be used to monitor

bandwidth, protocol, and network traffic information.

132

LAB #9 | Construct a Linux Host Firewall and Monitor for IP Traffic
3. Given that the Ubuntu internal firewall is not installed by default, should you enable this firewall if your

organization already has a firewall? Why or why not?

4. How do you block specific ports and IP ranges from communicating via TCP/IP to and from your Ubuntu

Target VM using Gufw?

5. Other than Deny or Allow incoming connections, what other options are available in Ubuntu’s internal

firewall? Why would they include any additional option?

6. What usefulness is there in monitoring IP traffic to and from an individual workstation or server?

Assessment Worksheet
7. How are you going to test if your internal firewall configuration is working properly?

133

9
Construct a Linux Host Firewall and Monitor for IP Traffic

8. This is a two–part, real-world scenario question. Read the REQUIREMENTS section. Then, based on the

requirements, answer PART A with a technical solution using the tools demonstrated in this lab and answer PART B with a written explanation and justification for your solution. You must use at least two of the following Linux-based IP monitor tools presented in this lab in your realworld example: bmon, iftop, pktstat, iperf, and/or tcptrack.
REQUIREMENTS: A strategy is required to effectively monitor IP traffic on an individual server as well

as many servers on a “point in time” as well as on an “over time” basis. There is also a requirement to automate the alerting of potential issues based on changes in network utilization.
PART A: Give a real-world example of how you could meet this requirement with the use of tools presented in this lab and the use of any other available resources, such as scripts, alerts, output formats, or scheduled tasks (i.e., cron jobs).

134

LAB #9 | Construct a Linux Host Firewall and Monitor for IP Traffic
PART B: Explain the usefulness and benefits of your real-world example to an organization and

support your reasoning with technical facts and security in mind. Did you meet the requirements? Why or why not?

Similar Documents

Premium Essay

Hris

...NI-LIMIT 11 NI-LIMIT COMPUTER NETWORK SYSTEM PROPOSAL [Type the document subtitle] [Type the author name] TABLE OF CONTENTS ACKNOWLEDGEMENTS My fellow group members would like to thank our dear lecturer Mrs. Noris Ismail for doing her lecturing job professionally which broadened our knowledge greatly about networking and enabled us to come up with such a detailed proposal for network infrastructure and mixing it with several other ideas to finally make a final report on it. I would also want to thank my fellow group members for the effort and dedication they put in to complete the task of coming up with the report and the final proposal. Chapter one: Company profile NI-Limits Sdn Bhd NI-Limits Sdn Bhd is a digital design & web management company that provides stateof-the-art service through a mixed team of local and foreign professionals with the mission of delivering unparallel service and support to both Malaysian and International markets. NI-Limits Sdn Bhd is a Malaysian based company resulting from a merger of several independent web development agencies (Pixel Media, Webb Designs and Quartz Interactive) and international freelancers that have been in business since 1997. Mark Smalley and Nigel Webb formed Pixel Media in Sarawak, Malaysia in 1997. As a team of independent freelancers working together, they developed online marketing material to clients throughout Asia. The company primarily dealt with Oil and Gas related companies that were...

Words: 10139 - Pages: 41

Premium Essay

Redhat

...edhat® ® Te r r y C o l l i n g s & K u r t W a l l UR ON IT OOLS IN Y T C E CD-R L TH O ED UD M Linux Solutions from the Experts at Red Hat ® ® P R E S S™ SEC Red Hat® Linux® Networking and System Administration Red Hat® Linux® Networking and System Administration Terry Collings and Kurt Wall M&T Books An imprint of Hungry Minds, Inc. Best-Selling Books G Digital Downloads G e-Books G Answer Networks e-Newsletters G Branded Web Sites G e-Learning New York, NY G Cleveland, OH G Indianapolis, IN Red Hat® Linux® Networking and System Administration Published by Hungry Minds, Inc. 909 Third Avenue New York, NY 10022 www.hungryminds.com Copyright © 2002 Hungry Minds, Inc. All rights reserved. No part of this book, including interior design, cover design, and icons, may be reproduced or transmitted in any form, by any means (electronic, photocopying, recording, or otherwise) without the prior written permission of the publisher. Library of Congress Control Number: 2001093591 ISBN: 0-7645-3632-X Printed in the United States of America 10 9 8 7 6 5 4 3 2 1 1O/RT/QT/QS/IN Distributed in the United States by Hungry Minds, Inc. Distributed by CDG Books Canada Inc. for Canada; by Transworld Publishers Limited in the United Kingdom; by IDG Norge Books for Norway; by IDG Sweden Books for Sweden; by IDG Books Australia Publishing Corporation Pty. Ltd. for Australia and New Zealand; by TransQuest Publishers Pte Ltd. for Singapore, Malaysia, Thailand...

Words: 220815 - Pages: 884

Free Essay

It-242

...Network Address Translation (NAT) is. I won’t cover items such as setting up Secure Shell (SSH) access and hardening access lists. You can expand into those areas as you feel comfortable and want to experiment more. What You’ll Need You need a Cisco router with at least two Ethernet interfaces. An 806, 836, 851, or 871 is ideal for a home or small office setup—in fact, that’s what those models are geared towards. You can buy an 851 for a few hundred dollars from various online retailers. However, a 2610 works just as well, and you might have one sitting in the equipment bin at your office that you can ask to borrow. Your router should have IOS 12.2 or later. This article is based on a Cisco 851W with IOS 12.4, including the IOS firewall feature set. You also need a Cisco console cable (sometimes called a rollover cable). One end has an eight-position, eight-conductor modular jack to connect to the router; the other end has a DB-9 serial connector. In recent years, the console cables that Cisco has shipped with its equipment have been light blue. You need a computer with a DB-9 serial port. In my experience, USB-to-serial converters work just fine for this application. You also need a computer with a terminal emulation program. Hilgraeve’s HyperTerminal is available with Windows XP, but it was removed from Windows Vista. Vista users can download...

Words: 1763 - Pages: 8

Free Essay

Ceh Test Questions

...Exam : 312-50 Title : Ethical Hacker Certified Ver : 02-23-2009 312-50 QUESTION 1: What is the essential difference between an 'Ethical Hacker' and a 'Cracker'? A. The ethical hacker does not use the same techniques or skills as a cracker. B. The ethical hacker does it strictly for financial motives unlike a cracker. C. The ethical hacker has authorization from the owner of the target. D. The ethical hacker is just a cracker who is getting paid. Answer: C Explanation: The ethical hacker uses the same techniques and skills as a cracker and the motive is to find the security breaches before a cracker does. There is nothing that says that a cracker does not get paid for the work he does, a ethical hacker has the owners authorization and will get paid even if he does not succeed to penetrate the target. QUESTION 2: What does the term "Ethical Hacking" mean? A. Someone who is hacking for ethical reasons. B. Someone who is using his/her skills for ethical reasons. C. Someone who is using his/her skills for defensive purposes. D. Someone who is using his/her skills for offensive purposes. Answer: C Explanation: Ethical hacking is only about defending your self or your employer against malicious persons by using the same techniques and skills. QUESTION 3: Who is an Ethical Hacker? A. A person whohacksfor ethical reasons B. A person whohacksfor an ethical cause C. A person whohacksfor defensive purposes D. A person whohacksfor offensive purposes Answer:...

Words: 34575 - Pages: 139

Premium Essay

Netwrk Security

...Fundamentals of Network Security John E. Canavan Artech House Boston • London http://www.artechhouse.com Library of Congress Cataloging-in-Publication Data Canavan, John E. Fundamentals of network security / John E. Canavan. p. cm.—(Artech House telecommunications library) Includes bibliographical references and index. ISBN 1-58053-176-8 (alk. paper) 1. Computer security. 2. Computer networks—Security measures. I. Title. II. Series. QA76.9.A25 C364 2000 005.8—dc21 00-050810 CIP British Library Cataloguing in Publication Data Canavan, John E. Fundamentals of network security.—(Artech House telecommunications library) 1. Computer networks—Security measures I. Title 005.8 1-58053-176-8 Cover design by Yekaterina Ratner Microsoft ® screen shots reprinted by permission from Microsoft Corporation. Netscape Communicator browser window © 1999 Netscape Communications Corporation. Used with permission. Netscape Communications has not authorized, sponsored, endorsed, or approved this publication and is not responsible for its content. Permission to reproduce screen shots from the PGP and Sniffer products has been provided by Network Associates, Inc. Network Associates, PGP, Pretty Good Privacy Sniffer, and Distributed Sniffer System are registered trademarks of Network Associates, Inc. and/or its affiliates in the U.S. and/or other countries. MIT screen shots used with permission. Qualcomm's Eudora screen shots used with permission. Copyright © 2001 ARTECH HOUSE, INC. 685 Canton Street...

Words: 95027 - Pages: 381

Premium Essay

Term Paper: Website Migration Project

...Term Paper: Website Migration Project Term Paper: Website Migration Project Dimitri A. Brydie Professor Jennifer Merritt Systems Analysis and Development December 18, 2013 Tony’s Chips has recently been acquired by a new independent company and the organization leaders have decided to move the current website, which is hosted externally, to an internal host. The company wants the website to be redesigned so that after migration, customers will then be able to make orders online. The company’s leadership would also like to have a disaster recovery solution in place in case the main site goes down. The overall objective of the project is to plan and design a new effective platform to host the website and to efficiently transfer the current website with minimal downtime. In order to accomplish successful migration of the current website, the five phases of the systems development life cycle will be utilized. The five phases are: systems planning, systems analysis, systems design, systems implementation, and finally, systems support and security (Shelly & Rosenblatt 2012). The first phase in the website migration project will be to become familiarized with the business process and identify the objectives of the project. For an IT professional, this may consist of meeting with business leaders and studying the formal business plan to get a feel for the operations of the company. In this case, the company makes potato chips and distributes them. Another objective...

Words: 1977 - Pages: 8

Premium Essay

Security Analyst

...Exploring Network Topologies 2. Working with the Open Systems Interconnection Model 3. Dissecting the TCP/IP Suite 4. IP Subnetting 5. Hexadecimal vs. Binary 6. Exploring TCP/IP Ports 7. Understanding Network Devices 8. Working with MAC Addresses 9. Intrusion Prevention and Intrusion Detection Systems 10. Network Security 11. Knowing Operating Systems 12. Backups and Archiving 13. Summary 14. Exam Essentials 15. Review Questions 5. Chapter 3: Cryptography 2 1. Cryptography: Early Applications and Examples 2. Cryptography in Action 3. Understanding Hashing 4. Issues with Cryptography 5. Applications of Cryptography 6. Summary 7. Exam Essentials 8. Review Questions 6. Chapter 4: Footprinting and Reconnaissance 1. Understanding the Steps of Ethical Hacking 2. What Is Footprinting? 3. Terminology in Footprinting 4. Threats Introduced by Footprinting 5. The Footprinting Process 6. Summary 7. Exam Essentials 8. Review Questions 7. Chapter 5: Scanning Networks 1. What Is Network Scanning? 2. Checking for Live Systems 3. Checking for Open Ports 4. Types of Scans 5. OS Fingerprinting 6. Banner Grabbing 7. Countermeasures 8. Vulnerability Scanning 9. Drawing Network Diagrams 10. Using Proxies 11. Summary 12. Exam Essentials 13. Review Questions 8. Chapter 6: Enumeration of Services 3 1. A Quick Review 2. What Is Enumeration? 3. Windows Basics 4. Enumeration with SNMP 5. Unix and Linux Enumeration 6. LDAP and Directory Service Enumeration 7. Enumeration Using NTP 8. SMTP Enumeration...

Words: 71242 - Pages: 285

Free Essay

A Hands on Intro to Hacking

...Interior Design: Octopod Studios Developmental Editor: William Pollock Technical Reviewer: Jason Oliver Copyeditor: Pamela Hunt Compositor: Susan Glinert Stevens Proofreader: James Fraleigh Indexer: Nancy Guenther For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 245 8th Street, San Francisco, CA 94103 phone: 415.863.9900; fax: 415.863.9950; info@nostarch.com; www.nostarch.com Library of Congress Cataloging-in-Publication Data Weidman, Georgia. Penetration testing : a hands-on introduction to hacking / Georgia Weidman. pages cm Includes index. ISBN 978-1-59327-564-8 (paperback) -- ISBN 1-59327-564-1 (paperback) 1. Penetration testing (Computer security) 2. Kali Linux. 3. Computer hackers. QA76.9.A25W4258 2014 005.8'092--dc23 2014001066 I. Title. No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no...

Words: 117203 - Pages: 469

Free Essay

Linux as a Personal Desktop Operating System

...Table of Contents Beginning Red Hat Linux 9 ...............................................................................................................................1 Introduction.........................................................................................................................................................4 Who Is This Book For?...........................................................................................................................4 What You Need to Use This Book.........................................................................................................4 What Is Linux? ........................................................................................................................................5 Linus Torvalds and the Birth of Linux.............................................................................................5 Why Choose Linux?.........................................................................................................................6 What Is Red Hat Linux 9?................................................................................................................7 What Is Covered in This Book?..............................................................................................................8 Conventions in This Book......................................................................................................................9 Customer Support...............

Words: 155032 - Pages: 621

Premium Essay

Term Paper - Website Migration Project

...Tony’s Chips has recently been acquired by a new independent company and the organization leaders have decided to move the current website, which is hosted externally, to an internal host. The company wants the website to be redesigned so that after migration, customers will then be able to make orders online. The company’s leadership would also like to have a disaster recovery solution in place in case the main site goes down. The overall objective of the project is to plan and design a new effective platform to host the website and to efficiently transfer the current website with minimal downtime. In order to accomplish successful migration of the current website, the five phases of the systems development life cycle will be utilized. The five phases are: systems planning, systems analysis, systems design, systems implementation, and finally, systems support and security (Shelly & Rosenblatt 2012). The first phase in the website migration project will be to become familiarized with the business process and identify the objectives of the project. For an IT professional, this may consist of meeting with business leaders and studying the formal business plan to get a feel for the operations of the company. In this case, the company makes potato chips and distributes them. Another objective in phase one of the website migration project, is to decide who will be involved and at what point during the project their involvement will be required. One of the purposes of the redesigned...

Words: 1950 - Pages: 8

Premium Essay

Doing Things

...Networking: A FlowBased Network Virtualization Architecture Georgia Kontesidou Kyriakos Zarifis Master of Science Thesis Stockholm, Sweden 2009 TRITA-ICT-EX-2009:205 Openflow Virtual Networking: A Flow-Based Network Virtualization Architecture Master Thesis Report November 2009 Students Kyriakos Zarifis Georgia Kontesidou Examiner Markus Hidell Supervisor Peter Sjödin Telecommunication Systems Laboratory (TSLab) School of Information and Communication Technology (ICT) Royal Institute of Technology Stockholm, Sweden 2 Abstract Network virtualization is becoming increasingly significant as other forms of virtualization constantly evolve. The cost of deploying experimental network topologies, the strict enterprise traffic isolation requirements as well as the increasing processing power requirements for virtualized servers make virtualization a key factor in both the research sector as well as the industry, the enterprise network and the datacenter. The definition of network virtualization as well as its manifestations vary widely and depend on the requirements of the environment in which it is deployed. This works sets the foundation towards a network virtualization framework based on a flow-based controlled network protocol like Openflow. 3 Abstract Så småningom, har nätverk virtualization blivit signifikant. Hög kostnaden för att utveckla experimentella nätverk topologier, noggranna kraven för en effektiv trafik isolering samt ökande centralenhets...

Words: 21351 - Pages: 86

Premium Essay

Ccna

...connection Virtual Circuit The OSI Model As you study this section, answer the following questions:       What is the OSI model and why is it important in understanding networking? How does the third OSI model layer relate to administering routers? Which OSI model layer is concerned with MAC addresses? What protocols correspond to the Presentation and Session layers? What is the difference between the TCP and UDP protocols? What is the EIA/TIA 232 protocol concerned with? This section covers the following exam objectives:    103. Use the OSI and TCP/IP models and their associated protocols to explain how data flows in a network 105. Describe the purpose and basic operation of the protocols in the OSI and TCP models 110. Identify and correct common network problems at layers 1, 2, 3 and 7 using a layered model approach OSI Model Facts The OSI model classifies and organizes the tasks that hosts perform to prepare data for transport across the network. You should be familiar with the OSI model because it is the most widely used method for understanding and talking about network communications. However, remember that it is only a theoretical model that defines standards for programmers and network...

Words: 73801 - Pages: 296

Premium Essay

Computer Tricks

...EC-Council Press | The Experts: EC-Council EC-Council’s mission is to address the need for well educated and certified information security and e-business practitioners. EC-Council is a global, member based organization comprised of hundreds of industry and subject matter experts all working together to set the standards and raise the bar in Information Security certification and education. EC-Council certifications are viewed as the essential certifications needed where standard configuration and security policy courses fall short. Providing a true, hands-on, tactical approach to security, individuals armed with the knowledge disseminated by EC-Council programs are securing networks around the world and beating the hackers at their own game. The Solution: EC-Council Press The EC-Council | Press marks an innovation in academic text books and courses of study in information security, computer forensics, disaster recovery, and end-user security. By repurposing the essential content of EC-Council’s world class professional certification programs to fit academic programs, the EC-Council | Press was formed. With 8 Full Series, comprised of 27 different books, the EC-Council | Press is set to revolutionize global information security programs and ultimately create a new breed of practitioners capable of combating this growing epidemic of cybercrime and the rising threat of cyber war. This Certification: C|EH – Certified Ethical Hacker Certified Ethical Hacker is a certification...

Words: 61838 - Pages: 248

Premium Essay

Computer Engineer

...Understanding Networks and their Building Blocks * 1-1 Introduction to Networks * 1-2 Networking Types * 1-3 OSI Reference Model * 1-4 TCP/IP Model * 1-5 Ethernet Technologies and Cabling * 1-6 Cisco 3 Layer Model * 1-7 Summary * Chapter 2 – IP Addressing and Subnets * 2-1 IP Addresses – Composition, Types and Classes * 2-2 Private and Public IP addresses * 2-3 Subnetting * 2-4 Variable Length Subnet Masks (VLSM) * 2-5 Route Summarization * 2-6 Troubleshooting IP Addressing * Chapter 3 Introduction to Cisco Routers, Switches and IOS * 3-1 Introduction to Cisco Routers, Switches, IOS & the Boot Process * 3-2 Using the Command-Line Interface (CLI) * 3-3 Basic Configuration of Router and Switches * 3-4 Configuring Router Interfaces * 3-5 Gathering Information and Verifying Configuration * 3-6 Configuring DNS & DHCP * 3-7 Saving, Erasing, Restoring and Backing up Configuration & IOS File * 3-8 Password Recovery on a Cisco Router * 3-9 Cisco Discovery Protocol (CDP) * 3-10 Using Telnet on IOS * 3-11 CCNA Lab #1 * Chapter 4 Introduction to IP Routing * 4-1 Understanding IP Routing * 4-2 Static, Default and Dynamic Routing * 4-3 Administrative Distance and Routing Metrics * 4-4 Classes of Routing Protocols ...

Words: 95744 - Pages: 383

Free Essay

Cisco Ccnp Security Training

...Table of Contents Chapter 1 Evaluating the Cisco ASA VPN Subsystem .......................................3 Chapter 2 Deploying Cisco ASA IPsec VPN Solutions ............................. 42 Chapter 3 Deploying Cisco ASA AnyConnect Remote-Access SSL VPN Solutions..............................109 Chapter 4 Deploying Clientless RemoteAccess SSL VPN Solutions ................148 Chapter 5 Deploying Advanced Cisco ASA VPN Solutions .............................184 CCNP Security VPN 642-648 Quick Reference Cristian Matei ciscopress.com [2] CCNP Security VPN 642-648 Quick Reference About the Author Cristian Matei, CCIE No. 23684, is a senior security consultant for Datanet Systems, Cisco Gold Partner in Romania. He has designed, implemented, and maintained multiple large enterprise networks, covering the Cisco security, routing, switching, service provider, and wireless portfolios of products. Cristian started this journey back in 2005 with Microsoft technology and finished the MCSE Security and MCSE Messaging tracks. He then joined Datanet Systems, where he quickly obtained his Security and Routing & Switching CCIE, among other certifications and specializations, such as CCNP, CCSP, and CCDP. Cristian has been a Cisco Certified Systems Instructor (CCSI) since 2007, teaching CCNA, CCNP, and CCSP curriculum courses. In 2009, he received a Cisco Trusted Technical Advisor (TTA) award and became certified as a Cisco IronPort Certified Security Professional (CICSP) on E-mail...

Words: 52748 - Pages: 211