This is an old revision of the document!
First, make sure that your virtual machine is updated (run the provided update.sh script, or create one).
root@cdci:/# cat update.sh #!/bin/bash # (c) Mihai Chiroiu - CDCI git clone -b labs --single-branch https://github.com/mihai-chiroiu/cdci.git git config user.email "student@upb.ro"
Next, in one terminal start the provided Mininet topology.
root@cdci:/# cd cdci/lab05 root@cdci:/# /usr/bin/python3 topology.py
If there are any problems with starting the topology (if all is good you should see the Mininet prompt ”>”) use the given cleanup script and try to restart the topology.
Before you begin, make sure that you have Internet connectivity on all two nodes. R1 should be the gateway for the all of them. Write down the IP addresses of all the nodes (including the gateway). Use the provided scripts to access the nodes.
Download the following archive and extract it both nodes (Hint: wget is installed). https://ocw.cs.pub.ro/courses/_media/cdci/labs/upb-vs-harvard.zip . Download the archive also on your local computer and inspect the images.
root@ip-172-30-0-165:/# ./h1.sh root@attacker:/# root@ip-172-30-0-165:/# ./h2.sh root@victim:/#
The openssl tool provides different mechanisms to encrypt data using symmetric cyphers. List all the available cyphers and modes of operation. Encrypt the ‘This is a cool lab’ text using aes-256-cbc mode and the password ‘thisisasupersecretpassword’. The output of the previous command is a not human-readable and cannot be easily used, add the ‘-base64’ parameter and verify the output.
In this exercise we will show how using a wrong encryption mode can break the encryption scheme. Let us try to encrypt the upb.bmp image using the AES-256-ECB mode.
Symmetric encryption is typically used for encrypting data, hashing is used for data integrity and asymmetric encryption is used for authentication. We can use ‘openssl dgst’ tool for signing files using DSA.
7. Asymmetric encryption schemes are used in certificates to authenticate and encrypt data in transit. In this exercise we are going to create a CSR (Certificate Signing Request), which includes the public key of your server. Note that this CSR must be signed by a Certificate Authority before being used. a. Generate a 2048 bits private-public RSA key. Note, that while in practice the private key should be protected using a symmetric key, in this lab we assume that you don’t. Display the public key part of the generated pair. How about the private one? b. Use the previously generated key and create a new CSR that should be saved to the ‘ServerCertificateRequest.csr’ file. c. Print the public key stored in the CSR certificate and compare it with the one generated in the first step.
8. In this exercise you will be required to analyze an already signed certificate from the cisco.com website. a. Use the s_client suite from openssl and download the certificate locally. Note that there might be a chain of certificates, save each one in a different file. b. What is the public key of the cisco.com server? Compare it to the one viewed in browser (use Firefox for a simplified view). c. The chain downloaded include three certificates, use ‘openssl verify’ to test the correctness of each certificate in the path. Test the first level against the second, the second against the third, and the third against the machine. Does the verification of cisco.com certificate work without the fullchain?