Myon - SISR, 2022 session

Task A1 - Video surveillance network study

Equipment to represent and their VLANs (document 4):

Equipment	VLAN	Network
12 Lesquin IP cameras	70 (VIDEO)	192.168.70.0/24
4 Mâcon IP cameras	71 (VIDEO-MAC)	192.168.71.0/24
NVR4432 recorder	70 (port 5 on SW2)	192.168.70.0/24
XG-7100 switches (SW1 / SW21)	inter-VLAN routing + firewall	—
IPsec VPN tunnel Lesquin ⇄ Mâcon	carries VLAN 71 to the NVR	—

Flows: Lesquin cameras (VLAN 70) → SW1-2/SW1-3 → NVR (same VLAN 70); Mâcon cameras (VLAN 71) → SW21 → IPsec VPN → SW1 → NVR.

• From the Internet: cameras are on dedicated VLANs (70/71) not routed to the WAN; no NAT/port forwarding rule exposes them (doc A2 only redirects traffic to DMZ 192.168.51.1), and the XG-7100 firewall blocks by default (rule 9999 deny). The Mâcon cameras pass through the encrypted IPsec VPN tunnel, inaccessible from the outside.
• Malicious local user: VLAN segmentation isolates the video network from user networks; a workstation on another VLAN only reaches VLAN 70 if the inter-VLAN firewall allows it, which is not the case.

Task A2 - Migrating and securing a business application

The application is reachable from the outside via port 5433 → 5000 redirected to DMZ 192.168.51.1 (doc A2/A3). Internal traffic (port 5000) must be redirected from Lxd1 to Lxd2: modify the internal destination NAT address in the port forwarding rule (and/or the DHCP reservation) to point to Lxd2. WAN filtering rules (NAT 5433→5000, allow 5000 to the DMZ) remain unchanged because they target the DMZ gateway address, not the server's own IP.

The attack originates from IPs 193.14.78.1 and 5.49.250.12 on port 443. Two explicit block rules are added:

Number	Protocol	Source IP	Src port	Dest IP	Dest port	Rule
5	tcp	193.14.78.1	*	192.168.51.1	443	deny
6	tcp	5.49.250.12	*	192.168.51.1	443	deny

Placement: at the top of the table, BEFORE rule 20 (allow 443). A firewall applies the first matching rule; placed after the allow rule, they would be ineffective. Hence numbers (5 and 6) lower than rule 20.

fail2ban. It monitors logs (web server/firewall), detects repeated authentication failures from the same IP, and dynamically bans the address (temporary firewall rule). Advantages: automation (no need to add each IP manually, which an attacker bypasses by changing address), configurable thresholds and durations, near-real-time response: it handles source IP variability that static filtering does not cover.

Section	Reference(s)	Justification
Element	[ i1 ] Server	the attack targets a web server (Lxd1)
Nature	[ n20 ] Attempted cyberattack + [ n11 ] Unauthorised access	brute force / fraudulent authentication
Data compromised?	[ c2 ] No	the attack failed
HR contacted?	[ r2 ] No	no harassment
Emergency measures	[ u7 ] Other: "Blocking source IPs on the firewall + fail2ban"	measure implemented

([ i11 ] and [ n24 ] not required here; [ u7 ] takes the descriptive sentence.)

a) In promiscuous mode, the interface accepts and passes all frames on the segment to the system, including those not addressed to its own MAC address (instead of filtering them). Essential for an IDS sensor to analyse all traffic.

b) A switch only forwards traffic intended for each specific port. For the Snort sensor (port 23, Debian Snort) to see all DMZ traffic, configure port mirroring (SPAN) on SW2: mirror the DMZ ports (Lxd1 = port 21, Lxd2 = port 22, SW1 uplink) to port 23.

Ping uses ICMP. The Lxd1/Lxd2 servers are in the DMZ (192.168.51.0/24). First custom rules → sid ≥ 1000001 (doc A6). One rule per server (or a single rule for the DMZ network):

alert icmp any any -> 192.168.51.21 any (msg:"Ping vers serveur web Lxd1"; sid:1000001; rev:1;)
alert icmp any any -> 192.168.51.22 any (msg:"Ping vers serveur web Lxd2"; sid:1000002; rev:1;)

(Condensed variant: alert icmp any any -> 192.168.51.0/24 any (msg:"Ping vers serveurs web DMZ"; sid:1000001; rev:1;).)

Mission A3 - Securing the wireless network (Wi-Fi)

• Individual authentication (WPA2-Enterprise/802.1X): each mechanic authenticates with their AD account instead of a shared passphrase (WPA-PSK) known to everyone and not individually revocable.
• Centralisation and traceability: accounts are managed in the directory; user logins are tracked; immediate revocation when an employee leaves without changing the key for everyone (NPS reuses the existing identity).

1. WPA2-Enterprise (802.1X) with AES-CCMP encryption (dropping WPA-PSK).
2. MAC address filtering (MAC ACL, doc A7) to only allow known tablets.
3. VLAN 80 segmentation: maintain the lack of Internet access for tablet Wi-Fi.
4. Transmission power reduction (limiting signal spillover outside the premises) and monitoring for rogue access points (rogue APs).

Any organisation providing access (Wi-Fi connection logs) is treated as an access provider - LCEN Art. 6-II, decree of 24 March 2006 and the anti-terrorism law of 23 January 2006 (doc A8): obligation to retain technical connection data for 1 year (date/time, MAC address, method), followed by anonymisation. This data does not reveal the content of communications and its processing complies with GDPR.

• Regulations: collecting name, company, email address = personal data processing (GDPR) → visitor notice, specified purpose, limited retention, lawful basis. The log retention requirement (1 year) remains: log the voucher ↔ visitor assignment to identify anyone responsible for misuse.
• Security: isolated guest Wi-Fi (separate VLAN, no access to internal network or servers), temporary access (time-limited voucher, single-use). The captive portal must not expose other VLANs.

Mission B1 - Improving storage server reliability

a) RAID 0 only stripes data across the 12 disks (performance): no redundancy. A single disk failure causes total data loss → no reliability.

b) Usable capacity (12 × 2 TB = 24 TB raw):

Level	Fault tolerance	Usable capacity	Suitable?
RAID 5	1 disk	(12-1) × 2 = 22 TB	yes
RAID 6	2 disks	(12-2) × 2 = 20 TB	recommended
RAID 10	1 per mirror	24/2 = 12 TB	no (less than 18 TB)

→ RAID 6: better reliability (tolerates 2 simultaneous failures, real risk of a double failure during rebuild with 12 disks) and 20 TB usable ≥ 18 TB required. RAID 10 (12 TB) is insufficient.

RAID 5 is not a backup: it protects against single disk failure, but not against file deletion or alteration (human error, malice, ransomware), logical corruption, disasters (fire, theft), or double failure. Backing up to the NAS provides an independent, versioned copy that can be restored in case of logical loss or disaster.

• Legal: data governed by French/EU law → GDPR applies, out of reach of extraterritorial legislation (Cloud Act); sovereignty and sector-specific requirements.
• Technical: low latency with Lesquin (better backup throughput), French-language support/SLA, potential compliance (SecNumCloud / HDS).

SFTP (or SCP), encapsulated in SSH: encrypted transfer (confidentiality + integrity) with key-based authentication, unlike FTP/HTTP (cleartext). SFTP is preferable to FTPS (single port, simple firewall traversal) for automated backups.

Mission B2 - Implementing privilege delegation (sudo)

sudo allows a user to run only specific commands with root privileges, without sharing the root password or granting full access. Each IT technician logs in with their own account and only receives privileges for necessary commands (alias NET: ifup/ifdown, editing interfaces/resolv.conf). The minimum required permissions are granted, with traceability (who ran what and when) and NOEXEC blocking shell escapes.

a) Risk: in sudo versions prior to 1.9, a user authorised to run a command as any user other than root could bypass the restriction using sudo -u#-1 commande. UID -1 does not exist but is interpreted as 0 = root → execution with root privileges = unintended privilege escalation.

b) Affected machines: all Linux servers running sudo ≤ 1.8.x where delegation allows execution as a specific target user (SRV1, Debian10, Debian Snort, Lxd1, Lxd2, LxdTest). Windows machines are not affected (no sudo).

• Line 3 - stores in empreinteAttendue the reference hash of the .deb published by the vendor (trusted value).
• Line 4 - calculates the actual hash of the downloaded file (sha1sum).
• Line 5 - compares both; if they match, the file is authentic and intact (not corrupted/altered) and only then is it installed (dpkg -i).

These lines verify the integrity and authenticity of the package before installation.

Note: line 3 provides a 64-character hash (SHA-256) whereas line 4 uses sha1sum (SHA-1, 40 chars) - an algorithm mismatch; and the comparison should use = (strings) rather than -eq (numeric). The principle remains valid.

Mission B3 - Securing email

a) TLS encrypts the channel between client (Outlook) ⇄ server: confidentiality (a network attacker reads neither traffic nor passwords), communication integrity, and server authentication (certificate). It protects the transmission of emails and credentials.

b) No. TLS only secures transport. If credentials/passwords are stolen, the attacker logs in to the mailbox and reads all emails stored in plain text on the server. TLS does not protect content at rest or against fraudulent authenticated access: end-to-end encryption is required.

End-to-end encryption (recipient's public key, private key on BIP badge - doc B6), compared to TLS alone:

• End-to-end confidentiality: only the recipient (private key on smart card) reads the message; it remains encrypted at rest on servers, unreadable even if credentials are stolen or the server is compromised.
• Authenticity / non-repudiation: combined with a signature (sender's private key), it proves the origin and integrity of the message.
• Access control: since the private key is on the personal badge, the email cannot be read without the card.