¼Ö¶ó¸®½º ³×Æ®¿÷ Ä¿³Î º¸¾È Æ©´×
ÀÛ¼ºÀÚ °ü¸®ÀÚ ÀÛ¼º½Ã°£ 2003-10-07 12:10:18
 

Solaris Network Kernel Tunning for Security

cert@certcc.or.kr, http://www.certcc.or.kr

±è»óö¿¬±¸¿ø ksch@certcc.or.kr

1. ¼Ò°³

Solaris KernelÀº TCP/IP½ºÅÿ¡ ¿©·¯°¡Áö »ç¿ëÀÚ ÀÎÅÍÆäÀ̽º¸¦ Á¦°øÇÑ´Ù. Cache Å×À̺íÀÇ Lifetime ¹× ´Ù¼öÀÇ TCP ¿¬°á¿¡ ´ëÇÑ ¿©·¯°¡Áö ¿É¼ÇÀ» ÅëÇÏ¿© Kernel ParameterÀÇ ¼³Á¤ ¹× Á¦¾î°¡ °¡´ÉÇÏ´Ù. ÇÏÁö¸¸ ÀÌ·¯ÇÑ Kernel ParameterµéÀ» TunningÇϱâ À§ÇÏ¿© °¢°¢ÀÇ kernel parameterµé¿¡´ëÇÑ Á¤È®ÇÑ ±â´ÉµéÀÇ ÀÌÇØ°¡ ¹Ýµå½Ã ¿ä±¸µÇ¾îÁø´Ù. ±×¸®°í ¸¹Àº ½Ã½ºÅÛ°ü¸®ÀÚµéÀº ÀÌ·¯ÇÑ Kernel ParameterµéÀ» »ç¿ë ¹× ¼³Á¤ÇÏ´Â µîÀÇ ÀÏ·ÃÀÇ Security ¾÷¹«¿¡ ¼ÒȦÈ÷ ÇØ¿Ô´Ù. ÀÌ º¸°í¼­¿¡¼­´Â solaris¿¡¼­ Á¦°øµÇ¾îÁö´Â Network Security Kernelµé¿¡ °ü·ÃÇÏ¿© ¿Ã¹Ù¸£°Ô ÀÌÇØÇØ°í ¼³Á¤ÇÏ¿© TunningÇÏ´Â ¹æ¹ýÀ» ¼Ò°³ÇÏ°íÀÚ ÇÑ´Ù.

2. Solaris Kernel Tools

solaris¿¡¼­´Â TCP/IP Ä¿³Î¿¡ ´ëÇÑ µå¶óÀ̹ö·Î¼­ "ndd"°¡ À¯ÀÏÇÑ µµ±¸À̸ç Solaris ½Ã½ºÅÛÀÇ ³×Æ®¿öÅ© Ä¿³Î º¯¼öµéÀ» TunningÇϱâ À§ÇÑ °¡Àå À¯¿ëÇÑ ToolÀÌ "ndd"ÀÌ´Ù.

3. Solaris ³×Æ®¿öÅ© Ä¿³Î º¯¼öµé

ÀϹÝÀûÀ¸·Î TCP/IP Ä¿³Î¿¡ ´ëÇÑ º¯¼öµéÀ» º¸´Â ¹æ¹ýÀº ´ÙÀ½°ú °°Àº ¸í·É¾î¸¦ ½ÇÇàÇÔÀ¸·Î½á °¡´ÉÇÏ´Ù.

# ndd /dev/<driver> <parameter>

¿©±â¼­ TCP/IP Ä¿³Î¿¡ ´ëÇÏ¿© <driver>´Â ARP, IP, TCP, UDPÁß¿¡ ÇϳªÀÌ¸ç °¢°¢ÀÇ µå¶óÀ̹ö¿¡ ´ëÇÏ¿© ¸ðµç º¯¼öµéÀ» º¸´Â ¸í·É¾î´Â ´ÙÀ½°ú °°´Ù.

# ndd /dev/<driver> \?

IP µå¶óÀ̹ö¿¡ ´ëÇÑ ¸í·É¾î¸¦ ½ÇÇàÇÏ¸é ´ÙÀ½°ú °°ÀÌ Ãâ·ÂµÈ´Ù.

[phoenix:root]:/ >ndd /dev/ip \?

? (read only)

ip_forwarding (read and write)

ip_respond_to_address_mask_broadcast(read and write)

ip_respond_to_echo_broadcast (read and write)

ip_respond_to_timestamp (read and write)

ip_respond_to_timestamp_broadcast(read and write)

ip_send_redirects (read and write)

ip_forward_directed_broadcasts(read and write)

ip_debug (read and write)

ip_mrtdebug (read and write)

ip_ire_cleanup_interval (read and write)

ip_ire_flush_interval (read and write)

ip_ire_redirect_interval (read and write)

ip_def_ttl (read and write)

ip_forward_src_routed (read and write)

ip_wroff_extra (read and write)

ip_ire_pathmtu_interval (read and write)

ip_icmp_return_data_bytes (read and write)

ip_send_source_quench (read and write)

ip_path_mtu_discovery (read and write)

ip_ignore_delete_time (read and write)

ip_ignore_redirect (read and write)

ip_output_queue (read and write)

ip_broadcast_ttl (read and write)

ip_icmp_err_interval (read and write)

ip_reass_queue_bytes (read and write)

ip_strict_dst_multihoming (read and write)

ip_addrs_per_if (read and write)

ip_ill_status (read only)

ip_ipif_status (read only)

ip_ire_status (read only)

ip_ipc_status (read only)

ip_rput_pullups (read and write)

ip_enable_group_ifs (read and write)

ndd¸¦ »ç¿ëÇÏ¿© Ä¿³Î º¯¼ö¸¦ ¼³Á¤Çϱâ À§ÇÏ¿©´Â ´ÙÀ½°ú °°ÀÌ ¸í·É¾î¸¦ ½ÇÇàÇÏ¸é µÈ´Ù.

# ndd -set /dev/<driver> <parameter> <value>

ndd¸¦ »ç¿ëÇÏ¿© Ä¿³Î º¯¼ö¸¦ º¯°æÇÒ¶§´Â ÁÖÀÇÇÏ¿©¾ß ÇÒ »çÇ×ÀÌ ÀÖ´Ù. Çѹø ¼³Á¤µÈ parameter´Â ½Ã½ºÅÛÀ» ÀçºÎÆÃÇÒ °æ¿ì¿¡´Â ÀÌÀü¿¡ ¼³Á¤µÈ °ªÀÌ ¿ø·¡ÀÇ ±âº»¼³Á¤°ªÀ¸·Î º¯°æµÈ´Ù´Â Á¡ÀÌ´Ù. ¼³Á¤µÈ °ªÀ» °è¼ÓÀûÀ¸·Î »ç¿ëÇϱâ À§Çؼ­´Â ½Ã½ºÅÛ °ü¸®ÀÚ°¡ shell scriptµîÀ» ÀÌ¿ëÇؼ­ ½Ã½ºÅÛ ºÎÆýà ÀÚµ¿À¸·Î ½Ã½ºÅÛ°ü¸®ÀÚ°¡ ¿øÇÏ´Â ¼³Á¤°ªÀ¸·Î ¼³Á¤µÇ°Ô ¿î¿µÇÏ¿©¾ß ¸¹´Ù. ¿¹¸¦µé¾î /etc/init.d/inetinit³ª °³º°ÀûÀÎ shell script·Î ¿î¿µÇÏ¿©¾ß¸¸ ÇÑ´Ù.

4. ARP (Address Resolution Protocol)

ARP´Â Layer3ÀÇ ³×Æ®¿öÅ© ÁÖ¼Ò¸¦ data-link ÁÖ¼Ò(MAC Address)·Î µ¿Àû ¸ÊÇÎ(mapping)Çϴµ¥ »ç¿ëµÈ´Ù. ÇϳªÀÇ ½Ã½ºÅÛÀÌ ÇÑ ³×Æ®¿öÅ© »ó¿¡¼­ ´Ù¸¥ ½Ã½ºÅÛ°ú Åë½ÅÇÏ°íÀÚ ÇÑ´Ù¸é broadcastÁÖ¼ÒÀÎ ff:ff:ff:ff:ff:ff·Î ARP ÆÐŶÀ» ù¹ø°·Î º¸³½´Ù. ±× ÆÐŶÀº ´Ü¼øÇÑ ÆÐŶÀ¸·Î¼­ ÇØ´ç ÁÖ¼Ò¸¦ ¾î¶² ½Ã½ºÅÛÀÌ »ç¿ëÇÏ°í ÀÖ´ÂÁö¿¡ ´ëÇÑ ÁúÀÇ ÆÐŶÀÌ´Ù. ¿¹¸¦ µé¾î ´©°¡ ÁÖ¼Ò A¸¦ »ç¿ëÇÏ°í ÀÖ´ÀÁö¿¡ ´ëÇÏ¿© ARPÆÐŶÀ» broadcastÇϸé, ÇÑ network »ó¿¡ Á¸ÀçÇÏ´Â ¸ðµç È£½ºÆ®µéÀÌ ÀÌ ÆÐŶÀ» ¼ö½ÅÇÏ°Ô µÈ´Ù. À̶§ ½Ã½ºÅÛ A´Â ARP ¿ä±¸¿¡ ´ëÇÑ ÀÀ´äÀ¸·Î¼­ ´äÀ» º¸³»°ÔµÈ´Ù. ARP BroadcastÆÐŶÀ» º¸³Â´ø ÇØ´ç ½Ã½ºÅÛÀº 32bit IPÁÖ¼Ò¸¦ layer-2ÀÎ MACÁÖ¼Ò·Î ¸ÅÇÎÇϸ鼭 table°ú cache¸¦ ±¸¼ºÇÏ¿© ¿î¿µÇÏ°Ô µÈ´Ù. À̶§ ÇØ´ç ½Ã½ºÅÛÀº network layer¿¡ÀÇÇÑ µÎ¹ø° Å×À̺íÀ» ±¸¼ºÇÏ°Ô µÈ´Ù. ÀÌ Å×À̺íÀº data-link layer¿¡ÀÇÇØ Á¦°øµÇ¾îÁö´Â Á¤º¸·ÎºÎÅÍ ±¸¼ºµÇ¾îÁö¸ç, È°¼ºÈ­µÈ ¿¬°á¿¡´ëÇÑ ³×Æ®¿öÅ© ¶ó¿ìÆà Á¤º¸¸¦ Æ÷ÇÔÇÏ°í ÀÖ´Ù. network layer´Â data-link layer·ÎºÎÅÍ MACÁÖ¼Ò¸¦ ¿äûÇϸç, ¿äûµÈ °á°ú·ÎºÎÅÍ ¼ö½ÅµÈ ÀÌ·¯ÇÑ ÁÖ¼Ò¸¦ ³×Æ®¿öÅ© ¶ó¿ìÆà Å×ÀÌºí¿¡ ÀúÀåµÇ¾îÁø´Ù. Network layerÀÇ Á¤º¸´Â 20ºÐ ÈÄ¿¡ ¸¸·áµÈ´Ù.

ÇϳªÀÇ ³×Æ®¿öÅ©¿¡¼­ È£½ºÆ®´Â ´Ù¸¥ ½Ã½ºÅÛ°ú Åë½ÅÇϱ⠿ìÈ÷¾Æ¿© ù¹ø°·Î IP layerÀÇ ARP cache¸¦ üũÇÑ´Ù. À̶§ ³×Æ®¿öÅ© peer¿¡´ëÇÑ ¿£Æ®¸®°¡ cache¿¡ Á¸ÇØÇÏÁö ¾ÊÀ¸¸é ARP ¿äûÀÌ broadcastµÇ¾î Áø´Ù. ARP Cache ¿£Æ®¸®´Â 5ºÐÈÄ¿¡ ¸¸·áµÈ´Ù. ARP Cache¸¦ ÀÌ¿ëÇÑ °ø°ÝÀº µÎ°¡Áö Á¾·ù°¡ ÀÖ´Ù. Çϳª´Â ARP cache poisoningÀÌ¸ç ´Ù¸¥ Çϳª´Â ARP spoofingÀÌ´Ù.

ARP cache poisoningÀº Á¸ÀçÇÏÁö ¾Ê´Â ARPÁÖ¼Ò³ª, À߸øµÈ ARPÁÖ¼Ò¸¦ ½Ã½ºÅÛÀÇ ARP cache¿¡ »ðÀÔ½ÃÅ°´Â °ÍÀÌ´Ù. ÀÌ°ÍÀº target½Ã½ºÅÛÀÌ peerÀÇ IPÁÖ¼Ò·Î ÆÐŶÀ» º¸³»Áö¸¸ MACÁÖ¼Ò°¡ À߸øµÇ¾î Àֱ⶧¹®¿¡ ÇØ´ç ½Ã½ºÅÛÀ¸·Î ÇÏ¿©±Ý ¼­ºñ½º °ÅºÎ¸¦ ÀÏÀ¸Å³¼ö ÀÖ´Ù,

ARP spoofingÀº system compromise°á°ú¸¦ ÃÊ·¡ÇÒ ¼ö ÀÖ´Ù. IP spoofingó·³ ARP spoofingÀº ³×Æ®¿öÅ©»ó¿¡ Á¸ÀçÇÏ´Â ÇϳªÀÇ È£½ºÆ®¸¦ ³×Æ®¿öÅ© ±â´ÉÀ» Á¤»óÀûÀ¸·Î ó¸®ÇÏÁö ¸øÇÏ°Ô Çؼ­ ¸ðµç ARP ¿äû broadcast¿¡ ´ëÇÑ ÀÀ´äÀ» ¸øÇϵµ·Ï ÇÑ´Ù. ÀÌ°ÍÀÌ ÇàÇØÁö±â¸¸ ÇÏ¸é °ø°ÝÀÚ´Â ¹«´É·ÂÇØÁø È£½ºÆ®ÀÇ IPÁÖ¼Ò¸¦ °ø°Ý È£½ºÆ®·Î¼­ ±¸¼ºÇÏ¿© »ç¿ëÇÒ ¼ö°¡ ÀÖ°Ô µÇ¾îÁø´Ù. ÇÇÇØ È£½ºÆ®°¡ ¹«´É·ÂÇØÁø È£½ºÆ®¿Í Åë½ÅÇÏ·Á ÇÒ¶§ °ø°ÝÀÚÀÇ ½Ã½ºÅÛÀÌ ¸ðµç ARP broadcastÀÇ ¿äû¿¡ ÀÀ´äÇÏ°Ô µÈ´Ù. ÀÌ·¸°Ô ÇÏ¸é ±×°ÍÀÇ MACÁÖ¼Ò°¡ ÇÇÇؽýºÅÛÀÇ ARP Cache¿¡ ÀúÀåµÇ¾îÁö°Ô µÇ¼­ ÇÇÇؽýºÅÛÀº disableµÈ ½Ã½ºÅÛÀÌ °ø°ÝÀÚÀÇ ½Ã½ºÅÛÀ¸·Î ¾Ë°ÔµÇ¼­ °ø°Ý½Ã½ºÅÛ°ú ÇÇÇؽýºÆÀ°úÀÇ Á¤»óÀûÀÎ Åë½ÅÀÌ °¡´ÉÇÏ°Ô µÇ¾îÁø´Ù.

ARP °ø°Ý¿¡ ´ëÀÀÇϱâ´Â ¸Å¿ì ¾î·Æ´Ù. ARP°ø°Ý¿¡ ´ëÇÑ ÇÑ°¡Áö ´ëÀÀ¹æ¹ýÀº cache ¿£Æ®¸®ÀÇ lifetimeÀ» ÁÙÀÌ´Â °ÍÀÌ´Ù. cache lifetimeÀº ³×Æ®¿öÅ© Ä¿³Î º¯¼öÀÎ arp_cleanup_interval¿¡ ÀÇÇÏ¿© °áÁ¤µÇ¾î Áø´Ù. IP routing Å×ÀÌºí ¿£Æ®¸®ÀÇ lifetimeÀº Ä¿³Î º¯¼öÀÎ ip_ire_flush_interval¿¡ ÀÇÇؼ­ Á¶Á¤µÇ¾î Áú ¼ö ÀÖ´Ù. ÀÌ¿¡ ´ëÇÑ Ä¿³Î º¯¼ö´Â ´ÙÀ½°ú °°Àº ¸í·É¾îÀÇ ½ÇÇà¿¡ ÀÇÇؼ­ °¡´ÉÇÏ´Ù.

# ndd -set /dev/arp arp_cleanup_interval <time>

# ndd -set /dev/ip ip_ire_flush_interval <time>

¿©±â¼­ timeÀº millisecond¸¦ ÀǹÌÇÑ´Ù. ARP Cache ¸¸·á ¹× IP routing Å×À̺íÀÇ ¸¸·á½Ã°£À» ÁÙÀÌ´Â °ÍÀº °ø°ÝÀÇ ÇÇÇظ¦ ÁÙÀϼö ´Â ÀÖÀ¸³ª ±Ùº»ÀûÀÌ ÇØ°áÃ¥Àº ¾Æ´Ï´Ù. ¶Ç´Ù¸¥ ¿É¼ÇÀº ÀϺΠ½Ã½ºÅÛ¿¡ ´ëÇÏ¿© Á¤Àû(static)ÀÎ ARP ÁÖ¼Ò¸¦ »ç¿ëÇÏ¸é °¡´ÉÇÏ´Ù. Á¤ÀûÀÎ ARP cache ¿£Æ®¸®´Â ¿µ±¸ÀûÀ̾ ¸¸·áµÇÁö ¾Ê´Â´Ù. ÀÌ·¯ÇÑ Á¤ÀûÀÎ entry´Â ¸í·É¾î arp -d¸¦ »ç¿ëÇÏ¿© Á¦°ÅµÇ¾î Áú¼ö ÀÖ´Ù.

5. IP Parameters

Solaris Ä¿³ÎÀº IP ³×Æ®¿öÅ© ÇÁ·ÎÅäÄÝÀÇ ´Ù¾çÇÑ Æ¯Â¡µé¿¡ ´ëÇÑ Á¦¾î¹æ¹ýÀ» Á¦°øÇÑ´Ù. ÀÌ·¯ÇÑ ±â´ÉµéÀº ¸î¸îÀÇ ÆĶó¹ÌÅ͵éµéÀ» ÅëÇÏ¿© Á¦°øµÈ´Ù. ¸¹ÀÌ »ç¿ëµÇ´Â parameterµéÀº ´ÙÀ½°ú °°´Ù

ip_forwarding

ip_strict_dst_multihoming

ip_forward_directed_broadcasts

ip_forward_src_routed

IP forwardingÀº µ¿ÀÏ ½Ã½ºÅÛ¿¡ µÎ°³ÀÌ»óÀÇ ³×Æ®¿öÅ© ÀÎÅÍÆäÀ̽º»çÀÌ¿¡ IP ÆÐŶµéÀ» ¶ó¿ìÆÃÇÏ´Â °ÍÀ» ÀÏÄƴ´Ù. ÀüÇüÀûÀ¸·Î·Î ÀÌ·¯ÇÑ ±â´ÉÀº ¶ó¿ìÅÍÀÇ ±â´É°ú µ¿ÀÏÇÏ´Ù. Solaris¸¦ °¡Áö°í ¼³Ä¡µÈ ½Ã½ºÅÛÀº ÀÌ·¯ÇÑ IP ForwardingÀ» Àß ¼öÇàÇÑ´Ù. ÀÌ·¯ÇÑ IP forwardingÀº ip_forwarding ÆĶó¹ÌÅÍÀ» 0À¸·Î ¼¼ÆÃÇÏ¿© Â÷´ÜÇÒ ¼ö ÀÖ´Ù. IP Forwarding±â´ÉÀ» Â÷´ÜÇϱâ À§ÇÑ ¸í·É¾î´Â ´ÙÀ½°ú °°´Ù.

#ndd -set /dev/ip ip_forwarding 0

ħÀÔÀÚ´Â IP ÆÐŶµéÀ» forwardingÇÏÁö ¾Ê´Â multihomed server¿¡ ¿¬°áµÈ ³×Æ®¿öÅ© °æ·Î·Î ÆÐŶµéÀ» ¹ß»ý ½ÃÅ°´Â ¶Ç´Ù¸¥ °ø°ÝÀÌ ÀÖÀ» ¼ö ÀÖÀ¸¹Ç·Î ÀÌ·¯ÇÑ °ø°ÝÀ» Â÷´ÜÇϱâ À§Çؼ­´Â ½Ã½ºÅÛÀÇ IP Ä¿³Î º¯¼öÀÎ ip_strict_dst_multihomingÀ» 0À¸·Î ¼¼ÆÃÇÏ¿© Â÷´ÜÇÒ ¼ö ÀÖ´Ù. ÀÌ·¸°Ô ½Ã½ºÅÛÀ» ¼³Á¤ÇÔÀ¸·Î½á ¿¬°áµÈ ÇϳªÀÇ ³×Æ®¿öÅ©·ÎºÎÅÍ ¶Ç´Ù¸¥ ³×Æ®¿öÅ© ÀÎÅÍÆäÀ̽º·Î ¹ß»ýµÇ´Â ¸ðµç ÆÐŶµéÀÌ Â÷´ÜµÇ°Ô ÇÒ ¼ö ÀÖ´Ù. Ä¿³Î ¼³Á¤Àº ´ÙÀ½°ú °°Àº ¸í·ÉÀ¸¸¦ ½ÇÇàÇÔÀ¸·Î½á °¡´ÉÇÏ´Ù.

#ndd -set /dev/ip ip_strict_dst_multihoming 0

Directed Broadcast´Â ¿ÜºÎ ³×Æ®¿öÅ©ÀÇ ÇÑ ½Ã½ºÅÛÀ¸·ÎºÎÅÍ ¶Ç ´Ù¸¥ ³×Æ®¿öÅ©ÀÇ ¸ðµç ½Ã½ºÅÛ¿¡ º¸³»¾îÁö´Â ÆÐŶµéÀ» ¸»ÇÑ´Ù. Directed Broadcast´Â "smurf"°ø°ÝÀÇ ±Ù°£À¸·Î½á °­Á¦µÈ ICMP ÆÐŶµéÀÌ ÇϳªÀÇ È£½ºÆ®·ÎºÎÅÍ ¸®¸ðÆ® ³×Æ®¿öÅ©ÀÇ broadcast ÁÖ¼Ò·Î º¸³»¾îÁø´Ù. ICMPÆÐŶµéÀÇ Ãâ¹ßÁö ÁÖ¼Ò´Â ÇÇÇظ¦ ÀÔÈ÷°íÀÚ ÇÏ´Â ½Ã½ºÅÛÀÇ ÁÖ¼Ò¸¦ °®µµ·Ï °­Á¦·Î ¼³Á¤ÇÒ ¼ö ÀÖ´Ù. ±×·¯¸é ¿ø°ÝÀÇ ³×Æ®¿öÅ©¿¡ ÀÖ´Â ½Ã½ºÅÛµéÀº ICMP ÆÐŶµéÀ» ¹ÞÀ¸¸é ÀÌ¿¡ ´ëÇÑ ÀÀ´äÀ¸·Î¼­ ÀÀ´ä ÆÐŶÀÌ ÇÇÇØÈ£½ºÆ®·Î Àü¼ÛµÇ¾î Áø´Ù. ´ë¿ë·®ÀÇ ÆÐŶÀ» ¹ÞÀº È£½ºÆ®Àº floodingµÇ°Ô µÈ´Ù. IP forwardingÀÌ ¼³Á¤µÈ ¸ðµç ¼Ö¶ó¸®½º ½Ã½ºÅÛÀº directed broadcast¿ª½Ã forwardingÇÒ °ÍÀÌ´Ù. directed broadcastÀÇ forwarding±â´ÉÀ» ÇØÁ¦Çϱâ À§Çؼ­´Â ip_forward_directed_broadcasts Ä¿³Îº¯¼ö¸¦ 0À¸·Î ¼³Á¤ÇÏ¸é µÉ °ÍÀÌ´Ù.

#ndd -set /dev/ip ip_forward_directed_broadcasts 0

ÆÐŶµéÀÌ ÇÑ ³×Æ®¿öÅ©ÀÇ È£½ºÆ®·ÎºÎÅÍ ´Ù¸¥ È£½ºÆ®·Î Àü´ÞµÇ¾î Áú¶§, ¶ó¿ìÆü­ºñ½º¸¦ Á¦°øÇϴ ȣ½ºÆ®µéÀ̳ª Àü¿ë ¶ó¿ìÅ͵鿡 ÀÇÇØ ±×µéÀÌ °æ·Î°¡ °áÁ¤µÇ¾î Áø´Ù. ±×·¡¼­ IP´Â Ãâ¹ßÁö¿Í ¸ñÀûÁö»çÀÌ¿¡¼­ °æ·Î¸¦ ÁöÁ¤ÇÏ´Â ±â´ÉÀ» °¡Áö°í ÀÖ´Ù. ÀÌ·¯ÇÑ ±â´ÉµéÀº µÎ°¡Áö ÇüŸ¦ ÃëÇÒ ¼ö ÀÖÀ¸¸ç Çϳª´Â strict source routing·Î¼­ ÆÐŶÀÇ ¼Û½Å½Ã½ºÅÛÀÌ Ãâ¹ßÁö¿Í ¸ñÀûÁö»çÀÇÀÇ Áß°£ÀÇ ¸ðµç HOP¸¶´Ù ¶ó¿ìÆúμҸ¦ Á¦°øÇØÁÖ´Â °æ¿ì¿Í, ´Ù¸¥ Çϳª´Â loose source routingÀ¸·Î¼­ ¼Û½ÅÃøÀÇ µÎ ½Ã½ºÅÛ »çÀÌÀÇ ¸ðµç °æ·Î¸¦ ¼±ÅÃÇÔ¿¡ À־ ÀϺΠ¸î°³ÀÇ HOP¸¸ ÁöÁ¤ÇØÁÖ°í ³ª¸ÓÁö´Â ÀÚÀ¯·Ó°Ô µµ´ÞÇϵµ·Ï ÇÏ´Â ¹æ¹ýÀÌ´Ù. source routingÀº ³×Æ®¿öÅ© ÅäÆú·ÎÁö»ó¿¡¼­ º¸¾Èü°è¸¦ ¿ìȸÇϵµ·Ï »ç¿ëµÉ ¼ö ÀÖ´Ù. ¹°·Ð ÇϳªÀÇ ³×Æ®¿öÅ©»ó¿¡¼­ source-routeµÈ ÆÐŶÀº Ưº°ÇÑ °æ¿ì¸¦ Á¦¿ÜÇÏ°í´Â »ç¿ëµÇÁö ¾Ê´Â´Ù. ±×·¸±â ¶§¹®¿¡ IP ForwardingÀ»Á¦°øÇÏ´Â ¸ðµç È£½ºÆ®µéÀº Solaris kernel º¯¼öÀÎ ip_forward_src_routed¸¦ 0À¸·Î ¼¼ÆÃÇÏ¿© source-routeµÈ ÆÐŶµéÀÌ ÀÚµ¿À¸·Î µå·ÓµÇµµ·Ï ¼³Á¤ÇÏ¿© ¿î¿µÇÏ¿©¾ß ÇÑ´Ù. ¼³Á¤¹æ¹ýÀº ´ÙÀ½°ú °°´Ù.

#ndd -set /dev/IP ip_forward_src_routed 0

6. TCP Parameters

1997³â hrack MagazineÀÇ ±â»ç¿¡¼­ SYN flood·Î¼­ ¾Ë·ÁÁø ÇϳªÀÇ ¼­ºñ½º°ÅºÎ°ø°ÝÀ» ±â¼úÇÏ¿´´Ù. ÀÌ·¯ÇÑ °ø°ÝÀÇ ¸ñÀûÀº ƯÁ¤ ½Ã½ºÅÛÀ» Æı«Çϱ⠺¸´Ù´Â internetÀ̳ª intranet»ó¿¡¼­ ½Ã½ºÅÛÀÌ ³×Æ®¿öÅ© ¼­ºñ½º¸¦ ºÒ°¡´ÉÇÏ°Ô ¸¸µå´Â °ÍÀÌ´Ù. ÀÌ·¯ÇÑ ¼­ºñ½º °ÅºÎ°ø°ÝÀº TCP¿¬°áÀÇ ±âº»¹æ¹ýÀ» ÀÌ¿ëÇÏ¿© °³¹ßµÇ¾ú´Ù.

ÇϳªÀÇ ½Ã½ºÅÛÀÌ ÇÑ ¼­¹ö¿¡ TCP¸¦ »ç¿ëÇÏ¿© ¿¬°áÇÏ°íÀÚ ÇÒ¶§ sender´Â óÀ½ TCP/IP ÆÐŶ¿¡ SYN bit¸¦ ¼³Á¤ÇÏ¿© ¸ñÀûÁö¿¡ ¹ß¼ÛÇÑ´Ù. ÀÌ SYNÆÐŶÀº TCPÇì´õ¿¡ SYN°ú ACK ºñÆ®°¡ ¼³Á¤µÈ ÆÐŶÀ» °¡Áö°í ¸ñÀûÁö ½Ã½ºÅÛÀ¸·ÎºÎÅÍ ÀÀ´ä¹Þ´Â´Ù. ÀÌ ¶§ sender´Â SYN-ACKÆÐŶ¿¡ ´ëÇÑ ÀÀ´äÀ¸·Î¼­ ACKÆÐŶÀ» º¸³½´Ù. ÀÌ·¯ÇÑ ¹æ½ÄÀ» "3-way handshake"¹æ½ÄÀ̶ó ÇÑ´Ù. ´ÙÀ½Àº ÀÌ·¯ÇÑ ÀÏ·ÃÀÇ °úÁ¤À» ±×¸²À¸·Î ¼³¸íÇÑ´Ù.

sender(client) destination(server)

SYN -------------------------->

(sequence #: X)

<-------------------------- SYN-ACK

(sequence #:X+1, sequence #: Y)

ACK -------------------------->

(sequence #: Y+1)

ÀÌ·¯ÇÑ °úÁ¤¿¡¼­ ¸ñÀûÁö ½Ã½ºÅÛÀÌ sender¿¡°Ô SYN-ACKÆÐŶÀ» ÀÀ´äÇÏ°í ACKÆÐŶÀ» sender°¡ ÀÀ´äÇÏÁö ¾ÊÀ»¶§ ¹ß»ýÇÑ´Ù. ¸ñÀûÁö È£½ºÆ®´Â "half-open"»óÅ·ΠconnectionÀÌ È®¸³µÇ±â¸¦ ±â´Ù¸°´Ù. À̶§ srouceÈ£½ºÆ®°¡ ¸ñÀûÁöÀÇ ¸ðµç °¡´ÉÇÑ TCP¼ÒÄÏ ¸®¼Ò½º¸¦ °í°¥½Ãų¶§±îÁö ÀÌ·¯ÇÑ half-open connectionÀ» °è¼ÓÇÏ°ÔµÇ¸é ¸ñÀûÁö ½Ã½ºÅÛÀº ´õÀÌ»óÀÇ TCP SYNÆÐŶÀ» ó¸®ÇÏÁö ¸øÇÒ °ÍÀÌ´Ù. Solaris ½Ã½ºÅÛÀÌ TCP SYN°ø°ÝÇÏ¿¡ ÀÖ´ÂÁö¸¦ °áÁ¤ÇÏ´Â ÇÑ°¡Áö ¹æ¹ýÀº SYN_RCVD»óÅ¿¡ ÀÖ´Â TCP connectionÀÇ °¹¼ö¸¦ ¸ð´ÏÅ͸µÇÏ´Â °ÍÀÌ´Ù. SYN_RCVD»óÅÂÀÇ connectionÀº ´ÙÀ½°ú °°Àº ¸í·É¾î¸¦ ÅëÇÏ¿© È®ÀÎ ÇÒ ¼ö ÀÖ´Ù.

#netstat -an -f inet | grep SYN_RCVD

´ÙÀ½Àº Solaris 7½Ã½ºÅÛÀÌ SYN Flooding°ø°ÝÀ» ¹Þ°íÀÖ´Â µ¿¾È¿¡ À§ÀÇ ¸í·É¾î¸¦ ½ÇÇàÇÑ °á°úÀÌ´Ù.

[search:root]/user/ksch/dos > netstat -an -f inet | grep SYN_RCVD | more

127.0.0.1.80 172.16.10.1.14059 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.33931 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.61628 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.37302 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.27227 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.8350 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.52729 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.6407 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.63538 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.5467 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.33539 0 0 9112 0 SYN_RCVD

127.0.0.1.80 172.16.10.1.59230 0 0 9112 0 SYN_RCVD

......................................................................
......

......................................................................
......

127.0.0.1.80 172.16.10.1.59230 0 0 9112 0 SYN_RCVD

½Ã½ºÅÛÀÌ Á¤»óÀûÀÎ »óÅ¿¡¼­´Â SYN_RCVD»óÅÂÀÇ connectionÀÇ È½¼ö°¡ °ÅÀÇ 0ÀÌ´Ù.

´ÙÀ½Àº SYN flooding°ø°ÝÀ» ¹Þ°íÀÖ´Â »óÅ¿¡¼­ SYN_RCVD»óŸ¦ Ä«¿îÆ® ÇÑ°ÍÀÌ´Ù.

[search:root]/user/ksch/dos > netstat -an -f inet | grep SYN_RCVD | wc -l

898

ÀÌ·¯ÇÑ °ªÀº ½Ã½ºÅÛÀÌ Á¤»óÀûÀΠȯ°æÇÏ¿¡¼­ ÀÛµ¿ÇÒ¶§ÀÇ ±âº»ÀûÀÎ °ª°úÀÇ ºñ±³¸¦ ÅëÇÏ¿© ¼öÇàµÇ¾î Áú ¼ö ÀÖ´Ù.

Solaris´Â ½Ã½ºÅÛÀÌ TCP SYN°ø°ÝÇÏ¿¡ ÀÖ´ÂÁö¸¦ °áÁ¤ÇØÁÖ´Â ¶Ç´Ù¸¥ ¹æ¹ýÀÌ ÀÖ´Ù. ´ÙÀ½°ú °°Àº ¸í·É¾î¸¦ »ç¿ëÇؼ­ ÇϳªÀÇ TCP SYN°ø°ÝÀÌ È®ÀεǾîÁú ¼ö ÀÖ´Â tcpHalfOpenDrop, tcpTimRetransDrop, tcp_ListenDrop ÆĶó¹ÌÅ͵éÀÇ °ªÀ» Á¶»çÇϸ鼭 °¡´ÉÇÏ´Ù.

#netstat -s -P tcp

´ÙÀ½Àº Á¤»óÀûÀÎ ½Ã½ºÅÛÀÇ »óÅ¿¡¼­ TCP SYN Flooding°ø°ÝÀ» ¹Þ°íÀÖ´Â »óÅÂÀÇ ÆĶó¹ÌÅÍ°ªµéÀ» Á¶»çÇÑ °á°úÀÌ´Ù.

Á¤»óÀûÀÎ »óÅ¿¡¼­´Â tcpTimRetransDrop = 0, tcpListenDrop = 0,

tcpHalfOpenDrop = 0ÀÇ °ªÀ» À¯ÁöÇÏ°í ÀÖ¾úÀ¸³ª, °ø°ÝÀ» ¹ÞÀº »óÅ¿¡¼­´Â tcpTimRetransDrop = 4243

tcpListenDrop = 0, tcpHalfOpenDrop = 140336ÀÇ °ªÀ» ³ªÅ¸³»¾ú´Ù. ´ÙÀ½Àº TCP SYN Flooding°ø°ÝÀ» ¹Þ°íÀÖ´Â Solaris 7½Ã½ºÅÛÀÇ Ä¿³Î ÆĶó¹ÌÅÍ°ªÀ» Á¶È¸ÇÑ °á°úÀÌ´Ù.

[search:root]:/ > netstat -s -P tcp

TCP tcpRtoAlgorithm = 4 tcpRtoMin = 200

tcpRtoMax = 60000 tcpMaxConn = -1

tcpActiveOpens = 72503 tcpPassiveOpens =207964

tcpAttemptFails = 10067 tcpEstabResets = 27

tcpCurrEstab = 18 tcpOutSegs =3220622

tcpOutDataSegs =2857020 tcpOutDataBytes =270559996

tcpRetransSegs =315847 tcpRetransBytes =577759

tcpOutAck =363525 tcpOutAckDelayed = 10315

tcpOutUrg = 3 tcpOutWinUpdate = 42

tcpOutWinProbe = 118 tcpOutControl =734882

tcpOutRsts = 14378 tcpOutFastRetrans = 353

tcpInSegs =3872088

tcpInAckSegs =2909440 tcpInAckBytes =270664796

tcpInDupAck =189991 tcpInAckUnsent = 0

tcpInInorderSegs =2845248 tcpInInorderBytes =300182637

tcpInUnorderSegs = 1428 tcpInUnorderBytes =1034420

tcpInDupSegs = 2487 tcpInDupBytes = 23404

tcpInPartDupSegs = 76 tcpInPartDupBytes = 45970

tcpInPastWinSegs = 0 tcpInPastWinBytes = 0

tcpInWinProbe = 0 tcpInWinUpdate = 118

tcpInClosed = 27 tcpRttNoUpdate = 359

tcpRttUpdate =2841174 tcpTimRetrans = 110

tcpTimRetransDrop = 4243 tcpTimKeepalive = 1498

tcpTimKeepaliveProbe= 64 tcpTimKeepaliveDrop = 1

tcpListenDrop = 0 tcpListenDropQ0 = 0

tcpHalfOpenDrop =140336 tcpOutSackRetrans = 0

ÆĶó¹ÌÅÍ tcpTimRetransDropÀº ½Ã½ºÅÛ ºÎÆÃÈÄ¿¡ SYN ¿ä±¸³ª ¿¬°áÈ®¸³µÈ TCP ¿¬°á¿¡ ´ëÇÏ¿© ½Ã°£¸¸·áµÈ ÆÐŶÀÇ ¼öÀ̸ç, ÆĶó¹ÌÅÍ tcpListenDropÀº ½Ã½ºÅÛÀÌ ºÎÆÃÇÑ ÈÄ¿¡ TCP queue backlog¶§¹®¿¡ °ÅÀýµÈ SYN ¿ä±¸ÀÇ È½¼ö¸¦ ÀǹÌÇÑ´Ù. ¶ÇÇÑ tcpTimRetransDropÀÇ °ª¿¡ µû¶ó tcpListenDrop ¹× tcpHalfOpenDrop°ªÀÌ ºü¸£°Ô Áõ°¡Çϸé ÇØ´ç ½Ã½ºÅÛÀÌ TCP SYN °ø°ÝÀ» ´çÇÏ°í ÀÖÀ» È®À²ÀÌ »ó´çÈ÷ ³ôÀ½À» ³ªÅ¸³½´Ù. ÀÌ·¯ÇÑ °ø°ÝÀ» »ó¼âÇϱâ À§Çؼ­ °ü¸®ÀÚ´Â ´ÙÀ½ÀÇ µÎ°¡Áö ÀÛ¾÷À» ¼öÇàÇÒ ¼ö ÀÖ´Ù. Çϳª´Â abort timerÀÇ °ªÀ» ´õ ª°Ô ÇÏ´Â °ÍÀÌ°í ´Ù¸¥ Çϳª´Â TCP ¿¬°á Å¥(queue)¸¦ ´õ ±æ°ÔÇÏ´Â °ÍÀÌ´Ù. abort timer¸¦ ª°ÔÇϱâ À§Çؼ­´Â milli-second·Î ¼³Á¤ÇÏ´Â Ä¿³Î º¯¼öÀÎ tcp_ip_abort_cinterval¸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ½Ã½ºÅÛ µðÆúÆ®°ªÀº 180ÃÊ·Î ¼³Á¤µÇ¾î ÀÖ´Ù. abort timer¸¦ 60ÃÊ·Î ¼³Á¤Çϱâ À§Çؼ­´Â ´ÙÀ½°ú °°Àº ¸í·É¾î¸¦ ½ÇÇàÇÏ¸é µÉ°ÍÀÌ´Ù.

#ndd -set /dev/tcp tcp_ip_abort_cinterval 60000

(60000 = 60 * 1000)

¿¬°áÈ®¸³(connection established)ÀÌ ÀÌ·ç¾îÁöÁö ¾ÊÀº ÆÐŶ¿¡´ëÇÑ Å¥ Å©±â´Â Ä¿³Î º¯¼öÀÎ tcp_conn_req_max_q0(Solaris 2.6ÀÌ»ó)¸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù. solaris 2.5.1Àº patch 103581-11¸¦ ÆÐÄ¡ÇÏ¿©¾ß¸¸ ÇÑ´Ù. tcp_conn_req_max_q0ÀÇ µðÆúÆ® °ªÀº 1024ÀÌ´Ù. queue Å©±â¸¦ Áõ°¡½ÃÅ°±â À§Çá¿© ´ÙÀ½ÀÇ ¸í·É¾î¸¦ ½ÇÇà½ÃÅ°¸é µÈ´Ù.

#ndd -set /dev/tcp tcp_conn_req_max_q0 2048

SYN AttackÀÇ ¶Ç´Ù¸¥ ¹æ¹ýÀº ¿¬°áÈ®¸³µÈ TCPÀÇ queue¸¦ °í°¥½ÃÅ°´Â °ÍÀÌ´Ù. ÀÌ·¯ÇÑ ¹æ¹ýÀº Ãâ¹ßÁö ÁÖ¼Ò°¡ ³ëÃâµÇ±â ¶§¹®¿¡ SYN°ø°ÝÀ¸·Î¼­´Â Àß »ç¿ëµÇÁö ¾Ê´Â ¹æ¹ýÀÌ´Ù. ÇÏÁö¸¸ ÇØÅ·¿¡ ¼º°øÇÑ ¼­¹öµîÀ» »ç¿ëÇÏ´Â ¹æ¹ýÀ» ÅëÇÏ¿© »ç¿ëµÉ ¼ö ÀÖ´Â ¹æ¹ýÀ̱⵵ ÇÏ´Ù. Solaris 2.6ÀÌ»ó(Solaris 2.5.1Àº 103582-11·Î ÆÐÄ¡ÇÊ¿ä)¿¡ ´ëÇÏ¿© tcp_conn_req_max_qÀÇ Ä¿³Î º¯¼ö¸¦ ÅëÇÏ¿© queue Å©±â¸¦ Áõ°¡½Ãų¼ö ÀÖ´Ù.

#ndd -set /dev/tcp tcp_conn_req_max_q <size>

¿©±â¼­ <size>´Â È£½ºÆ®¿¡¼­ Çã¿ëÇÏ´Â TCP¿¬°áÈ®¸³ÀÇ ÃÑ ¼ö¸¦ ÀǹÌÇÑ´Ù. established ¹× unestablished TCP¿¬°á¿¡ ´ëÇÑ queue Å©±â¸¦ Áõ°¡½ÃÅ°±â À§Çؼ­´Â ´õ ¸¹Àº ¸Þ¸ð¸®¸¦ ÇÊ¿ä·ÎÇÑ´Ù. µû¶ó¼­ ÃæºÐÇÑ ¸Þ¸ð¸®ÀÇ È®º¸ ¾øÀÌ queue Å©±â¸¦ Áõ°¡½ÃÅ°¸é ¼­¹öÀÇ performance¿¡ ¿µÇâÀ» ÁÙ¼ö ÀÖ´Ù. »Ó¸¸¾Æ´Ï¶ó ¼­¹ö°¡ ó¸®ÇÒ ¼ö ÀÖ´Â °Íº¸´Ù ´õ ¸¹Àº¾çÀÇ half-openÀ̳ª established¿¡ ´ëÇÑ TCP ConnectionsÀ» ¹ß»ý½ÃÅ°¸é ÀÌ·¯ÇÑ ¼­ºñ½º °ÅºÎ°ø°ÝÀº ¼º°øÇÒ °ÍÀÌ´Ù.

7. °á·Ð

Solaris KernelÀº ¸¹Àº Security°ü·Ã ȯ°æ ÆĶó¹ÌÅ͸¦ °¡Áö°í ÀÖ´Ù. ÀÌ·¯ÇÑ ÆĶó¹ÌÅ͵éÀÇ Á¶Á¤À» ÅëÇÏ¿© ½Ã½ºÅÛÀÇ security ´ëÀÀ´É·ÂÀ» Áõ°¡½Ãų ¼ö ÀÖ´Ù. ÀÌ·¯ÇÑ Solaris Security Ä¿³Î º¯¼öµéÀº ARP timeout, ÆÐŶµéÀÇ IP forwarding, ÆÐŶµéÀÇ IP Source routing, TCP connection queue size, network connectionµéÀ» ÅëÁ¦ÇÏ´Â ¸¹Àº ´Ù¸¥ ¿ä¼Òµé·Î ±¸¼ºµÈ´Ù. Ä¿³Î º¯¼öµéÀ» ¿Ã¹Ù¸£°Ô tunningÇÔÀ¸·Î½á ½Ã½ºÅÛ°ü¸®ÀÚ´Â Solaris SystemÀ» ¿ÜºÎÀÇ SecurityÀ§Çù¿¡ ´ëÇÏ¿© ÀúÇ×·Â ÀÖ´Â ¼­¹ö½Ã½ºÅÛÀ» ±¸¼ºÇÒ ¼ö ÀÖÀ»°ÍÀÌ´Ù.

8. Âü°í¿ø¹® :

http://www.securityfocus.com/focus/sun/articles/kernel.html


¸ñ·Ï | ÀÔ·Â | ¼öÁ¤ | ´äº¯ | »èÁ¦