Mission 4: Security concerns

shanirub commented 2 weeks ago

Background

Sniffing a packet involves reading a socket, which is usually done by root. After several approaches (assigning regular user to group wireshark and tcpdump) that didn't work, a decision was made: sudo will be used to run the script, but raspi security will be tightened. To avoid exploits as possible.

Securing Your Raspberry Pi

Disabling Wi-Fi and limiting network access is a great idea to minimize attack surfaces, especially when running sensitive scripts like a network sniffer.

Your Approach

Connect via Ethernet: This limits potential attackers to devices on the wired local network.
Disable Wi-Fi: Reduces exposure to potential intrusions from nearby wireless devices.

Additional Security Measures

Harden SSH Access:
- Change the default pi user to a custom one.
- Use strong, unique passwords.
- Disable password-based SSH and use SSH keys for authentication.
- Change the default SSH port to a non-standard one.
Restrict Sudo Access:
- Only allow necessary commands to be run with sudo by editing /etc/sudoers for your user.
Network Segmentation:
- Use VLANs on your switch to isolate the Raspberry Pi from other devices, except the ones it needs to interact with.
Enable a Firewall:
- Install ufw (Uncomplicated Firewall) and allow only necessary incoming/outgoing connections.
```
sudo apt install ufw
sudo ufw allow ssh
sudo ufw enable
```
Audit and Update Regularly:
- Keep your Raspberry Pi software and firmware up to date.
- Regularly check logs (/var/log/) for unusual activity.
Run Sniffer with Limited Privileges: <-- need to try!
- Instead of running your script as sudo, use setcap to grant just the required permissions to the Python binary:
```
sudo setcap cap_net_raw+ep $(which python3)
```

Effectiveness of Your Plan

Disabling Wi-Fi and using Ethernet is effective in reducing the risk of attacks, particularly from devices not on the wired network. Combined with the above steps, your Raspberry Pi will be significantly harder to compromise.

shanirub commented 2 weeks ago

other sec approaches suggested by chatgpt

Other Approaches for Securing a Raspberry Pi While Allowing Sniffing

Here are additional ways to secure your Raspberry Pi for network sniffing: A. Isolated Sniffing Environment

Purpose: Ensure your Raspberry Pi operates in a restricted environment to mitigate exposure risks.
How:
    Standalone Network: Connect the Pi to a network switch or hub that is only used for monitoring. Ensure this network is not connected to the internet or other devices except for the ones being sniffed.
    Disable Unnecessary Services: Turn off all services except those required for your sniffing script:

sudo systemctl disable --now bluetooth.service sudo systemctl disable --now avahi-daemon.service sudo systemctl disable --now cups.service

Disable IPv6: Prevent additional networking attack vectors.

Add these lines to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1

Reload with:

        sudo sysctl -p

B. Use a Dedicated Sniffing Operating System

Purpose: Use a hardened OS optimized for packet sniffing.
Examples:
    Kali Linux: Includes tools like Wireshark and Scapy, and offers security-focused configurations.
    Parrot Security OS: A lightweight alternative to Kali.
How:
    Install the chosen OS on a microSD card.
    Use it exclusively for sniffing, keeping your general-purpose OS (e.g., Raspberry Pi OS) secure.

C. Secure Configuration for Packet Capture

Non-Root Packet Capture:
    Assign raw socket permissions to Scapy without requiring sudo:

sudo setcap cap_net_raw,cap_net_admin+ep $(which python3)

Verify capabilities with:

getcap $(which python3)

Create a Sniffing User: Create a restricted user account for running sniffing scripts.

sudo adduser sniffer --shell /bin/bash
sudo usermod -aG tcpdump sniffer

    This user can only execute scripts related to sniffing.

D. Run Pi in Kiosk Mode

Purpose: Restrict the Pi to a single application (your script) for an added layer of control.
How:
    Set the script to auto-run at startup by editing /etc/rc.local or creating a systemd service.
    Limit input/output by disabling unnecessary peripherals like HDMI, USB, or GPIO pins unrelated to the sniffing.

E. Secure Remote Access

Set up VPN access to monitor or manage the Pi remotely while ensuring the sniffing script remains isolated. Tools like WireGuard offer lightweight, secure VPN solutions.

shanirub commented 2 weeks ago

current plan:

create a new service for my code. that way the service can be ran with root permissions, but won't leave an interactive root session to be exploited.

shanirub / packetbeeps