diff --git a/projects/bash_networking_security/SOLUTION b/projects/bash_networking_security/SOLUTION index 2edfbaf..900e762 100644 --- a/projects/bash_networking_security/SOLUTION +++ b/projects/bash_networking_security/SOLUTION @@ -1,16 +1,26 @@ Local DNS Server IP ------------------- + 127.0.0.53 + + Default gateway IP ------------------- +10.0.0.1 DHCP IP allocation sys-logs ------------------- - + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.409527] systemd[1]: Detected virtualization xen. + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.413368] systemd[1]: Detected architecture x86-64. + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.422724] systemd[1]: Hostname set to . + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.830820] systemd[1]: Queued start job for default target Graphical Interface. + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.836910] systemd[1]: Created slice Slice /system/modprobe. + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.844069] systemd[1]: Created slice Slice /system/serial-getty. + Jun 15 13:07:48 ip-10-0-0-242 kernel: [ 3.852027] systemd[1]: Created slice Slice /system/systemd-fsck. \ No newline at end of file diff --git a/projects/bash_networking_security/bastion_connect.sh b/projects/bash_networking_security/bastion_connect.sh index a9bf588..7c4b3cf 100644 --- a/projects/bash_networking_security/bastion_connect.sh +++ b/projects/bash_networking_security/bastion_connect.sh @@ -1 +1,21 @@ #!/bin/bash +if [[ -z "$KEY_PATH" ]]; then + echo "Error: KEY_PATH environment variable is not set." + exit 5 +fi + +if [[ $# -lt 1 ]]; then + echo "KEY_PATH env var is expected" + echo "Please provide bastion IP address" + exit 5 +fi + +bastion_ip=$1 +private_ip=$2 +command_to_run="${@:3}" + +if [[ -n "$private_ip" ]]; then + ssh -t -i "$KEY_PATH" ubuntu@"$bastion_ip" ssh -i "new_key" ubuntu@"$private_ip" "$command_to_run" +else + ssh -i "$KEY_PATH" ubuntu@"$bastion_ip" "$command_to_run" +fi diff --git a/projects/bash_networking_security/tlsHandshake.sh b/projects/bash_networking_security/tlsHandshake.sh index a9bf588..3d0f11b 100644 --- a/projects/bash_networking_security/tlsHandshake.sh +++ b/projects/bash_networking_security/tlsHandshake.sh @@ -1 +1,62 @@ #!/bin/bash +#!/bin/bash -x + +# Step 1 - Client Hello (Client -> Server) +RESPONSE=$(curl -X POST -H "Content-Type: application/json" -d '{ + "version": "1.3", + "ciphersSuites": ["TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256"], + "message": "Client Hello" +}' http://3.129.21.174:8080/clienthello) + + +# Step 2 - Server Hello (Server -> Client) +SESSION_ID=$(echo "$RESPONSE" | jq -r '.sessionID') + +echo "$RESPONSE" | jq -r '.serverCert' > cert.pem + + +# Step 3 - Server Certificate Verification +wget https://devops-feb23.s3.eu-north-1.amazonaws.com/cert-ca-aws.pem + +VERIFICATION=$(openssl verify -CAfile cert-ca-aws.pem cert.pem) + +if [ "$VERIFICATION" != "cert.pem: OK" ]; +then + echo "Server Certificate is invalid." + exit 5 + else + echo "cert.pem: OK" +fi + + +# Step 4 - Client-Server master-key exchange +#echo "Hi server, please encrypt me and send to client!" > masterKey.txt +openssl rand -out masterKey.txt -base64 32 + + + +MASTER_KEY=$(openssl smime -encrypt -aes-256-cbc -in masterKey.txt -outform DER cert.pem | base64 | tr -d '\n') + + + +# Step 5 - Server verification message +RESPONSE=$(curl -X POST -H "Content-Type: application/json" -d '{ + "sessionID": "'"$SESSION_ID"'", + "masterKey": "'"$MASTER_KEY"'", + "sampleMessage": "Hi server, please encrypt me and send to client!" +}' http://3.129.21.174:8080/keyexchange) + + +# Step 6 - Client verification message + +echo "$RESPONSE" | jq -r '.encryptedSampleMessage' > encSampleMsg.txt +cat encSampleMsg.txt | base64 -d > encSampleMsgReady.txt + +decrypted_sample_msg=$(openssl enc -d -aes-256-cbc -pbkdf2 -kfile masterKey.txt -in encSampleMsgReady.txt) + +if [ "$decrypted_sample_msg" != "Hi server, please encrypt me and send to client!" ]; then + echo "Server symmetric encryption using the exchanged master-key has failed." + exit 6 +else + echo "Client-Server TLS handshake has been completed successfully" +fi \ No newline at end of file diff --git a/projects/bash_networking_security/vpc.sh b/projects/bash_networking_security/vpc.sh index 951abba..8c59763 100644 --- a/projects/bash_networking_security/vpc.sh +++ b/projects/bash_networking_security/vpc.sh @@ -1,4 +1,4 @@ -REGION="" -VPC_ID="" -PUBLIC_INSTANCE_ID="" -PRIVATE_INSTANCE_ID="" \ No newline at end of file +REGION="us-east-2" +VPC_ID="vpc-03f04820bd5538afb" +PUBLIC_INSTANCE_ID="i-0e364860614a7c200" +PRIVATE_INSTANCE_ID="i-0dd50ff38e7e7db24" \ No newline at end of file diff --git a/shambhaveenewohio.pem b/shambhaveenewohio.pem new file mode 100644 index 0000000..b540bfe --- /dev/null +++ b/shambhaveenewohio.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAwaCXrhJvel5dNuYJzrLJ6masjt8REWp1z3P3a/AcozXB4B8c +ynRMrGfWMz6c/K3/G8RfT+olnpxn4nSLbrNM2yBzXWf/d5cG1usuwW4o6CRjj9j7 +yza/TMJ7pU/cfmCVt5JIpeRpVpDx1YB6dNFXR20nxq3j5HDNJgoA+IktCrIb4Fca +fzCKiR1+MCbKHzieOX42WcpeliuSnN/SgOwpzCb0oXR6rsq8QyZjVZTTlppiLfJc +GaCMZmLt8aI9KmxCigHUH/chyJ2PsM+xFCYW7D8WobYUiw2KLr34GRAfwyT8LnQJ +mVn2CTqduv5flir1SrBEfEJoIMlDjqjH4tljIwIDAQABAoIBAFpQtw9p5/ezFlWq +HT79pDMiqzCFGef+uW8Hj4wYVrNGOuV4faxtbOoqEP6cIQu3eTwRb8fN1rhSCh7V +78e1+I5pZ4ZVIRM+LeGHl6p/4LLPbmVFd8VFBxwdxyDHzHhiQtN6d0px7TSErVjB +8dyVXNmjL597ssX2W6p3lhZXndvTgNeICKUbSDy4Svk5yAlYv7IoVSXjJWmJTMdP +FC8Hpi+spqX9wKpUtfcn+9Xhe7vgGhTKnyejHXnRmRcySDmqDgTRbW0U6WwWsBBX +OWeEMBL8aw26qNgZb3qBqdf4J2Fe2tQG9gPVOv9/rpEVrvulBBkkwD8eQUyhME+U ++6VY+3ECgYEA/Hbv8GOske2lBRWv8hKzTxvHXpwekxCuapzTP9V7uicOuGuM9HQn +a98NjIv/GUtqlfsrpUQGEKe4yG2heK36mjTNvVtjzL3iB42TZHoJt2VMrKVJexIw +s3yaJ7enPBvmQyfxOLGSG2/ViPgr8y4BIhZETlC14INhyBAcOA6g1VsCgYEAxFa6 +mR5fL/zi/aiwvBGShg211/cVi69wbKQOc/wP18VLxObwGkoaPN8EsKaviGMWwh3I +qnixzAo+bRgceabs6oJYvfgEaKetlkPiorgYTnvL3alm3/qhqwGwJHrzs7aaFBc4 +SoE7n9ZuTQXZbq6XyMkakzFqTtyizs5Flgge69kCgYEAhXEYQadtf3Rs1NMxvHHF +9Ppp1sgOIQ2gIxnhTsw4KZybWz79sffzHkE3mCInI+eI3t1zpFbgHc2JDedkgbTz +0K44UO4NQhrbbcKXNXSLzjPs4xQ6UqK6uyQRFw0rh8n3W2exSJYS9A2YgF0sXczj +LHE4iWx/tbu741Mgl0CkIiECgYEAt/aDdECu86nBjebnYfAdGBn0jlxnBbDmaAT3 +vdkphwTHz8CKrDdOikZ0gIhN5D7j7hI2GPRps0LN5y42UA4F4l0rhSPEDcM+tJL6 +4XgY3kDEbfbx+18855v3TNcfTP4FNFnlVnnsQgGK7ARVDI3ujiVQDya38xhsO9Wu +AbuuLVECgYB3B/bt2oWzEEsUMQQjuZSM/hz4/EtnPH+Us8vrll1Bju+DAKblsjQN +wxKEbPvJvpHn3jRAGY8kIn37GbvStyBV5C98RZqxyW52Na9xrYv3MVfe6qs3IMOO +0ZUbuMJ3Qz+7XliW/wUxbUQt57OCu1J7JZpYbbKzNJZrtftD3mtVAw== +-----END RSA PRIVATE KEY----- \ No newline at end of file