There might be a time when you become the victim of a network breach. The best defense is layering multiple security solutions that cover various points on your network so if one gets bypassed, other tools are there to identify and stop the attacker. Common defense tools range from firewalls to detection technologies such as IDS/IPS solutions.

The Raspberry Pi can be configured as a low budget IDS/IPS to protect a part of your network. This should obviously only be considered for a very specific goal as there are far better options for providing real long term IPS/IDS solutions. The Raspberry Pi does not have the horsepower or storage for anything beyond basic detection and prevention, so consider this option for lab use and training purposes.

When considering an IPS/IDS, the first thing to decide is how it will be deployed. The typical use case is between a router and another device, or between a system and network. You could also be an intrusion detection system, meaning the device is a tap in the network viewing copies of the traffic and won't have any enforcement capabilities. In my example, I'll use Snort as an inline IPS between my laptop and external network acting as a man-in-the-middle. This could be ideal for connecting to an untrusted network while not leveraging VPN. This setup will require two Ethernet ports so I'll be utilizing a USB to Ethernet adapter to accommodate the second port.

Deploying the Raspberry Pi for man-in-the-middle attacks is similar to acting as a man-in-the-middle for IPS deployments. You will need to set the IP address of both interfaces as 0.0.0.0, and use the bridge utility to bridge both interfaces together. We covered this process in Chapter 3, Penetration Testing under the Man-in-the-middle section. A summary of the commands used to bridge the two interfaces together is shown in the following screenshot:

Snort

The most popular open source IDS/IPS used today is Snort now owned by Cisco due to the acquisition of Sourcefire. The major problem with using Snort on a Raspberry Pi is the resource requirements that extend beyond what the Raspberry offers. It is recommended to tune down processes on Snort prior to running it to get decent functionality.

Snort can run from a Kali Linux installation but it is not preinstalled.

Note

Make sure you download and update Snort prior to bridging your interfaces or you won't have Internet access. A possible work-around is adding a third wireless or Ethernet adapter to provide Internet access for updates while you leverage the other two ports for bridging.

Let's look at how to install and use Snort once your man-in-the-middle bridge is established in the following manner:

1. The first step to is download required files using the following command:

   sudo apt-get install flex bison build-essential checkinstall libpcap-dev libnet1-dev libpcre3-dev libmysqlclient15-dev libnetfilter-queue-dev iptables-dev
   

2. Snort also requires libraries that do not ship with the Kali Linux ARM image. To get the libraries required for Snort to function properly, type the following command:

   wget https://libdnet.googlecode.com/files/libdnet-1.12.tgz
   

3. Next, you need to uncompress the file by using the tar –zxvf libdnet-1.12.tgz command. Once the file is uncompressed, use the cd command to navigate to the directory.
4. You will change the CFLAGS variables to be configured for a 64-bit OS by typing the ./configure CFLAGS="-fPIC" command. Once this is done, type the make command.
5. Next, you need to build a symbolic link from the location of libdnet to where Snort expects libdnet to be located. Type the following command to do this:

   ln -s /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1
   

6. Now, you need to move to a directory used for Snort. We created a new directory called snort on our desktop by using the mkdir snort command from the desktop folder in command line or by right clicking on the desktop in the GUI and selecting it to make a new directory.
7. Next, we will need to download the Snort data acquisition libraries. Type the wget https://www.snort.org/downloads/snort/daq-2.0.4.tar.gz command to do this. Note the version we are using might be different from what is available. Check snort.org to ensure you are using the latest version.
8. Download Snort with the following command:

   wget https://www.snort.org/downloads/snort/snort-2.9.7.0.tar.gz
   

9. Next, we will unzip and install the Snort data acquisition libraries using the following commands:

   tar -zxvf daq-2.0.4.tar.gz
   cd daq-2.0.4
   ./configure; make; sudo make install
   

10. The last step is downloading either Oinkcode, or community rules. Oinkcode rules are unique keys associated with an existing Snort user account. If you do not have Oinkcode rules, you can download community rules.
11. We will download community rules by using the wget https://www.snort.org/rules/community command. This should download a file called community.tar.gz into your directory. You will need to uncompress the file using the tar xvfz community.tar.gz -C /etc/snort/rules command.

    Note

    In some cases, you might need to add an extension to the file. If you only see community or some variation without the .tar.gz extension, type the mv community community.tar.gz command.

12. Now we are ready to install Snort. To install Snort, type apt-get install snort. You will get a prompt to configure the IP address and subnet mask of the Snort interface as shown in the following screenshot:
    

    You should see Snort complete its installation process, as shown in the following screenshot:

    

You have successfully configured Snort. There are many things you can do with Snort from this point such as analyzing traffic crossing the network bridge you set up in previous steps by using the snort command. We could write an entire book on Snort, and there are some books dedicated to the subject matter. If you are unfamiliar with Snort, we suggest you visit www.snort.org.

The easiest way to start Snort is just to type ./snort –i eth0; this will start Snort and listen on Ethernet 0. There are many more advanced configurations that allow you to capture and run everything to a syslog server for further analysis. By default, Snort will log everything to the terminal screen, as shown in the following screenshot. Don't worry if it is difficult to see, as the messages scroll fast on the screen and that is why most people will log to an external syslog server.

One additional step you might take is setting up Snort to automatically start by creating a script. This is typically only used if you have the Raspberry Pi dedicated to Snort. The following example shows how to create a script to auto start snort when you boot up your Raspberry Pi:

autostart-IDS.sh
#!/bin/bash
# Configures the virtual bridge between the two physical interfaces.
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0
brctl addbr bridge0
brctl addif bridge0 eth0
brctl addif bridge0 eth1
ifconfig bridge0 up
# Configures Snort and TCPdump tools to begin listen and inspecting
# the network traffic that travels through the bridge interface.
TCPdump -i bridge0 -w /root/IDS-log/networkdump/network-traffic-$(date +%y%m%d).cap &
Snort -i bridge0 -v |tee /root/IDS-log/snortdump/Snort-dump-$(date +%y%m%d) &

A content filter is used to control the type of content a reader is authorized to access while surfing the Internet. Older content filters require lot of manual tuning based on updating URL lists, however, most commercial offerings provide content categories that are automatically updated with new website labels. The most common use case for requiring a content filter is blocking inappropriate content such as pornography from business networkers. Typically, content filters are bundled in with capabilities offered by network proxies or application layer firewalls.

Let's look at how to turn a Raspberry Pi into a home office content filter. This is great for parents wanting to keep their personal network kid-friendly.

A Virtual Private Network (VPN) is an essential security element to many organizations. VPNs provide a method to connect directly to a remote network as if you are on-site and protect traffic in between the client and the connected network using encryption. This prevents many man-in-the-middle attacks and allows people to be more productive while out of the office. OpenVPN can turn a Raspberry Pi into a VPN concentrator providing these and other benefits at an extremely low cost.

Let's look at how to transform a Raspberry Pi into a VPN concentrator using the following steps:

Now let's download an OpenVPN client and connect back to our Raspberry Pi OpenVPN server using the following steps. There are a variety of OpenVPN clients that are available. We actually prefer Viscosity from SparkLabs.

Tor, sometimes known as onion routing, is used for anonymous access to the Internet by using a system of volunteer nodes and services to route and mask traffic. Using Tor makes it difficult to track Internet usage. This is ideal when you want to defend against unwanted traffic analysis that can be used to violate your privacy. Detailed information around Tor can be found at https://www.torproject.org/.

A Tor relay works by randomly selecting systems to use as a path to communicate from one point to another. Endpoints access the Tor network by using special software that pushes traffic through the Tor network. The following diagram shows how two systems might use different paths to communicate back and forth on a Tor network:

The Raspberry Pi can be configured as a Tor node and Tor router. A Tor node acts as a system passing through other users' traffic, meaning it is part of the Tor network helping other people remain anonymous while they access the Internet. A Tor router acts as an entry point for an internal network into the Tor network, so all devices surfing through the router will have their traffic randomized through the Tor network. A Tor router replaces the need for every user to run the special Tor software to access the Tor network, since all traffic is routed through Tor by the router.

Let's look at how to turn a Raspberry Pi into a Tor node and Tor router.

Raspberry Tor

You can turn your Raspberry Pi running Kali Linux into a Tor node so that you can take part in the Tor project.

Note

Running a TOR node might have legal or ethical constraints and requirements. We suggest you do your research before running Tor to completely understand what it means. Running a TOR node might mean anonymous users will be using your Internet connection for possibly malicious or illegal activities. Additionally, with the closure of Silk Road 2.0 and other law enforcement arrests, the anonymity of Tor has recently been questioned.

If you are going to participate in the Tor network with your Kali Linux Raspberry Pi, you will need to do some cleanup work using the following steps:

1. First, turn off any excess services or applications running on Raspberry Pi. If you are unsure, start with a clean install, or use the Raspbian distribution instead.
2. Change your root password. Use a minimum of twelve alphanumeric characters.
3. We will install sudo packages and add a tor username. That way, you don't have to work with the root username. We will also update and upgrade our software; use the following steps:

   apt-get install sudo
   adduser tor
   passwd tor
   apt-get update
   apt-get upgrade
   

4. We will also need to add the tor account to the list of sudoers. You can do this by editing the /etc/sudoers file. Type the sudo visudo command then add the line tor ALL=(ALL) ALL.

   Note

   The visudo command is the traditional and most commonly accepted way to edit the list of sudoers. However, in some operating systems, this command is not available. In those situations, you will need to edit the sudoers file directly. You might do so with the vi /etc/sudoers command.

   The following screenshot shows the /etc/sudoers file:

   
5. We need to change the default DHCP behavior of Kali Linux to a static address. Technically, we could keep a DHCP address, but most likely you will need a static address on the device. Type the ifconfig command to see your network interfaces. You should see something like what's shown in the following screenshot. Write this down:
   

   You will edit the network interface file. We will use vi, but you can use your favorite editor. Use the sudo vi /etc/network/interfaces command.

   Look for the line that says something close to iface eth0 inet dhcp, as shown in the following screenshot:

   

   You will change that line to a static address. In our example, we will change to a static IP of 10.0.1.167, with a subnet mask of 255.255.255.0, as well as default gateway of 10.0.1.1 using the following commands:

   iface eth0 inet static
   address 10.0.1.167 <- chose an IP that fits to your network! This is only an example!
   netmask 255.255.255.0 <- Apply the correct settings
   network <- The IP network
   broadcast <- enter the IP broadcast address
   gateway 10.0.1.1 <- Enter your router or default gateway
   

   The following screenshot shows the launch of the preceding commands:

   
6. Now, let's install Tor. Type the sudo apt-get install tor command. Edit the tor config file in /etc/tor/torrc. You will need to add or change the configuration to match the following lines. It is okay if there is excess stuff in the configuration file.

   Add or change the following to match the configuration:

   SocksPort 0
   Log notice file /var/log/tor/notices.log
   RunAsDaemon 1
   ORPort 9001
   DirPort 9030
   ExitPolicy reject *:*
   Nickname xxx (you can chose whatever you like)
   RelayBandwidthRate 100 KB # Throttle traffic to 100KB/s (800Kbps)
   RelayBandwidthBurst 200 KB # But allow bursts up to 200KB/s (1600Kbps)
   

   The following screenshot shows the launch of the sudo apt-get install tor command:

   
7. You will need to ensure TCP ports 9030 and 9001 are open from your firewall to your Raspberry Pi. You will want to make sure that the outside world can contact these ports as well. You might need to Network Address Translate (NAT) your Raspberry Pi with a static (or one-to-one) NAT statement. If you have a home router, this is sometimes called a Demilitarized Zone (DMZ) or a Game port.
8. Reboot your system.
9. Now, start Tor by using the sudo /etc/init.d/tor restart command in CLI. Check the Tor log file to ensure the service has started. The Tor log files are located in /var/log/tor/log. You can view the log files by issuing the less /var/log/tor/log command. Look for the entry Tor has successfully opened a circuit. Looks like client functionality is working. If you see this, you have set up your system correctly.

At this point, you will most likely want to use a Tor client to get on the Tor network. There are many clients available for a variety of operating systems. Here are a few links to help you get started:

• Windows: https://www.torproject.org/docs/tor-doc-windows.html.en
• Linux/Unix/BSD: https://www.torproject.org/docs/tor-doc-unix.html.en
• Debian/Ubuntu: https://www.torproject.org/docs/debian.html.en
• Mac OS X: https://www.torproject.org/docs/tor-doc-osx.html.en
• Android: https://www.torproject.org/docs/android.html.en

At this point, you have a fully functional Tor relay point and a Tor client to access the Tor network. You will not see much when the product is configured, besides some information and status messages on the terminal. There are other views available that will give you more information on traffic and your node participation status as well, which you can toggle through.

The Tor terminal