4. Какие атаки можно проводить на ssl и в чём заключается основная идея атак?

Атака отклика - злоумышленник записывает коммуникационную сессию между сервером и клиентом. Позднее, он пытается установить соединение с сервером, воспроизводя записанные сообщения клиента. Но SSL отбивает эту атаку при помощи особого уникального идентификатора соединения (ИС).

Атака против протокола рукопожатия - злоумышленник может попытаться повлиять на обмен рукопожатиями для того, чтобы стороны выбрали разные алгоритмы шифрования, а не те, что они выбирают обычно. Из-за того, что многие реализации поддерживают 40-битное экспортированное шифрование, а некоторые даже 0-шифрование или MAC-алгоритм, эти атаки представляют большой интерес.

Для такой атаки злоумышленнику необходимо быстро подменить одно или более сообщений рукопожатия. Если это происходит, то клиент и сервер вычислят различные значения хэшей сообщения рукопожатия. В результате чего стороны не примут друг от друга сообщения Finished. Без знания секрета злоумышленник не сможет исправить сообщение Finished, поэтому атака может быть обнаружена.

Выводы: В данных лабораторных работах были изучены различные средства защиты трафика, такие как сертификаты и туннелирование. Особых трудностей при программировании и построении топологии не возникло.

Приложение 1

Файл cert.pem

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 2 (0x2)

Signature Algorithm: sha1WithRSAEncryption

Issuer: C=ru, ST=moscow, L=moscow, O=bmstu, OU=iu6, CN=GRAM/emailAddress=bmstu@gmail.com

Validity

Not Before: Mar 16 11:02:51 2013 GMT

Not After : Mar 16 11:02:51 2014 GMT

Subject: C=ru, ST=moscow, O=bmstu, OU=iu6, CN=192.168.0.4/emailAddress=123@qwerty.com

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (1024 bit)

Modulus:

00:a3:43:61:0f:63:d8:0b:7d:b0:8e:43:e5:76:c8:

45:14:e4:4f:b5:de:0c:43:e4:f7:44:47:76:7c:a1:

dc:e2:06:06:75:1b:b5:ae:a7:99:96:e9:25:45:5e:

c1:0e:64:26:40:92:0a:57:8a:73:9d:9d:6f:e5:cf:

00:fe:72:73:18:3e:49:19:74:56:1d:2d:a4:08:74:

72:fd:ca:10:d7:14:1b:5c:fd:cc:87:01:3e:e6:6e:

e3:37:79:86:a3:73:e0:de:31:d7:1d:83:80:58:aa:

b8:69:ec:96:98:7b:27:ef:37:dd:09:4b:f9:41:b9:

59:a3:8b:26:19:51:30:4b:95

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

D6:5D:EE:0E:99:5D:00:0F:76:70:5E:DB:43:A1:84:13:CB:70:A4:DA

X509v3 Authority Key Identifier:

keyid:79:66:D9:BA:07:A3:25:11:15:79:C0:A4:F1:56:88:BF:74:AD:80:58

Signature Algorithm: sha1WithRSAEncryption

59:0d:5a:4d:10:58:75:37:65:9c:49:7d:82:89:d2:21:25:5d:

16:52:cf:01:9e:ec:c5:0e:4b:87:df:e5:c6:4e:f7:f9:a0:b8:

33:99:9b:1e:aa:a5:d5:df:d1:27:cb:a3:cc:23:4b:6f:9f:ff:

a0:69:a7:75:2c:67:24:08:7f:3a:61:77:3d:70:de:a5:13:c2:

15:79:66:6a:c0:85:a4:2a:5d:13:80:09:c2:e1:38:7d:55:59:

15:ce:fb:64:ac:5d:83:14:f6:67:5b:76:2f:0f:22:e8:42:89:

de:c0:13:57:95:2a:b7:8e:8d:30:d7:ae:86:f5:84:ff:cb:0a:

04:a9

-----BEGIN CERTIFICATE-----

MIICvjCCAiegAwIBAgIJANw+RXkhZwRrMA0GCSqGSIb3DQEBBQUAMHgxCzAJBgNV

BAYTAlJVMQ8wDQYDVQQIDAZNb3Njb3cxDzANBgNVBAcMBk1vc2NvdzEOMAwGA1UE

CgwFQk1TVFUxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGCSqG

SIb3DQEJARYIMTFAMTEucnUwHhcNMTMwMzE2MTM1NTAwWhcNMTMwNDE1MTM1NTAw

WjB4MQswCQYDVQQGEwJSVTEPMA0GA1UECAwGTW9zY293MQ8wDQYDVQQHDAZNb3Nj

b3cxDjAMBgNVBAoMBUJNU1RVMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3Jp

dHkxFzAVBgkqhkiG9w0BCQEWCDExQDExLnJ1MIGfMA0GCSqGSIb3DQEBAQUAA4GN

ADCBiQKBgQCw6w0ObyHgXYKjxwLUHP6Ggp9nYxgJ2MtWVg2zrOIxGepO6Hqxtx7i

CUlV29N9P2WLEf10MsUWTkEbyirg6SV0l46B81rDfyqZFMaXd1B0ZIx47DL82kzz

dvs9Wzfzn17DSlGxvNwXQgUR6AhyDg26EM1rclyHJBQMDM5mTF832wIDAQABo1Aw

TjAdBgNVHQ4EFgQUgOuj8vyHXXB35ycd2IapUbWV0oYwHwYDVR0jBBgwFoAUgOuj

8vyHXXB35ycd2IapUbWV0oYwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOB

gQAW9xF5KRh4neiX6EyIL7XOi2BEsriux7KWHS9nTFKnac3tp0UfY67yF7QBdimY

JzkzrGH95XW/mkVtQjCL9wSAiGXxqUMMPLDCfMD8LaclU4GkYnLlGGbDmQakKN8S

fgyIQjHD2QtkGcfm6OQAyGbFoavRlEGVOtPBimE7eolZVg==

-----END CERTIFICATE-----

Файл privkey.pem

-----BEGIN PRIVATE KEY-----

MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALZmKl8XlHvOSJfG

1eBuXuJpUieTTgoe3fDCijeS2JzT5xXAXxREOjOhQPvxYLXagFpU0bQhau8M+v6x

Nm2SAxki8uIpmcuzVzXecYHmxrqjqF9X3aQUWZp27e+QNBWERyCpxZo+lkE0GvZu

yvhLKywd7nf/4LD0HlxkBiPw4Zk9AgMBAAECgYA9yeRGrF0/h4Tt7YycZ6c6+cS7

5VnFcelrWuupodRBZENfCfjri6VPwiuabY1+bVOXxi334G4yJuqMBwpSGel0MqgQ

J5PkfQzF91Ijekqr14TpyDLAujwXCq+Qiv8M7ej+r/Mg2FKG+FeidgMoB8ycmoYc

k+cwxy7kI2s7JABufQJBAOh3qvrM7MR2hv4suVZUAGrrNPxLyzfMdUOJBKj0p8tC

PCgE4YT3fKtZrrUYzj0s8UIctVwgSHkoo/3kPtgkXdcCQQDI3P07aicv5eUa9dgv

DjXGNEb/238dpWFcUoLu6LdcN+kS4l8W3gAa24P3qwO54OPvs75xM8qGMeKrBqQD

TtcLAkEAlMM3vGV1Qsgi3Pcb55274q//6VBLjLqfdAdz3vcphY4uVuHAu8lwk2rB

vYxRNp7TCR68BGd4WWhjgW8VtFWZYwJANE7wl4d2ew/IkTPSv7ZYpKw6jSjxOpw1

9Z/7PxJVpetdhDB1iPP5XQUrodTkXITHd0X842gUZswY9mb9UWs3rwJABhLbl0st

N543y3BeASVAOgi7s/+bWWnc+e2YsgZeffLBGmEgV7rwj0m0y4m9HIxTNY6MHtGO

ymJueOXeD6YjNw==

-----END PRIVATE KEY-----

Файл casert.pem

-----BEGIN CERTIFICATE-----

MIICvjCCAiegAwIBAgIJANw+RXkhZwRrMA0GCSqGSIb3DQEBBQUAMHgxCzAJBgNV

BAYTAlJVMQ8wDQYDVQQIDAZNb3Njb3cxDzANBgNVBAcMBk1vc2NvdzEOMAwGA1UE

CgwFQk1TVFUxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGCSqG

SIb3DQEJARYIMTFAMTEucnUwHhcNMTMwMzE2MTM1NTAwWhcNMTMwNDE1MTM1NTAw

WjB4MQswCQYDVQQGEwJSVTEPMA0GA1UECAwGTW9zY293MQ8wDQYDVQQHDAZNb3Nj

b3cxDjAMBgNVBAoMBUJNU1RVMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3Jp

dHkxFzAVBgkqhkiG9w0BCQEWCDExQDExLnJ1MIGfMA0GCSqGSIb3DQEBAQUAA4GN

ADCBiQKBgQCw6w0ObyHgXYKjxwLUHP6Ggp9nYxgJ2MtWVg2zrOIxGepO6Hqxtx7i

CUlV29N9P2WLEf10MsUWTkEbyirg6SV0l46B81rDfyqZFMaXd1B0ZIx47DL82kzz

dvs9Wzfzn17DSlGxvNwXQgUR6AhyDg26EM1rclyHJBQMDM5mTF832wIDAQABo1Aw

TjAdBgNVHQ4EFgQUgOuj8vyHXXB35ycd2IapUbWV0oYwHwYDVR0jBBgwFoAUgOuj

8vyHXXB35ycd2IapUbWV0oYwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOB

gQAW9xF5KRh4neiX6EyIL7XOi2BEsriux7KWHS9nTFKnac3tp0UfY67yF7QBdimY

JzkzrGH95XW/mkVtQjCL9wSAiGXxqUMMPLDCfMD8LaclU4GkYnLlGGbDmQakKN8S

fgyIQjHD2QtkGcfm6OQAyGbFoavRlEGVOtPBimE7eolZVg==

-----END CERTIFICATE-----

Приложение 2

Файл 10-ssl.conf

##

## SSL settings

##

# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>

ssl = no

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before

# dropping root privileges, so keep the key file unreadable by anyone but

# root. Included doc/mkcert.sh can be used to easily generate self-signed

# certificate, just make sure to update the domains in dovecot-openssl.cnf

#ssl_cert = </etc/ssl/certs/dovecot.pem

#ssl_key = </etc/ssl/private/dovecot.pem

# If key file is password protected, give the password here. Alternatively

# give it when starting dovecot with -p parameter. Since this file is often

# world-readable, you may want to place this setting instead to a different

# root owned 0600 file by using ssl_key_password = <path.

#ssl_key_password =

# PEM encoded trusted certificate authority. Set this only if you intend to use

# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)

# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)

#ssl_ca =

# Request client to send a certificate. If you also want to require it, set

# auth_ssl_require_client_cert=yes in auth section.

#ssl_verify_client_cert = no

# Which field from certificate to use for username. commonName and

# x500UniqueIdentifier are the usual choices. You'll also need to set

# auth_ssl_username_from_cert=yes.

#ssl_cert_username_field = commonName

# How often to regenerate the SSL parameters file. Generation is quite CPU

# intensive operation. The value is in hours, 0 disables regeneration

# entirely.

#ssl_parameters_regenerate = 168

# SSL ciphers to use

#ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL

Файл stunnel.conf

; Sample stunnel configuration file by Michal Trojnara 2002-2010

;

; some options used here may not be adequate for your particular configuration

; please read the manual and make sure you understand them

; certificate/key is needed in server mode and optional in client mode

cert = /etc/stunnel/cert.pem

key = /etc/stunnel/privkey.pem

; protocol version (all, SSLv2, SSLv3, TLSv1)

sslVersion = SSLv3

; security enhancements for UNIX systems - comment them out on Win32

; for chroot a copy of some devices and files is needed within the jail

chroot = /var/run/stunnel

setuid = stunnel

setgid = stunnel

; PID is created inside the chroot jail

pid = /stunnel.pid

; performance tunings

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1

;compression = zlib

; workaround for Eudora bug

;options = DONT_INSERT_EMPTY_FRAGMENTS

; authentication stuff needs to be configured to prevent MITM attacks

; it is not enabled by default!

;verify = 2

; don't forget to c_rehash CApath

; CApath is located inside chroot jail

;CApath = /certs

; it's often easier to use CAfile

;CAfile = /etc/stunnel/certs.pem

; don't forget to c_rehash CRLpath

; CRLpath is located inside chroot jail

;CRLpath = /crls

; alternatively CRLfile can be used

;CRLfile = /etc/stunnel/crls.pem

; debugging stuff (may useful for troubleshooting)

;debug = 7

;output = stunnel.log

; SSL client mode

;client = yes

; service-level configuration

[pop3s]

accept = 995

connect = 110

[imaps]

accept = 993

connect = 143

[ssmtp]

accept = 465

connect = 25

;[https]

;accept = 443

;connect = 80

;TIMEOUTclose = 0

; vim:ft=dosini