Server security protection construction method based on puppet machine

Abstract

The invention discloses a server security protection construction method based on a puppet machine, and belongs to the technical field of security protection, and the method comprises the following steps: S1, setting IP addresses of the puppet machine and a real server, and monitoring a service port and a firewall strategy; s2, capturing mirror image traffic of the switch; s3, modifying a destination IP and a port of the original flow request message into a real server IP and a monitoring service port, and sending the modified request message to a real server; s5, capturing a response data packet of the real server, and modifying a destination IP and a destination port of the response data packet as a source IP and a source port of the original traffic; s6, sending a modified response data packet according to the source IP and the source port; s7, repeating the steps S3-S6, and completing the security establishment of the communication. The method belongs to passive defense, consumes less calculation and network resources, has small influence on the performance of the server, does not depend on specific software and hardware, and does not need to be frequently updated or maintained.

Description

Technical Field

[0001] The present invention belongs to the technical field of security protection, and in particular relates to a method for constructing server security protection based on a puppet machine. Background Art

[0002] Servers deployed on the Internet are often subject to targeted or non-targeted network attacks from third-party organizations. When a server is compromised, it faces the risk of various data being stolen, so it is particularly important to set up various security protection strategies for online servers.

[0003] Existing defense methods mainly use honeypot technology. The honeypot security structure or mechanism is used to divert and distract attackers from the organization's valuable assets. It is a security tool for identifying, recording and analyzing network attacks. Honeypots are mainly used to lure attackers into making illegal intrusions, thereby helping security teams collect intelligence and analyze attackers' behavior and develop corresponding response strategies.

[0004] However, this method belongs to active defense, which usually requires continuous monitoring and analysis of large amounts of data such as network traffic and system logs to identify potential threats. This may consume more computing and network resources and have a certain impact on system performance. In addition, active defense systems rely on specific software, hardware, or security updates to maintain their effectiveness. If these dependencies are not updated or maintained in a timely manner, the system's defense capabilities may be affected. Therefore, a passive security protection construction method is needed. Summary of the invention

[0005] In order to solve the problems raised in the above background technology, the present invention provides a method for constructing server security protection based on a puppet machine to solve the problems that the existing method consumes more computing and network resources and requires timely updating and maintenance.

[0006] To achieve the above object, the present invention provides the following technical solutions: A method for constructing server security protection based on a puppet machine includes the following steps: S1: Connect the puppet machine and the real server to the switch, and set the IP address and monitoring service port of the puppet machine and the real server; S2: Set the firewall policies of the puppet machine and the real server according to the operating system types of the puppet machine and the real server. The puppet machine is set to discard all ports, and the real server is set to discard all ports except the listening service port. S3: The real server captures the mirrored traffic of the switch and determines whether the original traffic of the mirrored traffic meets the following conditions: The destination IP is the IP of the puppet machine; The destination port is the monitoring service port of the puppet machine; If all conditions are met, then go to S4, otherwise repeat S3; S4: Based on the mirrored traffic, modify the destination IP of the original traffic request message to the real server IP, the destination port to the real server listening service port, recalculate the checksum and record the mapping relationship between the modified destination IP and destination port, and then use the network data flow playback tool to send the modified request message to the real server; S5: Capture the response data packet of the real server to the request message, and modify the destination IP and destination port of the response data packet according to the mapping relationship. The modified destination IP is the source IP of the original traffic, and the port is the source port of the original traffic, and the checksum is recalculated; S6: Sending a modified response data packet according to the source IP and source port; S7: Repeat S3-S6 to complete the secure establishment of communication.

[0007] Preferably, the real server is provided with three network cards, namely, a mirror network card, a traffic injection network card and a communication network card; In S3, the mirrored traffic of the switch is sent to the mirrored NIC of the real server; In S4, the modified request message is sent to the communication network card of the real server, and in S5, the response data packet is sent through the communication network card of the real server; In S6, the modified response data packet is sent through the injection network card.

[0008] Preferably, in S2, for the Windows operating system, the following firewall policy settings are performed: In the New Inbound Rule Wizard and New Outbound Rule Wizard in Control Panel-Firewall, create inbound and outbound rules; For the puppet machine, set the inbound rules and outbound rules to drop all ports, select "all remote ports", select "block connection", and finally enter the rule name to complete the puppet machine settings; For the real server, in the inbound and outbound rule settings, except for the listening service port, discard all ports, select "Specific remote port", enter the interval range, select "Block connection", and then enter the rule name to complete the real server settings.

[0009] Preferably, in S2, for the Linux operating system, firewall discard rules are set through Iptables / Firewalld, the firewall policy configuration file is edited, the policy configuration of the puppet machine rejecting all ports is added to the configuration file, and the policy of discarding all remaining ports except the listening service port of the real server is added to the configuration file, and then iptables is saved to the file, and finally systemctl restart iptables.service is used to restart the firewalld service to complete the configuration.

[0010] Preferably, the real server is deployed with a packet capture program, and the real server captures the mirror traffic from the switch to the mirror network card through the packet capture program, and the real server uses the packet capture program to capture the response data packet of the communication network card.

[0011] Preferably, the real server is deployed with a packet sending program, and the real server sends a response data packet modified according to the source IP and source port through the packet sending program via the back-injection network card.

[0012] Compared with the prior art, the present invention has the following beneficial effects: This application builds a server puppet machine. When a third-party attacker attacks, the attacker will mistakenly think that the puppet machine is a real server. Even if the puppet machine is compromised, no file data is saved on its device, thus avoiding the problem of data stored on it being stolen after the server is compromised. This application is a passive defense, consumes less computing and network resources, has little impact on the performance of the server, and does not rely on specific software and hardware, and does not require frequent updates or maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a schematic diagram of the process of this application. DETAILED DESCRIPTION

[0014] In order to facilitate those skilled in the art to understand the technical content of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific examples. It should be understood that the specific examples described herein are only used to explain the present invention and are not used to limit the present invention.

[0015] Embodiment 1: A method for constructing server security protection based on puppet machines, such as Figure 1 As shown, the following steps are included: A1: Set the IP address of the puppet machine and real server and the listening service port; The IP of the puppet machine is IP_0 (public network IP); The virtual server monitors the service port Port_0. The real server is set up with three network cards, namely the mirror network card, the traffic injection network card and the communication network card. The IP is IP_1 (private network IP) and the monitoring service port is Port_1. After the settings are completed, enter A2: A2: Set up firewall policies for puppet machines and real servers; The puppet machine is set to discard all port policies; The real server sets a policy of discarding all ports except Port_1; If the operating system of the puppet machine or real server is Windows, go to A3 to set the firewall policy. If the operating system is Linux, go to A4 to set the firewall discard policy. A3: For Windows system, set up Windows Firewall. First, enter the control panel, select "Windows Firewall", select "Advanced Settings", enter "Windows Firewall with Advanced Security", select "Inbound Rules" and "Outbound Rules", and create inbound and outbound rules in the "New Inbound Rules Wizard" and "New Outbound Rules Wizard". You can select program, port, predefined, and custom to restrict inbound rules. The port used in this method is restricted; For puppet devices, the inbound and outbound rules need to be set to discard all ports, select "All remote ports", then select "Block connection", and finally enter the rule name to complete; For real server devices, inbound and outbound rules need to be set to discard all ports except Port_1, select "Specific remote port", enter the range of "1-Port_1-1, Port_1+1", and then select "Block connection", which means that only Port_1 port data is allowed to pass, and all other port data are discarded. Finally, enter the rule name to complete. After completion, enter A5; A4: For Linux operating system, set firewall discard rules through Iptables / Firewalld. This solution selects CentOA7.9 system version and uses Firewalld to set rules. Check the firewall status: firewall-cmd--state. If it is closed, use the command: systemctl start iptables.service to start the firewalld service, edit the firewall policy configuration file, the configuration file path: / etc / sysconfig / iptables, add the following configuration to the configuration file: For puppet devices, the deny all port policy configuration is as follows: -A INPUT -j DROP; For real server devices, the policy configuration of denying and dropping all ports except Port_1 is as follows: -A INPUT -p tcp --dport 1:Port_1-1 -j DROP; -A INPUT -p tcp --dport Port_1+1:65535 -j DROP; Then save iptables to a file, and finally restart the firewalld service using systemctl restart iptables.service to complete the configuration. After that, proceed to A5. A5: The real server deploys a packet capture program to capture the traffic mirrored from the switch to the mirrored network card; determines whether the destination IP of the traffic is IP_0 and whether the port is Port_0. If the judgment is True, proceed to A6; if the judgment is False, directly discard it and repeat A5; A6: Based on the original mirrored traffic, assume that the original request message IP port information is IP_S: Port_S->IP_0:Port_0, where IP_S and Port_S represent the request source IP and source port, and IP_0 and Port_0 represent the request destination IP and destination port. Modify the message destination IP to IP_1 and the destination port to Port_1, then the modified IP port information is IP_S: Port_S->IP_1:Port_1, recalculate the checksum and record the modified IP and port mapping relationship, then use the network data stream playback tool to send the request to the communication network card of the real server to complete A7; A7: Use a packet capture program to capture the response data packet of the real server communication network card, and modify the IP port information of the response data packet according to the IP and port mapping relationship. The modified IP port information is IP_0:Port_0->IP_S:Port_S, and the checksum is recalculated to complete A8; A8: Use the packet sending program to send the modified response data packet through the back-injection network card, and then transfer to A9; A9: Repeat steps A5-A8 continuously, and finally complete the connection establishment by capturing the request data packet through the network card, modifying the IP information of the request data packet, replaying the network request data, capturing the response data packet through the network card, modifying the IP information of the response data packet, and injecting the network response data.

[0016] In this embodiment, the present application builds a server puppet machine. When a third-party attacker attacks, the attacker will mistakenly believe that the puppet machine is a real server. Even if the puppet machine is compromised, no file data is saved on its device, thus avoiding the problem of data stored on the server being stolen after the server is compromised. The present application is a passive defense, consumes less computing and network resources, has little impact on the performance of the server, and does not rely on specific software and hardware, and does not require frequent updates or maintenance.

Claims

1. A method for constructing server security protection based on a puppet machine, characterized in that: The following steps are involved: S1: Connect the puppet machine and the real server to the switch, and set the IP address and monitoring service port of the puppet machine and the real server; S2: Set the firewall policies of the puppet machine and the real server according to the operating system types of the puppet machine and the real server. The puppet machine is set to discard all ports, and the real server is set to discard all ports except the listening service port. S3: The real server captures the mirrored traffic of the switch and determines whether the original traffic of the mirrored traffic meets the following conditions: The destination IP is the IP of the puppet machine; The destination port is the monitoring service port of the puppet machine; If all conditions are met, then go to S4, otherwise repeat S3; S4: Based on the mirrored traffic, modify the destination IP of the original traffic request message to the real server IP, the destination port to the real server listening service port, recalculate the checksum and record the mapping relationship between the modified destination IP and destination port, and then use the network data flow playback tool to send the modified request message to the real server; S5: Capture the response data packet of the real server to the modified request message, and modify the destination IP and destination port of the response data packet according to the mapping relationship. The modified destination IP is the source IP of the original traffic, and the port is the source port of the original traffic, and the checksum is recalculated; S6: Sending a modified response data packet according to the source IP and source port; S7: Repeat S3-S6 to complete the secure establishment of communication.

2. According to a method for constructing server security protection based on a puppet machine according to claim 1, it is characterized in that: The real server is equipped with three network cards, namely the mirror network card, the traffic injection network card, and the communication network card; In S3, the mirrored traffic of the switch is sent to the mirrored NIC of the real server; In S4, the modified request message is sent to the communication network card of the real server, and in S5, the response data packet is sent through the communication network card of the real server; In S6, the modified response data packet is sent through the injection network card.

3. According to a method for constructing server security protection based on a puppet machine according to claim 1, it is characterized in that: In S2, for the Windows operating system, set the following firewall policy: In the New Inbound Rule Wizard and New Outbound Rule Wizard in Control Panel-Firewall, create inbound and outbound rules; For the puppet machine, set the inbound rules and outbound rules to drop all ports, select "all remote ports", select "block connection", and finally enter the rule name to complete the puppet machine settings; For the real server, in the inbound and outbound rule settings, except for the listening service port, discard all ports, select "Specific remote port", enter the interval range, select "Block connection", and then enter the rule name to complete the real server settings.

4. According to a method for constructing server security protection based on a puppet machine according to claim 1, it is characterized in that: In S2, for the Linux operating system, set the firewall discard rules through Iptables / Firewalld, edit the firewall policy configuration file, add the policy configuration of the puppet machine to reject all ports in the configuration file, add the policy of discarding all remaining ports of the real server except the listening service port in the configuration file, then save iptables to the file, and finally use systemctl restart iptables.service to restart the firewalld service to complete the configuration.

5. A method for constructing server security protection based on a puppet machine according to claim 2, characterized in that: The real server is deployed with a packet capture program. The real server captures the mirror traffic from the switch to the mirror network card through the packet capture program. The real server uses the packet capture program to capture the response data packets of the communication network card.

6. A method for constructing server security protection based on a puppet machine according to claim 2, characterized in that: The real server is deployed with a packet sending program, and the real server sends a response data packet modified according to the source IP and source port through the packet sending program via the back-injection network card.

Images