ITX8080: erinevus redaktsioonide vahel

Allikas: Lambda
Mine navigeerimisribale Mine otsikasti
← Vanem muudatus
Anttix (arutelu | kaastöö)
218 muudatust
Resümee puudub
Anttix (arutelu | kaastöö)
218 muudatust
 
(ei näidata sama kasutaja 79 vahepealset redaktsiooni)
2. rida: 2. rida:
== Schedule ==
== Schedule ==


Lecture TH 12:00 - 13:30
Lecture TH 17:45 - 21:15 (odd weeks)


Practice FR 14:00 - 17:30
Practice TH 17:45 - 21:15 (even weeks)


== Communication ==
== Communication ==


Discussinons will be held at: itx8080 atatat googlegroups.com
Discussinons will be held at course forum in Moodle.


Send e-mail to hannesa at-no-spam-please gmail.com for an invitation.
https://moodle.e-ope.ee/course/view.php?id=4319
 
All scenario proposals must be posted to their own respective forums.
 
Please register your account today at http://moodle.e-ope.ee


The lecturers can be reached via the course coordinator:  
The lecturers can be reached via the course coordinator:  
16. rida: 20. rida:
antti.andreimann only-people-please eesti.ee
antti.andreimann only-people-please eesti.ee


== Points awarded so far ==
= Grading =
 
Best of the bunch will score points.
 
Points will be awareded for the:
 
* Best simulation proposal
* Best result obtained in the lab environment
* Best lab report
 
In total it is possible to score three points for every two weeks.
 
Maximum score is 3, nobody will be awareded more.


Arnis : 1 point - ab testing solution
Minimum score to pass is 1.


Igor : 2 points - wordpress virtualization solution, lab 3 report
For those who can not score a single point, an
examination proposals will received from those
of you who scored 3 and voted.


Kaarel : 2 points - lab 1 report and conclusions, lab 3 solution
== Points scored so far ==


Märt : 3 points - wordpress testing procedure, best wordpress optimization (wp-cache + php-apc), best lab 2 report.
Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)


= Scenarios =
Andres - 1pts (best lab 1 report)
 
Michal - 1pts (best lab 1 result)
 
Alexandre - 1pts (best lab 2 result)


== Scenario 1 ==
Roman - 1pts (best lab 2 report)
There is a Wordpress based blog.


The client is worried: How many visitors can they handle before they die.
Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)


Establish a baseline: How many page displays per second AT LEAST we can handle.
Predrag - 2pts (best lab 3 proposal with Allan, best scenario 5 proposal)
Disruption of the site operation is NOT acceptable.


Minimal budget!
Mauno P - 3pts (best lab 3 report, best lab 4 report, best scenario 7 proposal)


Be as detailed and technical as You possibly can.
Robert P - 3 pts (best scenario 4 proposal, best lab 4 result, best lab 5 result)


Post to the discussion group the following information:
Anis - 1 pts (best lab 4 result)


# Detailed description of the simulation of the site. eg. if You're going to virtualize it then how? If You are running it as a process, then how You separate it from the real machine?
Mart - 1 pts (best lab 5 report)
# Detailed description of the attack / benchmark tools picked. Where You are going to run them? What tools? How many copies? How you are going to collect the results?!!!


=== Proposals ===
Ronny - 1 pts (best lab 7 report)
Benchmarking:
* AB - Discussed in lecture
* http://tsung.erlang-projects.org - Jérémy
* wget + AB - Arnis
* http://jakarta.apache.org/jmeter/ - Roland, Jérémy
* http://grinder.sourceforge.net/ - Märt
* http://httpd.apache.org/test/flood/ - Hannes
* Normal monitoring software on live server - Urmas


Simulation of the system:
Mikheil - 1 pts (best lab 6 report)
* VirtualBox - Roland, Jérémy
* VMWare ESX - Igor
* VMWare Player - Marina
* Amazon EC2 - Märt
* KVM - Siim
* Original hardware - Hannes


=== Lab 1 ===
Jan - 1pts (best lab 8 result)
We will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server. It's probably easiest to install only one image and then clone it.


Hard disk image cloning is best done with
Franck - 1pts (best lab 8 report)


Linux:
= Scenarios =
VBoxManage clonehd FirstUbuntu.vdi SecondUbuntu.vdi


Windows:
== Scenario 1 ==
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" clonehd FirstUbuntu.vdi SecondUbuntu.vdi


After cloning the image create another virtual machine and attach the 2nd disk to that machine. As the result there will be two different virtual machines with two different virtual hard disks.
There is a Wordpress based blog.


To be able to connect between the two virtual machines, You need to add an
The client is worried: How many visitors can they handle before they die.
additional network adapter to both hosts. It can be either "Host Only" or
"Internal" type.


To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces
Establish a baseline: How many page displays per second AT LEAST we can handle.
Disruption of the site operation is NOT acceptable.


== Scenario 2 ==
Minimal budget!
Design a method for evaluating any speedup solutions for the wordpress.
A repeatable process to evaluate the claims.
Whatever optimizations.
The process must be detailed enough so that somebody else can get the same results when applying that.
The @other person@ is expected to have IT knowledge sufficient to install and run a Linux desktop.
The method must specify the level performance
at which the site is considered DEAD.
Budget requirements: Low - Dedicated machine + dedicated tester.


=== Lab 2 ===
Assume upstream bandwidth can cope...
* Get Virtual machine disk image and instructions from: http://www.tud.ttu.ee/~anttix/lab2/ <br /> '''NB! DO NOT DOWNLOAD IMAGE FROM THE LINK NOTED IN INSTRUCTIONS PDF, IT WILL BE SLOW'''
* Fix bug in image (see below)
* Measure the effect of these wordpress plugins:
** [http://wordpress.org/extend/plugins/wp-super-cache/ WP Super Cache]
** [http://wordpress.org/extend/plugins/wp-cache/ WP-Cache]
* Devise Your own optimizations for the site


Bug in image: the ip address of the VM is saved in WP database as 192.168.56.3
Be as detailed and technical as You possibly can.
It is advised tu run the Target VM first and run the "sudo dhclient" command first in Target VM.
Then check active IP of target by command "ifconfig".  If it is not 192.168.56.3, then situation can be fixed by running:
In Target VM: "sudo ifconfig eth2 192.168.56.3"
In Client VM: "sudo ifconfig eth2 192.168.56.4"


==== A note to Windows users ====
=== Proposals ===
Use this command line to access VBoxManage program


"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"
* Install a similar system on test hardware
** Test hardware is smaller than
* Extrapolate from current system logs
** Must have some load ...
** It may NOT be linear (it usually isn't!)
* Generate some load (without breaking it) and extrapolate from logs
* Find existing performance graphs for wordpress ... (highly unlikely)


==== Wordpress Admin access ====
=== Simulation environment ===
Username: admin
Password: QIaTemvskSeM


* Real hardware
* Virtualization platform


==== Note to Ubuntu users ====
Pick what is closer to the real system.
VirtualBox with WiFi Does NOT work properly http://ubuntuforums.org/showthread.php?t=782936


== Scenario 3 ==
=== Benchmarking tools ===
Your client is worried about some stuff posted on a blog. They ask You to take care of it.
They have a throwaway "script kiddie" in a third world country, who will mount the attack
so You don't need to worry about hiding the attackers identity.


Devise a way to attack a wordpress (default installation) based site to render it
* httpPerf
unusable (page view times over 60 seconds).
* pagetop
* htop
* AB - apache bench
* curl / wget + custom scripts
* JMeter
* Grinder
* wpscan - wordpress specific


Attack resources: one PC, a script kiddie, internet connection of 2Mbit/s.
=== How to separate benchmark tools from the server? ===


How are we going to evaluate the solutions?
* Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
* Easy to use instructions
* Put VM disk images on different disks (probably an overkill)?
* The most efficient use of available resources
* Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
* Start monitoring load and page views. Generate some load on real system. How?


Defacing will count, IF it works for the latest version of wordpress.
How do we define the system is dead?


=== Lab 3 ===
Page view takes longer than 10sec.
Possible attacks:


* Brute force overload (AB or other benchmark), bang the slowest page possible.
=== Determining if referenced content has an effect on results ===
* Connection flood (slowloris)
* Make a list of all references the main page has
* SYN Flood (eg. with hping)
* Measure the performance of all the URLs
* Banging expensive operations (eg. adding big comments)
* Disregard the ones that load at least two magnitudes faster.
* etc.


== Scenario 4 ==
=== How to measure the results? ===
Develop countermeasures for the attacks simulated in Lab 3.


Limitations:
* Measure response times and number of parallel requests using the benchmarking tool itself
* No additional hardware
* Deduct the numbers from server logs
* No reactive measures
* Put the system under load, test with a normal browser if the load time is reasonable.


=== Lab 4 ===
=== What to document? ===


Evaluate the countermeasures against attacks.
* Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
The countermeasures must not have negative effects
* The version of the benchmarking tool used
on "normal usage pattern".
* Virtualization platform
* Hardware specification
* URL of the page tested
* Wordpress configuration
* Wordpress content !!!
* Wordpress version
* Web server configuration
* Web server version (apache, php, sql, etc)
* The measurement results (page load times under each different test)
* Web browser used to measure response time (type, version, operating system)
* Operating system configuration (version, software installed, customizations etc).
* The AUTHOR! and the DATE!


Normal usage pattern is defined as:
Write evertyhing down at ONCE.
* Bursts of 10 connections per IP address in 1 second
if using VM-s save the image.
* Page load times not over 20 seconds


== Scenario 5 ==
=== Lab1 ===
Create a solution and instructions for testing IDS
systems against the wordpress site and attacks
tried in lab 3.


A repeatable process to evaluate the claims.
* Virtualization platform: VirtualBox
Whatever passive IDS system delivered as a VM or a dedicated box.
** 512M memory, 1 CPU for each VM
* Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
* Ubuntu Server 10.04 LTS 32bit
* Web server: Apache2, SQL: MySQL (default versions bundled with OS)
* Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.


Creating the IDS system itself is out of scope.


The process must be detailed enough so that somebody else can get the same results when applying that.
You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.
The "other person" is expected to have IT knowledge sufficient to install and run a Linux desktop.


Budget requirements: Modest - 2 Dedicated machines + dedicated tester + networking equipment to connect these together.
To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.


The process must test at least the following:
To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces
* Port scan
* SYN flood
* slowloris/pyloris
* Ab overwhelming attack

Viimane redaktsioon: 21. detsember 2011, kell 01:55

General Information

Schedule

Lecture TH 17:45 - 21:15 (odd weeks)

Practice TH 17:45 - 21:15 (even weeks)

Communication

Discussinons will be held at course forum in Moodle.

https://moodle.e-ope.ee/course/view.php?id=4319

All scenario proposals must be posted to their own respective forums.

Please register your account today at http://moodle.e-ope.ee

The lecturers can be reached via the course coordinator:

antti.andreimann only-people-please eesti.ee

Grading

Best of the bunch will score points.

Points will be awareded for the:

  • Best simulation proposal
  • Best result obtained in the lab environment
  • Best lab report

In total it is possible to score three points for every two weeks.

Maximum score is 3, nobody will be awareded more.

Minimum score to pass is 1.

For those who can not score a single point, an examination proposals will received from those of you who scored 3 and voted.

Points scored so far

Margus - 3pts (lecture 1 vote, lab 2 testing method, lab 3 result)

Andres - 1pts (best lab 1 report)

Michal - 1pts (best lab 1 result)

Alexandre - 1pts (best lab 2 result)

Roman - 1pts (best lab 2 report)

Allan - 3pts (best lab 3 proposal with Predrag, lucky SOB scenario 4 proposal, best scenario 5 proposal)

Predrag - 2pts (best lab 3 proposal with Allan, best scenario 5 proposal)

Mauno P - 3pts (best lab 3 report, best lab 4 report, best scenario 7 proposal)

Robert P - 3 pts (best scenario 4 proposal, best lab 4 result, best lab 5 result)

Anis - 1 pts (best lab 4 result)

Mart - 1 pts (best lab 5 report)

Ronny - 1 pts (best lab 7 report)

Mikheil - 1 pts (best lab 6 report)

Jan - 1pts (best lab 8 result)

Franck - 1pts (best lab 8 report)

Scenarios

Scenario 1

There is a Wordpress based blog.

The client is worried: How many visitors can they handle before they die.

Establish a baseline: How many page displays per second AT LEAST we can handle. Disruption of the site operation is NOT acceptable.

Minimal budget!

Assume upstream bandwidth can cope...

Be as detailed and technical as You possibly can.

Proposals

  • Install a similar system on test hardware
    • Test hardware is smaller than
  • Extrapolate from current system logs
    • Must have some load ...
    • It may NOT be linear (it usually isn't!)
  • Generate some load (without breaking it) and extrapolate from logs
  • Find existing performance graphs for wordpress ... (highly unlikely)

Simulation environment

  • Real hardware
  • Virtualization platform

Pick what is closer to the real system.

Benchmarking tools

  • httpPerf
  • pagetop
  • htop
  • AB - apache bench
  • curl / wget + custom scripts
  • JMeter
  • Grinder
  • wpscan - wordpress specific

How to separate benchmark tools from the server?

  • Use to VMs, Use CPU allocation in virtualization environment to allocate different CPUs for different VMs
  • Put VM disk images on different disks (probably an overkill)?
  • Monitor process table and make sure that test tools consume significantly less than web server processes. Lower the priority of the test tools.
  • Start monitoring load and page views. Generate some load on real system. How?

How do we define the system is dead?

Page view takes longer than 10sec.

Determining if referenced content has an effect on results

  • Make a list of all references the main page has
  • Measure the performance of all the URLs
  • Disregard the ones that load at least two magnitudes faster.

How to measure the results?

  • Measure response times and number of parallel requests using the benchmarking tool itself
  • Deduct the numbers from server logs
  • Put the system under load, test with a normal browser if the load time is reasonable.

What to document?

  • Exact configuration of the benchmarking tool (command line, scripts, config files etc. for EACH test performed)
  • The version of the benchmarking tool used
  • Virtualization platform
  • Hardware specification
  • URL of the page tested
  • Wordpress configuration
  • Wordpress content !!!
  • Wordpress version
  • Web server configuration
  • Web server version (apache, php, sql, etc)
  • The measurement results (page load times under each different test)
  • Web browser used to measure response time (type, version, operating system)
  • Operating system configuration (version, software installed, customizations etc).
  • The AUTHOR! and the DATE!

Write evertyhing down at ONCE. if using VM-s save the image.

Lab1

  • Virtualization platform: VirtualBox
    • 512M memory, 1 CPU for each VM
  • Wordpress 3.2.1 with default settings (no extra plugins, no performance tweaks, default skin) and default home page
  • Ubuntu Server 10.04 LTS 32bit
  • Web server: Apache2, SQL: MySQL (default versions bundled with OS)
  • Point will go to the person that can produce the most dense graph showing the number of concurrent connections against the response time. Individual tests used to plot the data must be repeated at least 3 times.


You will need to create two different virtual machines, one is going to be the wordpress server and the 2nd one is the client which is used to attack the server.

To be able to connect between the two virtual machines, You need to add an additional network adapter to both hosts. It can be either "Host Only" or "Internal" type.

To enable the new adapters in Ubuntu edit the file: /etc/network/interfaces

Pärit leheküljelt "http://www.lambda.ee/w/index.php?title=ITX8080&oldid=8433"