Network Security Guide: Complete Tutorial

# Network Segmentation Example (Cisco)
! Create VLANs
vlan 10
 name USER_NETWORK
vlan 20
 name SERVER_NETWORK
vlan 30
 name DMZ

! Configure Inter-VLAN Routing
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip access-group USER_ACL in

interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip access-group SERVER_ACL in

! Configure Firewall Rules
ip access-list extended USER_ACL
 deny ip any 192.168.20.0 0.0.0.255
 permit tcp any any eq 80
 permit tcp any any eq 443

! IDS/IPS Integration
ip ips name NETWORK_IPS
ip ips signature-category
  category all
    retired true
  category ios_ips basic
    retired false

# SSH Configuration (OpenSSH)
# /etc/ssh/sshd_config
Protocol 2
PermitRootLogin no
MaxAuthTries 3
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
X11Forwarding no
AllowUsers admin@192.168.1.0/24

# Firewall Configuration (iptables)
# Basic ruleset
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Snort IDS Rule Examples
# Detect SQL Injection
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (
    msg:"SQL Injection Attempt";
    flow:to_server,established;
    content:"UNION"; nocase;
    content:"SELECT"; nocase;
    pcre:"/UNION.*SELECT/i";
    classtype:web-application-attack;
    sid:1000001; rev:1;
)

# Port Scan Detection
alert tcp any any -> $HOME_NET any (
    msg:"Potential Port Scan";
    flow:stateless;
    detection_filter:track by_src,
    count 50, seconds 5;
    reference:arachnids,439;
    classtype:attempted-recon;
    sid:1000002; rev:1;
)

# Suspicious Outbound Traffic
alert tcp $HOME_NET any -> any $HTTP_PORTS (
    msg:"Potential Data Exfiltration";
    flow:established,to_server;
    dsize:>1000;
    threshold:type threshold,
    track by_src, count 10, seconds 60;
    classtype:data-loss;
    sid:1000003; rev:1;
)

# Logstash Configuration
input {
  file {
    path => "/var/log/auth.log"
    type => "syslog"
  }
  beats {
    port => 5044
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "logstash-%{+YYYY.MM.dd}"
  }
  if [type] == "syslog" {
    if [syslog_program] == "sshd" {
      if [syslog_message] =~ "Failed password" {
        email {
          to => "security@example.com"
          subject => "SSH Failed Login Alert"
          body => "Failed SSH login detected from %{source_ip}"
        }
      }
    }
  }
}

# Incident Response Script
#!/bin/bash

# Variables
ALERT_EMAIL="security@example.com"
LOG_FILE="/var/log/incident_response.log"
QUARANTINE_VLAN=999

function log_incident() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> $LOG_FILE
}

function quarantine_host() {
    local MAC=$1
    local IP=$2
    
    # Update VLAN assignment
    ssh network-switch "
        configure terminal
        interface $(get_interface_by_mac $MAC)
        switchport access vlan $QUARANTINE_VLAN
        exit"
    
    # Block traffic
    iptables -A INPUT -s $IP -j DROP
    iptables -A OUTPUT -d $IP -j DROP
    
    log_incident "Quarantined host: $IP ($MAC)"
}

function collect_forensics() {
    local IP=$1
    local TIMESTAMP=$(date +%Y%m%d_%H%M%S)
    
    # Capture traffic
    tcpdump -i any host $IP -w /forensics/$IP_$TIMESTAMP.pcap &
    
    # Collect logs
    find /var/log -type f -exec grep $IP {} \; > \
        /forensics/$IP_$TIMESTAMP.logs
    
    log_incident "Forensics collected for: $IP"
}

# System Recovery Script
#!/bin/bash

function verify_system_integrity() {
    # Check critical system files
    tripwire --check > integrity_report.txt
    
    # Verify running services
    systemctl list-units --state=failed > failed_services.txt
    
    # Check for unauthorized users/groups
    awk -F: '$3 >= 1000 && $3 != 65534' /etc/passwd > \
        user_audit.txt
}

function restore_from_backup() {
    local SYSTEM=$1
    local TIMESTAMP=$2
    
    # Stop services
    systemctl stop application.service
    
    # Restore from backup
    restic restore latest --target /
    
    # Verify restoration
    verify_system_integrity
    
    # Update security configurations
    ansible-playbook security-hardening.yml
    
    # Restart services
    systemctl start application.service
}