ait-testbed / atb-aecid-testbed Goto Github PK

Capabilities of tcpdump must be set to cap_net_raw and cap_net_admin ( https://github.com/ait-testbed/atb-ansible-tcpdump )

Please add cas1, cas2, adminpc1, adminpc2, webuser, dnsuser to the testbed, ghost-server

In scenario1(videoserver) some attacks need actions executed from admin-pc. In order to make those hosts accessible by attackm8, the mgmt-host is allowed to have password-login via ssh. This is insecure in environments where the mgmt-host is hosted with a public ip(public cloudprovider).

I can think of possible solutions like:

1. create another jumphost, that is only for the simulation and has no floating-ip
2. add the inet-network to the adminpcs so that they are dual-homed and can directly accessed by attackm8

MGMT-Host needs static ip adresses. Change the terragrunt-bootstrap. Use the same postfix(last part of the ip address) for every single network

Currently the adminpc's are in the lan-network. Create admin-networks. Admins are allowed to access all networks. Add the network to the terragrunt/bootstrap

In the docs, there is still "terraform" instead of "opentofu"

Put all required packages like python-openstackclient and passlib in requirements.txt

Add Ghost-Usersimulation for the videoserver-scenario to the testbed

customdpkg installs from a repository. But at packer-time there is no repository!

For some reasons we want "log_format = RAW" for auditd.conf

Currently only bruteforce is only done with ssh. This scenario needs modifications for the attackmate

The variables.pkr.hcl files in the packer folders have the old names as default values for the flavor variables. This should be eventually updated to the new naming conventions (e.g. d2-2 instead of m1.small).

For terragrunt init to work, provider need to be changed in the versions.tf files from terraform-providers/openstack to terraform-provider-openstack/openstack

registry: https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest

Create a dedicated network for user-clients. Install a squid-proxy on the firewall so that the users are forced to use the proxy

There is a healthcheck-server but no healthcheck-client

Add rsync to the atb-ansible-aecidtools role