Skip to content

Commit 08ee292

Browse files
dnkcomactiveshadow
dnkcom
authored and
activeshadow
committed
initial commit
0 parents  commit 08ee292

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+53562
-0
lines changed

‎.github/workflows/docker.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Publish Docker Image
2+
on:
3+
push:
4+
branches: ['main']
5+
jobs:
6+
push-to-ghcr:
7+
name: Push tools Docker image to GitHub Packages
8+
runs-on: ubuntu-latest
9+
permissions:
10+
packages: write
11+
contents: read
12+
steps:
13+
- name: Checkout Code
14+
uses: actions/checkout@v3
15+
- name: Get short SHA
16+
run: |
17+
echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
18+
echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV
19+
- name: Log in to GitHub Docker Registry
20+
uses: docker/login-action@v2
21+
with:
22+
registry: ghcr.io
23+
username: ${{ github.actor }}
24+
password: ${{ secrets.GITHUB_TOKEN }}
25+
- name: Store Lowercase Image Repo Name
26+
run: echo IMAGE_REPO=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
27+
- name: Build container image
28+
uses: docker/build-push-action@v3
29+
with:
30+
context: .
31+
file: Dockerfile.tools
32+
push: true
33+
tags: |
34+
ghcr.io/${{ env.IMAGE_REPO }}/tools:${{ env.sha }}
35+
ghcr.io/${{ env.IMAGE_REPO }}/tools:${{ env.branch }}

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
configs/grafana/plugins/*
2+
!configs/grafana/plugins/.gitkeep

‎.gitpod.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
tasks:
2+
- command: |
3+
docker-compose up -d
4+
5+
ports:
6+
- port: 1880
7+
name: HMI
8+
description: Turbine HMI (at /ui path)
9+
10+
vscode:
11+
extensions:
12+
- ms-azuretools.vscode-docker

‎Dockerfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
FROM ghcr.io/patsec/ot-sim/ot-sim:main
2+
3+
RUN curl -O --output-dir /tmp https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-8.16.1-amd64.deb \
4+
&& dpkg -i /tmp/packetbeat-8.16.1-amd64.deb
5+
6+
COPY ./configs/elasticsearch/packetbeat.yml /etc/packetbeat/packetbeat.yml
7+
RUN chown root:root /etc/packetbeat/packetbeat.yml
8+
COPY ./scripts/start-packetbeat.sh /start-packetbeat.sh
9+
RUN chmod +x /start-packetbeat.sh
10+
COPY ./scripts/packetbeat-entrypoint.sh /docker-entrypoint.sh
11+
RUN chmod +x /docker-entrypoint.sh
12+
13+
ENTRYPOINT ["/docker-entrypoint.sh"]
14+
CMD ["ot-sim-cpu-module", "/etc/ot-sim/config.xml"]

‎Dockerfile.tools‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
FROM debian:bookworm
2+
3+
RUN echo "wireshark-common wireshark-common/install-setuid boolean false" | debconf-set-selections
4+
5+
RUN apt update \
6+
&& apt install -y --no-install-recommends \
7+
ca-certificates \
8+
curl \
9+
dsniff \
10+
lxterminal \
11+
htop \
12+
iptables \
13+
iproute2 \
14+
nano \
15+
nmap \
16+
novnc \
17+
openbox \
18+
python3 \
19+
python3-pip \
20+
supervisor \
21+
tcpdump \
22+
tigervnc-standalone-server \
23+
tint2 \
24+
tmux \
25+
tshark \
26+
vim \
27+
wireshark \
28+
xdg-utils \
29+
&& rm -rf /var/lib/apt/lists \
30+
&& mkdir -p /usr/share/desktop-directories
31+
32+
RUN curl -fsSL https://tailscale.com/install.sh | sh
33+
34+
RUN python3 -m pip install --break-system-packages mitmproxy
35+
36+
COPY configs/docker/openbox-menu.xml /root/.config/openbox/menu.xml
37+
COPY configs/docker/tint2rc /root/.config/tint2/tint2rc
38+
COPY configs/docker/supervisord.conf /etc/supervisor/supervisord.conf
39+
40+
RUN cp /etc/xdg/openbox/rc.xml /root/.config/openbox/rc.xml \
41+
&& sed -i 's/Clearlooks/Nightmare-01/g' /root/.config/openbox/rc.xml
42+
43+
EXPOSE 8080
44+
45+
CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]

‎README.md‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
# OT Security Lab: UIUC CS 460 / ECE 419 - Security Laboratory
2+
3+
Welcome to the second OT Security Lab for UIUC course CS 460 / EC419 - Security
4+
Laboratory in December 2024.
5+
6+
This lab has three separate modules, each building on the previous one, in
7+
separate branches. Modules 1 and 2 rely on wind farm controller infrastructure
8+
containers present in this branch to be deployed and connected to the Tailscale
9+
Tailnet used for this lab. Instructions for deploying the wind farm controller
10+
infrastructure follow the Tailscale setup instructions below.
11+
12+
## Tailscale Setup
13+
14+
The lab leader must set up the Tailscale infrastructure for lab participants to
15+
join the wind farm. Access the [Tailscale
16+
administration](https://login.tailscale.com/admin/) interface via a browser.
17+
18+
### Access Control: Edit tagOwners
19+
20+
The Tailscale authentication keys that will be used by lab participants will
21+
include tags to support lab activities. In order to associate tags with
22+
authentication keys, edit the access controls policy file by browsing to the
23+
[Access controls] (https://login.tailscale.com/admin/acls/file) tab and then
24+
clicking `Edit file`.
25+
26+
<p align="center">
27+
<img src="images/06-edit_ac-file.png" />
28+
</p>
29+
30+
Under the `"tagOwners"` key, add the following (see lines 8-12):
31+
32+
```
33+
"tagOwners": {
34+
"tag:wind-farm": ["autogroup:admin"],
35+
"tag:wind-farm-turbine": ["autogroup:admin"],
36+
"tag:wind-farm-ctlr": ["autogroup:admin"],
37+
},
38+
```
39+
40+
### Generate Authentication Keys
41+
42+
Click the `Settings` tab and access the
43+
[Keys](https://login.tailscale.com/admin/settings/keys) on the left menu.
44+
45+
<p align="center">
46+
<img src="images/01-manage_keys.png" />
47+
</p>
48+
49+
Your browser window should look like the above image.
50+
51+
Generate authentication keys for the Wind Farm Controller and Wind Turbine(s) by
52+
clicking the `Generate auth key…` button. Create two keys matching the provided
53+
images. Note the unique Description and Tags for each key.
54+
55+
> [!WARNING]
56+
> Copy each key generated and store for later use in the Gitpod URLs.
57+
58+
<p align="center">
59+
<img src="images/04-copy_keys.png" />
60+
</p>
61+
62+
> [!CAUTION]
63+
> You will not be able to access the key in its entirety again.
64+
65+
#### Key for Farm Controller
66+
67+
<p align="center">
68+
<img src="images/02-controller_key.png" />
69+
</p>
70+
71+
#### Key for Turbine Containers
72+
73+
<p align="center">
74+
<img src="images/03-turbine_key.png" />
75+
</p>
76+
77+
### Verify the Keys
78+
79+
Click the carrot to the left of each key to confirm it has the correct tags for
80+
the key description. The carrot for the top key in the image below is extended
81+
to show its tags.
82+
83+
<p align="center">
84+
<img src="images/05-verify_keys.png" />
85+
</p>
86+
87+
### Access Control: Update ACLs
88+
89+
Edit the access controls policy file again by browsing to the [Access
90+
controls](https://login.tailscale.com/admin/acls/file) tab and then clicking
91+
`Edit file`.
92+
93+
Under the `"acls"` key, add the following rule (lines 25-29):
94+
95+
```
96+
{
97+
"action": "accept",
98+
"src": ["tag:wind-farm"],
99+
"dst": ["tag:wind-farm:*"],
100+
},
101+
```
102+
103+
> [!NOTE]
104+
> The above ACL allows any device authenticated to Tailscale with an
105+
> authorization key tagged `wind-farm` to talk to any other device authenticated
106+
> with a `wind-farm` on any port. Since both of the authorization keys generated
107+
> above include the more general `wind-farm` tag, any device using those keys to
108+
> authenticate with will be able to talk to each other.
109+
110+
## Wind Controller Setup
111+
112+
In addition to setting up the Tailscale infrastructure as described above, the
113+
lab leader must also deploy the wind farm controller infrastructure for the lab
114+
participants to connect their wind turbines to (over Tailscale).
115+
116+
To deploy the wind farm controller infrastructure, create a Gitpod account (if
117+
needed) and deploy the wind farm controller's Gitpod workspace using the
118+
following URL, replacing `{{FIX_ME}}` with the Farm Controller Tailscale
119+
authorization key created above.
120+
121+
https://gitpod.io/#HOSTNAME=farm-ctlr,OTSIM_TAILSCALE_AUTHKEY={{FIX_ME}}/https://github.com/ITI/ICS_Virtualization_Testbed-wind_farm/tree/main
122+
123+
## Lab Participants
124+
125+
To start, create a Gitpod account (if needed) and deploy the initial Gitpod
126+
workspace using the following URL.
127+
128+
https://gitpod.io/#https://github.com/ITI/ICS_Virtualization_Testbed-wind_farm/tree/module-0
129+
130+
Follow the README instructions in the workspace.
131+
132+
> [!NOTE]
133+
> Beginning with module-0, the URLs at the bottom of each README need updating
134+
> for each student. Replace `{{FIX_ME}}` after `HOSTNAME` with the student’s
135+
> turbine identifier (e.g., `wtg-01`). Replace `{{FIX_ME}}` after
136+
> `OTSIM_TAILSCALE_AUTHKEY` with the Turbine key copied and stored when
137+
> generated.

‎configs/docker/openbox-menu.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<openbox_menu xmlns="http://openbox.org/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://openbox.org/ file:///usr/share/openbox/menu.xsd">
3+
<menu id="root-menu" label="Openbox 3">
4+
<item label="Wireshark">
5+
<action name="Execute">
6+
<execute>/usr/bin/wireshark</execute>
7+
</action>
8+
</item>
9+
<item label="Terminal">
10+
<action name="Execute">
11+
<execute>/usr/bin/x-terminal-emulator</execute>
12+
</action>
13+
</item>
14+
<item label="Htop">
15+
<action name="Execute">
16+
<execute>/usr/bin/x-terminal-emulator -e htop</execute>
17+
</action>
18+
</item>
19+
</menu>
20+
</openbox_menu>

‎configs/docker/supervisord.conf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
[supervisord]
2+
nodaemon=true
3+
user=root
4+
pidfile=/tmp/supervisord.pid
5+
logfile=/dev/fd/1
6+
logfile_maxbytes=0
7+
8+
[program:websockify]
9+
priority=0
10+
command=/usr/bin/websockify --web /usr/share/novnc 8080 localhost:5900
11+
autorestart=true
12+
stdout_logfile=/dev/fd/1
13+
stdout_logfile_maxbytes=0
14+
redirect_stderr=true
15+
16+
[program:openbox]
17+
priority=1
18+
command=/usr/bin/openbox
19+
environment=DISPLAY=:1
20+
autorestart=true
21+
stdout_logfile=/dev/fd/1
22+
stdout_logfile_maxbytes=0
23+
redirect_stderr=true
24+
25+
[program:tint2]
26+
priority=1
27+
command=/usr/bin/tint2
28+
environment=DISPLAY=:1
29+
autorestart=true
30+
stdout_logfile=/dev/fd/1
31+
stdout_logfile_maxbytes=0
32+
redirect_stderr=true
33+
34+
[include]
35+
files = /etc/supervisor/conf.d/*.conf

‎configs/docker/tailscale.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[program:tailscale]
2+
priority=900
3+
command=/usr/bin/tailscale --socket=/tmp/tailscaled.sock up --authkey="%(ENV_OTSIM_TAILSCALE_AUTHKEY)s" --accept-dns=true
4+
autorestart=unexpected
5+
stdout_logfile=/dev/fd/1
6+
stdout_logfile_maxbytes=0
7+
redirect_stderr=true
8+

‎configs/docker/tailscaled.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[program:tailscaled]
2+
priority=100
3+
command=/usr/sbin/tailscaled --socket=/tmp/tailscaled.sock --state=mem: --statedir=/tmp
4+
autorestart=true
5+
stdout_logfile=/dev/fd/1
6+
stdout_logfile_maxbytes=0
7+
redirect_stderr=true
8+

0 commit comments

Comments
 (0)