Lab 7 of IT security course is about Security in Network. Lab starts with En. Mohd Zaki briefly describes on how to perform lab task before let us start lab activities. After listen to En.Mohd Zaki explanation, we start our lab activities which consist of two tasks.
The first task is to capturing File transfer protocol (FTP) username and password. Before start task 1, I have created 2 Windows Server 2003 virtual machine with one is winserv03_server, IP address of 192.177.1.107 and another one is winserv03_client, IP address of 192.177.1.105. Winserv03_server is installed with FTP and Wireshark in it. On winserv03_client, I login to FTP server on winserv03_server by using command. While on winserv03_server, I login view the Wireshark interface, I notice that username and password that I use to login to FTP server can clearly seen on the monitor.
The second task is to using IPSec to secure FTP transaction. On winserv03_server, I change several setting of Management Console to implement IP security. Besides that, I also change some setting on winserv03_client to enable authentication method. After a few steps of configuration of FTP and Wireshark, I try to login just like task 1. The result of task 2 is Wireshark cannot display the username and password.
As a conclusion, the difference of Wireshark output of task 1 and task 2 is Wireshark cannot display username and password in task 2 while username and password is display in task 1. This shown that FTP and Telnet is not secure because username and password are sent in clear text which enables intruder use Network Monitoring tool to sniff all packet transfer. IPSec is able to safeguard the transmission of data over FTP from being seen by unauthorized user by handling encrypted data.
No comments:
Post a Comment