# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Infrastructure Installation and Configuration Guide

11 November, 2012

- 1
- 2
…
- 14
- 15
- 16
- 17
- 18

SECRET//NOFORN
(S//NF) VPS Redirector Hive Infrastructure Configuration Guide
5 (S//NF) VPS Redirector
5.1 (S/NF) IPv6 Security
(S//NF) If IPv6 is functional (verified by noting the presence of inet6 addresses on the network interface
configurations after using ifconfig), then add the following IPv6 firewall rules using ip6tables:
ip6tables -F INPUT
ip6tables -F OUTPUT
ip6tables -F FORWARDING
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP
(S//NF) Use ip6tables-save to save these into /etc/sysconfig/ip6tables and then review the settings in the
ip6tables-config file.
5.2 (S//NF) Install and Configure Redirection Script
(S//NF) Copy the redirection script to /etc/init.d/redirection.
(S//NF) Copy the redirection configuration file, redirect.conf to the /etc/openvpn directory and edit it to
conform to the desired configuration. It looks similar to this:
outside_interface=eth0
inside_interface=eth1
tunnel_interface=tun0
VPN_PORT=1194 # VPN tunnel port
ADMIN_PORT=3600 # SSH port used by administrator
PUBLIC_IP=10.6.5.191 # Public-facing IP
PRIVATE_IP=10.177.77.1 # IP of next hop
VDNS_PORT=5301 # Virtual DNS port
VHTTP_PORT=8001 # Virtual HTTP port
VHTTPS_PORT=44301 # Virtual HTTPS port
(S//NF) Use chkconfig to set redirection to start and stop on system startup and shutdown.
chkconfig --add redirection
(S//NF) Set the system configuration to perform IP forwarding by editing /etc/sysctl.conf as follows.
net.ipv4.ip_forward = 1
(S//NF) To start redirection after first installing the script use:
service redirection start
(S//NF) To stop redirection, but maintain the tunnel and administrative access through ssh, use:
service redirection stop
10 SECRET//NOFORN//20371105 November 2012

- 1
- 2
…
- 14
- 15
- 16
- 17
- 18