How to Secure a SCADA System in 2026

#!/bin/bash

# Vider les règles existantes
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Interface réseau (adaptez eth0 à votre setup)
IFACE="eth0"

# Autoriser loopback
iptables -A INPUT -i lo -j ACCEPT

# Autoriser connexions établies
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Autoriser SSH (port 22) depuis IP admin (remplacez 192.168.1.0/24)
iptables -A INPUT -i $IFACE -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# Ports SCADA : Modbus TCP (502), OPC UA (4840), S7 (102) - UNIQUEMENT depuis réseau OT sécurisé
iptables -A INPUT -i $IFACE -p tcp --dport 502 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -i $IFACE -p tcp --dport 4840 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -i $IFACE -p tcp --dport 102 -s 10.0.1.0/24 -j ACCEPT

# Interdire tout le reste
iptables -A INPUT -i $IFACE -j REJECT --reject-with icmp-host-prohibited

# Sauvegarder
netfilter-persistent save

# Log des rejets (optionnel)
iptables -A INPUT -j LOG --log-prefix "SCADA-DROP: " --log-level 4

echo "Firewall SCADA sécurisé activé. Testez avec: nmap -p 22,502,102,4840 votre_IP"

#!/bin/bash

# Créer CA auto-signé pour test (en prod, utilisez CA externe)
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=US/ST=Test/L=NewYork/O=Industrial/CN=SCADA-CA"

# Certificat serveur OPC UA
openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -subj "/C=US/ST=Test/L=NewYork/O=Industrial/CN=opcua.scada.local"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

# Certificat client (pour HMI/OPC client)
openssl genrsa -out client.key 4096
openssl req -new -key client.key -out client.csr -subj "/C=US/ST=Test/L=NewYork/O=Industrial/CN=hmi.scada.local"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365

# Concaténer pour OPC UA trust list (ex: pour open62541 ou Prosys OPC UA)
cat ca.crt server.crt > server-chain.pem
cat ca.crt client.crt > client-chain.pem

# Permissions sécurisées
chmod 600 *.key
chmod 644 *.crt *.pem

mkdir -p /etc/scada-tls
cp *.key *.crt *.pem /etc/scada-tls/

# Exemple config OPC UA server (adaptez à votre stack, ex: node-opcua-server)
echo '{"SecurityProfiles": ["Basic256Sha256_SignAndEncrypt"], "Certificate": "/etc/scada-tls/server-chain.pem"}' > opcua-config.json

echo "TLS OPC UA prêt. Importez ca.crt dans clients OPC UA pour trust."

import re
import sys
import time
from pathlib import Path
from collections import defaultdict

LOG_FILE = '/var/log/scada-access.log'
ALERT_THRESHOLD = 5  # Tentatives par minute
SUSPICIOUS_IPS = set()

def tail_log():
    with open(LOG_FILE, 'r') as f:
        f.seek(0, 2)
        while True:
            line = f.readline()
            if not line:
                time.sleep(0.1)
                continue
            yield line

def parse_log(line):
    # Regex pour extraire IP et port SCADA
    match = re.match(r'SCADA-ACCESS: (\S+) \[(\d+)] "(?:GET|POST) /?(\d+)"', line)
    if match:
        ip, timestamp, port = match.groups()
        return ip, int(port)
    return None

def send_alert(ip):
    print(f'🚨 ALERTE SCADA: IP {ip} suspecte ! Bloquez avec iptables -I INPUT -s {ip} -j DROP', file=sys.stderr)
    # Intégrez Slack/Email: ex requests.post('webhook', json={'alert': ip})

if __name__ == '__main__':
    rate_limit = defaultdict(int)
    last_minute = time.time()
    
    for line in tail_log():
        event = parse_log(line)
        if not event:
            continue
        ip, port = event
        now = time.time()
        
        if now - last_minute > 60:
            rate_limit.clear()
            last_minute = now
        
        rate_limit[ip] += 1
        if rate_limit[ip] > ALERT_THRESHOLD and port in [502, 102, 4840]:
            send_alert(ip)
            SUSPICIOUS_IPS.add(ip)

print('Monitoring SCADA actif. Ctrl+C pour arrêter.')

[Definition]
failregex = ^SCADA-ACCESS: <HOST> \[.*\] "(?:GET|POST) /?(502|102)" \d+ \d+$
ignoreregex =

Port 2222
Protocol 2
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
X11Forwarding no
PrintMotd no
ClientAliveInterval 300
ClientAliveCountMax 0
LoginGraceTime 30
MaxAuthTries 3
AllowUsers scada-admin
Match User scada-admin
    ForceCommand internal-sftp
    ChrootDirectory /home/scada-admin
    PermitTunnel no