Remote ssh access

**TReX** · 22-07-2011, 14:07

Originally Posted by Satoorn

×òî âû óâèäåëè ñëîæíîãî?
Äàâàéòå ïî ïðîñòîìó. Ïî ëîêàëêå çàõîæó íà 22 ïîðò.
Ïî÷åìó 22 ïîðò íå ïðîñëóøèâàåòñÿ? ×òî åù¸ ïîêàçàòü?

Íåïîíÿòåí ñìûñë âñåõ ïðèâåäåííûõ âûøå òåëîäâèæåíèé - óâåëè÷åíèå ñêîðîñòè äàâíî íå àêòóàëüíî äëÿ òåêóùèõ ïðîøèâîê, ïîñêîëüêó ïàò÷ òóïî â íèõ âêëþ÷åí, âñå íàñòðîéêè ssh ïðåêðàñíî ðàáîòàþò è ÷åðåç web ìîðäî÷êó, ïîýòîìó âîïðîñ - è çà÷åì âñå âûøå ïåðå÷èñëåííûå ïëÿñêè ñ áóáíîì? )

Ï.Ñ. Äëÿ ïðîáðîñà íàðóæó ssh ëó÷øå èñïîëüçîâàòü íàïðèìåð ïîðò 1122 à íå ñòàíäàðòíûé, áî áîëüøèíñòâî ïðîâàéäåðîâ ñòàíäàòíûé äàâÿò, äëÿ áåçîïàñíîñòè, îá ýòîì îïÿòü æå 1000 ðàç ïèñàëîñü )

**Satoorn** · 22-07-2011, 15:50

Ïðè óñòàíîâêå â âåá ìîðäå è ïðè âûñòàâëåíèè äîñòóïà ñ WAN, çàéòè ñ âíåøêè ÿ íå ìîãó. Ïî ýòîìó ÿ è ïðîáîâàë îòêëþ÷àòü â âåá èíòåðôåéñå è ïðîïèñàòü â èñïîëíÿåìûå ñêðèïòû. Ïëþñ ÿ õîòåë ïðîáðîñèòü (REDIRECT) íà 22 ïîðò, ÷òî áû îñòàâèòü âñ¸ íà ñâîèõ ïîðòàõ è ÷òîá îí áûë çàêðûò íà âíåøêó. Ó ïðîâàéäåðà îòêðûòû ïîðòû. Ok.

Code:

$ iptables -L -vn 

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:3128 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
    0     0 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2613 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
15639 3612K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW 
  950  208K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW 
    0     0 SECURITY   all  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           state NEW 
  585  134K SECURITY   all  --  vlan1  *       0.0.0.0/0            0.0.0.0/0           state NEW 
   89 33665 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 flags:0x17/0x02 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:***** 
  484 99548 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0       



$ netstat -na

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8081            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:5431            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3128            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      
tcp        0      0 10.62.86.84:1024        78.29.3.44:1723         ESTABLISHED 
tcp        0      0 192.168.25.1:22         192.168.25.11:56784     ESTABLISHED 
udp        0      0 0.0.0.0:1025            0.0.0.0:*                           
udp        0      0 0.0.0.0:514             0.0.0.0:*                           
udp        0      0 127.0.0.1:34954         0.0.0.0:*                           
udp        0      0 0.0.0.0:53              0.0.0.0:*                           
udp        0      0 0.0.0.0:67              0.0.0.0:*                           
udp        0      0 0.0.0.0:1900            0.0.0.0:*

**TReX** · 22-07-2011, 16:25

Originally Posted by Satoorn

Ïðè óñòàíîâêå â âåá ìîðäå è ïðè âûñòàâëåíèè äîñòóïà ñ WAN, çàéòè ñ âíåøêè ÿ íå ìîãó. Ïî ýòîìó ÿ è ïðîáîâàë îòêëþ÷àòü â âåá èíòåðôåéñå è ïðîïèñàòü â èñïîëíÿåìûå ñêðèïòû. Ïëþñ ÿ õîòåë ïðîáðîñèòü (REDIRECT) íà 22 ïîðò, ÷òî áû îñòàâèòü âñ¸ íà ñâîèõ ïîðòàõ è ÷òîá îí áûë çàêðûò íà âíåøêó. Ó ïðîâàéäåðà îòêðûòû ïîðòû.

×óäåñ íå áûâàåò, íà ïîñëåäíåé ïðîøèâêå èñïîëüçóþ SSH è ñíàðóæè è èçíóòðè, âñå ðàáîòàåò, ïîñêîëüêó ïðîâ ðåæåò ïîðòû òî ïîðò íåñòàíäàðòíûé, ïîìåíÿë â ìîðäî÷êå áîëüøå íè÷åãî íå äîíàñòðàèâàë...

**Satoorn** · 22-07-2011, 16:32

Êèíóë â ëè÷êó.
Ëè÷êó ïî÷èñòè, íå ìîãó ñîîáùåíèå ïîñëàòü.

Èç ëîêàëêè òî áåç ïðîáëåì ìîãó çàéòè, à ñ âíåøêè: ssh: connect to host ****.no-ip.info port ****: No route to host.
Õî÷åøü ñêàçàòü ïðîïèñûâàòü ìàðøðóò äî no-ip.com?

**FilimoniC** · 22-07-2011, 23:53

Originally Posted by Satoorn

Êèíóë â ëè÷êó.
Ëè÷êó ïî÷èñòè, íå ìîãó ñîîáùåíèå ïîñëàòü.

Èç ëîêàëêè òî áåç ïðîáëåì ìîãó çàéòè, à ñ âíåøêè: ssh: connect to host ****.no-ip.info port ****: No route to host.
Õî÷åøü ñêàçàòü ïðîïèñûâàòü ìàðøðóò äî no-ip.com?

Íó ñîáñòâåííî SSH òóò íå ïðè ÷åì.
Ëèáî ó âàñ no-ip ãëþ÷èò (ïîñìîòðèòå nslookup), ëèáî ... ëèáî... íó êîðî÷å ëþáîå çâåíî ìåæäó À è Á

**TReX** · 23-07-2011, 00:16

Originally Posted by Satoorn

Êèíóë â ëè÷êó.
Ëè÷êó ïî÷èñòè, íå ìîãó ñîîáùåíèå ïîñëàòü.

Èç ëîêàëêè òî áåç ïðîáëåì ìîãó çàéòè, à ñ âíåøêè: ssh: connect to host ****.no-ip.info port ****: No route to host.
Õî÷åøü ñêàçàòü ïðîïèñûâàòü ìàðøðóò äî no-ip.com?

Äëÿ íà÷àëà ïðîâåðèòü ïèíã íà ñàìîãî ñåáÿ èçíóòðè ïî âíåøíåìó àäðåñó -
ping ****.no-ip.info, ýòî äîëæíî ðàáîòàòü, åñëè ïèíã ïðîõîäèò, à ñîåäèíåíèå âñå ðàâíî íåò, çíà÷èò ãäå òî ïî äîðîãå óáèâàåòñÿ ôàèðâîëîì, ñêîðåå âñåãî ïðîâàéäåðà.
Ëèáî ñàìûé òóïîé âàðèàíò ó âàñ ñåðûé IP è âû çà ïðîâàéäåðñêèì NAT (ïèíãè òîãäà íå ïðîéäóò ))

**Satoorn** · 23-07-2011, 08:07

Originally Posted by TReX

Äëÿ íà÷àëà ïðîâåðèòü ïèíã íà ñàìîãî ñåáÿ èçíóòðè ïî âíåøíåìó àäðåñó -
ping ****.no-ip.info, ýòî äîëæíî ðàáîòàòü, åñëè ïèíã ïðîõîäèò, à ñîåäèíåíèå âñå ðàâíî íåò, çíà÷èò ãäå òî ïî äîðîãå óáèâàåòñÿ ôàèðâîëîì, ñêîðåå âñåãî ïðîâàéäåðà.
Ëèáî ñàìûé òóïîé âàðèàíò ó âàñ ñåðûé IP è âû çà ïðîâàéäåðñêèì NAT (ïèíãè òîãäà íå ïðîéäóò ))

Ïèíãè ó ìåíÿ çàðåçàþòñÿ íàñòðîéêîé iptables. Ïîðòû îòêðûòû ó ïðîâàéäåðà.
Âîïðîñ ðåøèëñÿ ñìåíîé ñåðâåðà c no-ip íà ddns.
Äîñòóï ïîÿâèëñÿ, íàäî áûëî â ñòðîêå ïèñàòü ëîãèí íà ddns, à íå åìåéë.

ß ïðîïèñàë òàê:

Code:

cat /tmp/local/sbin/post-firewall
#!/bin/sh

iptables -P INPUT DROP
iptables -D INPUT -j DROP

iptables -A INPUT -p tcp --dport 12345 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 22 -j DROP
iptables -t nat -A PREROUTING -p tcp --dport 12345 -j REDIRECT --to-ports 22

iptables -A INPUT -j DROP

Ïî÷åìó? Ñòàðàþñü íå ìåíÿòü ñòàíäàðòíûå ïîðòû ó ïðèëîæåíèé.
Çäåñü èä¸ò ïðîñòîé ïðîáðîñ ñ 12345 ïîðòà íà 22. Â òî æå âðåìÿ 22 ïîðò ïðèêðûò.

**reiten** · 23-07-2011, 09:40

Ïî÷èòàéòå, êàêèå äåéñòâèÿ iptables ïðåäíàçíà÷åíû äëÿ êàêèõ òàáëèö.
Íàïðèìåð, â PREROUTING äåéñòâèÿ DROP áûòü íå äîëæíî.

**TReX** · 23-07-2011, 10:06

Originally Posted by Satoorn

Ïî÷åìó? Ñòàðàþñü íå ìåíÿòü ñòàíäàðòíûå ïîðòû ó ïðèëîæåíèé.
Çäåñü èä¸ò ïðîñòîé ïðîáðîñ ñ 12345 ïîðòà íà 22. Â òî æå âðåìÿ 22 ïîðò ïðèêðûò.

Âåá-èíòåðôåéñ è ñäåëàí äëÿ ëþäåé êîòîðûì ëåíü/íåò ñèë/âðåìåíè èçó÷àòü iptables, òàê ÷òî ëèáî ïîíèìàéòå ÷òî äåëàåòå, ëèáî îñòàâüòå òî, ÷òî ñäåëàëè çà âàñ òå êòî ðàçîáðàëñÿ, èíà÷å â ëó÷øåì ñëó÷àå áóäåòå èìåòü ïðîáëåìû ñ ñîåäèíåíèåì à â õóäøåì ñâåòèòü âñåì â èíåò )

**Satoorn** · 26-07-2011, 04:08

Originally Posted by TReX

Âåá-èíòåðôåéñ è ñäåëàí äëÿ ëþäåé êîòîðûì ëåíü/íåò ñèë/âðåìåíè èçó÷àòü iptables, òàê ÷òî ëèáî ïîíèìàéòå ÷òî äåëàåòå, ëèáî îñòàâüòå òî, ÷òî ñäåëàëè çà âàñ òå êòî ðàçîáðàëñÿ, èíà÷å â ëó÷øåì ñëó÷àå áóäåòå èìåòü ïðîáëåìû ñ ñîåäèíåíèåì à â õóäøåì ñâåòèòü âñåì â èíåò )

Ñïàñèáî çà ñîâåò, íî ñäåëàë êàê è ïèñàë ðàíåå ÷åðåç REDIRECT, ïðîáëåìà áûëà ñ õîñòèíãîì no-ip.com, ÷åðåç íåãî íå ïðîõîäèëè çàïðîñû. Ïîñòàâèë dyndns, âñ¸ ñðàçó çàðàáîòàëî â ëó÷øåì âèäå.
reiten, âîçìîæíî, íî êàê ÿ ïîíèìàþ, íàäî õîòÿ áû âûäåðæêó èç ìàíà êèäàòü (êàê ÿ ïîíÿë ýòî - http://www.opennet.ru/docs/RUS/iptab...REROUTINGCHAIN), à íå çàÿâëÿòü íè÷åì íå ïîäòâåðæäàÿ. (raw ó ìåíÿ íå ðàáîòàåò, ìîäóëü íóæåí, íà ôîðóìå íå íàø¸ë), íî ïðàâèëî ðàáîòàåò æå. )

nat PREROUTING Ýòà öåïî÷êà èñïîëüçóåòñÿ äëÿ òðàíñëÿöèè ñåòåâûõ àäðåñîâ (Destination Network Address Translation). Source Network Address Translation âûïîëíÿåòñÿ ïîçäíåå, â äðóãîé öåïî÷êå. Ëþáîãî ðîäà ôèëüòðàöèÿ â ýòîé öåïî÷êå ìîæåò ïðîèçâîäèòüñÿ òîëüêî â èñêëþ÷èòåëüíûõ ñëó÷àÿõ.

**nen777w** · 02-08-2011, 08:25

Êàê ñäåëàòü telnet äîñòóïíûì èç âíå?
ïðîøèâêà: 1.9.2.7-rtn-r3121
SSH íå óñòðàèâàåò ïîòîìó ÷òî â îäíîì ìåñòå ãäå ìíå íóæåí ðîóòåð åãî ðåæóò, è ïîõîæå íà óðîâíå ïðîòîêîëà.
À âîò telnet ðàáîòàåò.
Ñïàñèáî.

**FilimoniC** · 02-08-2011, 10:39

Originally Posted by nen777w

Êàê ñäåëàòü telnet äîñòóïíûì èç âíå?
ïðîøèâêà: 1.9.2.7-rtn-r3121
SSH íå óñòðàèâàåò ïîòîìó ÷òî â îäíîì ìåñòå ãäå ìíå íóæåí ðîóòåð åãî ðåæóò, è ïîõîæå íà óðîâíå ïðîòîêîëà.
À âîò telnet ðàáîòàåò.
Ñïàñèáî.

Ýòî ïðèìåðíî òàê æå, êàê îñòàâëÿòü êëþ÷è â çàìêå èëè âûñòàâëÿòü æîïó â îêíî ñ íàäïèñüþ Free Sex

**max2007** · 02-08-2011, 11:00

Originally Posted by nen777w

Êàê ñäåëàòü telnet äîñòóïíûì èç âíå?
ïðîøèâêà: 1.9.2.7-rtn-r3121
SSH íå óñòðàèâàåò ïîòîìó ÷òî â îäíîì ìåñòå ãäå ìíå íóæåí ðîóòåð åãî ðåæóò, è ïîõîæå íà óðîâíå ïðîòîêîëà.
À âîò telnet ðàáîòàåò.
Ñïàñèáî.

Íó íàâåðíîå âîò òàê

Code:

iptables -I INPUT -p tcp --dport 23 -j ACCEPT

**TReX** · 13-09-2011, 17:05

Originally Posted by Satoorn

Â ïîëå DMZ ïðîïèñàí IP àäðåñ (ñ ëîêàëêè çàõîæó áåç ïðîáëåì â îáîèõ ñëó÷àÿõ):

Êòî ÷òî ïîäñêàæåò èëè ýòî â âåòêó ðàçðàáîò÷èêîâ ïðîøèâêè?
Ïîêà IP íå ïðîáîâàë ïðîïèñûâàòü â Virtual Server ñ ïîëíûì îòêðûòèåì ïîðòîâ, DMZ íóæåí äëÿ PS3.

Ïî÷èòàòü êíèãó TCP/IP äëÿ ÷àéíèêîâ?

À âàøè ïðîñòûíè ëó÷øå ñðàçó ïîñòèòü íà bash.org.ru, íàðîä ïîâåñåëèòå...

**Satoorn** · 13-09-2011, 18:09

Íîñîì ìîæåòå òêíóòü â ìîþ îøèáêó? Èëè âû ìîè 2 ïîñëåäíèõ ïîñòà äàæå íå ïðî÷èòàëè?

Thread: Remote ssh access

Thread Tools

Rate This Thread

Display

Êàê îòêðûòü telnet?

Similar Threads

Enable Web Access from WAN? YES-NO. Ðàáîòàåò ëè çàùèòà?

Ïðîáëåìû ñ RAdmin è Remote Desktop

[HowTo]Aria2 Torrent, FTP, HTTP mit Remote Control

Can't access my firmware

Access to NAS in LAN from WAN

Tags for this Thread

Posting Permissions