Remote ssh access

Quote:

Originally Posted by leniviy

Ïîêà íå íàøåë, êàê ïðèâÿçàòü êëþ÷ ê þçåðó. (ïîä àäìèíîì ÿ íîðìàëüíî ëîãèíþñü ñ ïîìîùüþ êëþ÷à)
http://www.nslu2-linux.org/wiki/HowT...orRemoteAccess

someone@hostname çàìåíèë íà portforwarder
íå ðàáîòàåò.

Ïîëîæèòü êëþ÷ â äèðåêòîðèþ .ssh ó þçåðà.

ãåíèàëüíî :D

ïîìîãèòå ðàçîáðàòüñÿ ñ SSH.

Äîáðûé äåíü. Ïîìîãèòå ïîæàëóéñòà ÷àéíèêó. Ðåøèë íàñòðîèòü ssh. Íàñòðàèâàë ïî èíñòðóêöèè:
http://wl500g.info/showthread.php?t=...0%ED%E8%E5+SSH

â /usr/local/sbin/post-boot ïðîïèñàíî ñëåäóþùåå:
dropbear -p 16016
â /usr/local/sbin/post-firewall
# set default policy
iptables -P INPUT DROP
# remove last default rule
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --syn --dport 16016 -j ACCEPT

â ïðîöåññàõ dropbear âèñèò:

-sh: 59: not found
[fuzzylogic@pela root]$ 64 fuzzylog 380 S httpd vlan1
-sh: 64: not found
[fuzzylogic@pela root]$ 69 fuzzylog 408 S syslogd -m 0 -O /tmp/syslog.log -S -l 7
-sh: 69: not found
[fuzzylogic@pela root]$ 70 fuzzylog 364 S klogd
-sh: 70: not found
[fuzzylogic@pela root]$ 75 nobody 432 S [dnsmasq]
-sh: 75: not found
[fuzzylogic@pela root]$ 77 fuzzylog SW [khubd]
-sh: 77: not found
[fuzzylogic@pela root]$ 85 fuzzylog 276 S lpd
-sh: 85: not found
[fuzzylogic@pela root]$ 87 fuzzylog 260 S p9100d -f /dev/usb/lp0 0
-sh: 87: not found
[fuzzylogic@pela root]$ 90 fuzzylog 340 S waveservermain
-sh: 90: not found
[fuzzylogic@pela root]$ 92 fuzzylog 344 S rcamdmain
-sh: 92: not found
[fuzzylogic@pela root]$ 105 fuzzylog 312 S infosvr br0
-sh: 105: not found
[fuzzylogic@pela root]$ 106 fuzzylog 448 S watchdog
-sh: 106: not found
[fuzzylogic@pela root]$ 109 fuzzylog 344 S ntp
-sh: 109: not found
[fuzzylogic@pela root]$ 116 fuzzylog 480 S dropbear -p 16016
-sh: 116: not found
[fuzzylogic@pela root]$ 121 fuzzylog 492 S upnp -D -L br0 -W vlan1
-sh: 121: not found
[fuzzylogic@pela root]$ 125 fuzzylog 728 S dropbear -p 16016
-sh: 125: not found
[fuzzylogic@pela root]$ 126 fuzzylog 548 S -sh
-sh: 126: not found
[fuzzylogic@pela root]$ 130 fuzzylog 728 S dropbear -p 16016
-sh: 130: not found
[fuzzylogic@pela root]$ 131 fuzzylog 548 S -sh
-sh: 131: not found
[fuzzylogic@pela root]$ 134 fuzzylog 392 R ps

Putty c ìàøèíû èç âíóòðåííåé ñåòè çàõîäèò. Ïðîáëåìû íà÷èíàþòñÿ ïðè óäàëåííîì äîñòóïå.
Â ëîãàõ iptables ïîðò 16016 íå îòêðûò:
Chain INPUT (policy ACCEPT)
target prot opt source destination
MACS all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state NEW
SECURITY all -- anywhere anywhere state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp
DROP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
MACS all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP all -- anywhere anywhere
SECURITY all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere ctstate DNAT

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain MACS (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere MAC 00:1E:8C:9A:1D:C4
RETURN all -- anywhere anywhere MAC 00:19:CB:41:72:BC
RETURN all -- anywhere anywhere MAC 00:19:CB:41:72:B9
RETURN all -- anywhere anywhere MAC 00:19:CB:41:72:B8
RETURN all -- anywhere anywhere MAC 00:1E:8C:9A:1C:3A
DROP all -- anywhere anywhere

Chain SECURITY (2 references)
target prot opt source destination
RETURN tcp -- anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 1/sec burst 5
RETURN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5
RETURN udp -- anywhere anywhere limit: avg 5/sec burst 5
RETURN icmp -- anywhere anywhere limit: avg 5/sec burst 5
DROP all -- anywhere anywhere

Chain logaccept (0 references)
target prot opt source destination
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT '
ACCEPT all -- anywhere anywhere

Chain logdrop (0 references)
target prot opt source destination
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `DROP '
DROP all -- anywhere anywhere

åñëè äîáàâëÿþ ðóêàìè - â iptables ïðîïèñûâàåòñÿ:

Êàê ñäåëàòü ÷òîáû ýòî ïðîèñõîäèëî àâòîìàòîì?

Ôàéë /usr/local/sbin/post-firewall îòðàáàòûâàåò?
Ïîëíîå ñîäåðæèìîå ôàéëà ìîæíî?

Quote:

Originally Posted by vectorm

Ôàéë /usr/local/sbin/post-firewall îòðàáàòûâàåò?
Ïîëíîå ñîäåðæèìîå ôàéëà ìîæíî?

êàê îïðåäåëèòü îòðàáàòûâàåò èëè íåò?
ïîëíîå ñîäåðæàíèå:
# set default policy
iptables -P INPUT DROP
# remove last default rule
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --syn --dport 16016 -j ACCEPT

Çàðàíåå ñïàñèáî

Íå îòðàáîòàë post-firewall
Âîçìîæíî, èç-çà òîãî, ÷òî íà íåãî íå ñêàçàëè chmod +x
Âîçìîæíî, èç-çà òîãî, ÷òî íåò â íà÷àëå ìàãè÷åñêîé ñòðî÷êè

Code:

#!/bin/sh

È îñòàâëÿòü ôàéðâîë áåç "DROP âñå îñòàëüíîå" íåêðàñèâî.
Íàäî äîáàâèòü â êîíöå

Code:

iptables -A INPUT -j DROP

upd. À, òàì äåôîëòíàÿ ïîëèòèêà ñòàâèòñÿ. Òîãäà ïîñëåäíåå íå îáÿçàòåëüíî.

Quote:

Originally Posted by 6opoga

Íå îòðàáîòàë post-firewall
Âîçìîæíî, èç-çà òîãî, ÷òî íà íåãî íå ñêàçàëè chmod +x
Âîçìîæíî, èç-çà òîãî, ÷òî íåò â íà÷àëå ìàãè÷åñêîé ñòðî÷êè

Code:

#!/bin/sh

Íå âîçìîæíî,à òî÷íî - â ïðèâåäåííîì ëèñòèíãå ôàéëà åå íåò. Â ñîäåðæèìîì èñïîëíÿåìûõ ôàéëîâ Ëèíóêñà ÎÁßÇÀÒÅËÜÍÎ äîëæíî áûòü óêàçàíèå ÷åì èõ èñïîëíÿòü!

Ðàç óæ çàøëà òåìà î SSH,-

Òàêîé ãëþê(?) ïðè ñìåíå ïàðîëÿ ÷åðåç web êîíôèãóðàòîð ïàðîëü íà SSH íå ìåíÿåòñÿ ÷òî ñ ýòèì äåëàòü è êàê ëå÷èòü?

P.S. ïîäîçðåâàþ ÷òî ýòî ìîæåò áûòü èç çà òîãî ÷òî ñèñòåìà ãðóçèòñÿ ñ ôëåøêè ... âîáùåì òåðÿþñü â äîãàäêàõ ñïàñàéòå :)

Quote:

Originally Posted by 6opoga

Íå îòðàáîòàë post-firewall
Âîçìîæíî, èç-çà òîãî, ÷òî íà íåãî íå ñêàçàëè chmod +x
Âîçìîæíî, èç-çà òîãî, ÷òî íåò â íà÷àëå ìàãè÷åñêîé ñòðî÷êè

Code:

#!/bin/sh

È îñòàâëÿòü ôàéðâîë áåç "DROP âñå îñòàëüíîå" íåêðàñèâî.
Íàäî äîáàâèòü â êîíöå

Code:

iptables -A INPUT -j DROP

upd. À, òàì äåôîëòíàÿ ïîëèòèêà ñòàâèòñÿ. Òîãäà ïîñëåäíåå íå îáÿçàòåëüíî.

Áîëüøîå ñïàñèáî âñåì! Ïîìîãëî! Ó ìåíÿ ñí÷àëà áûëà ýòà ñòðî÷êà, íî ïîòîì åå çà÷åì-òî óäàëèë.
Âû áûëè ïðàâû, îêàçàëîñü ÷òî íå äàë êîìàíäó chmod +x. Åùå ðàç ñïàñèáî!

Vbifi à ÷òî passwd óæå íå ñïàñàåò? ß ñäåëàë åãî è ìîíóìåíòàëüíûå flashfs save è òä.

êòî-òî ëîìèòñÿ ïî ssh

Ñîãðàæäàíå, ïîäñêàæèòå ÷òî äåëàòü.
Çàìåòèë íà ðîóòåðå æóòêèå òîðìîçà, ïðîâåðèë ëîã è îáíàðóæèë âîò òàêóþ ïîðòÿíêó âåñîì 194 Ê:

Oct 6 03:01:48 dropbear[6091]: exit before auth: Disconnect received
Oct 6 03:01:48 dropbear[6092]: Child connection from ::ffff:148.235.144.119:60377
Oct 6 03:01:50 dropbear[6092]: login attempt for nonexistent user from ::ffff:148.235.144.119:60377
Oct 6 03:01:51 dropbear[6092]: exit before auth: Disconnect received
Oct 6 03:01:51 dropbear[6093]: Child connection from ::ffff:148.235.144.119:50684
Oct 6 03:01:53 dropbear[6093]: login attempt for nonexistent user from ::ffff:148.235.144.119:50684

Àéïèøíèê îäèí è òîò æå.

Ïîäñêàæèòå, åñòü ëè êàêîå-òî ðåøåíèå, ÷òîá ïîñëå òð¸õ ïîïûòîê ëîãèíà àéïèøíèê áàíèëñÿ?

íå ðàç îáñóæäàëîñü. â ïîèñê - "áåçîïàñíîñòü ssh"
è âîîáùå äëÿ íà÷àëà ïîìåíÿéòå ïîðò ñî ñòàíäàðòíîãî 22 íà êàêîé-íèáóäü äðóãîé ïîñëå 10000. ñðàçó ïðîáëåì ñòàíåò ìåíüøå.

ñïàñèáî çà íàâîäêó.

Âñåì äîáðûé âå÷åð! Íå ìîãó ñàì ñäåëàòü! Èçâåíèòå çà ãëóïóé âîïðîñ, íî ÿ íå ìîãó!
Íåäàâíî ïðèîáðåë ðîóòåð Asus WL-500g Premium è äèñê íà 2 òåðàáàéòà. Òàê âîò â ÷åì çàäà÷à. Ìíå íóæíî ñîçäàòü òóíåëü SSH, ÷òîáû ÿ ìîã îáðàùàòüñÿ ê ñâîåìó äèñêó ÷åðåç èíåò! Ó äèñêà åñòü èíòåðôåéñ Ethernet. Ò.å. ÿ ìîãó ê íåìó îáðàùàòüñÿ äàæå ïðè âûêëþ÷åííîì êîìïå.
Íà ôîðóìå ïðî÷èòàë, ÷òî ìîæíî íà ðîóòåðå Asus WL-500g Premium ïîäíÿòü SSH ñåðâåð è ñîçäàâ òóíåëü îáðàùàòüñÿ ê ýòîìó äèñêó ïî çàùèùåííîìó êàíàëó.
Çäåñü æå íà ôîðóìå íàøåë âîò òàêóþ èíñòðóêöèþ, ÷òîáû ïîäíÿòü SSH ñåðâåð:

mkdir -p /usr/local/etc/dropbear
dropbearkey -t dss -f /usr/local/etc/dropbear/dropbear_dss_host_key
dropbearkey -t rsa -f /usr/local/etc/dropbear/dropbear_rsa_host_key
mkdir -p /usr/local/sbin/
echo "#!/bin/sh" >> /usr/local/sbin/post-boot
cp /usr/local/sbin/post-boot /usr/local/sbin/post-firewall
cp /usr/local/sbin/post-boot /usr/local/sbin/post-mount
cp /usr/local/sbin/post-boot /usr/local/sbin/pre-shutdown
chmod +x /usr/local/sbin/p*
echo "dropbear > /dev/null 2>&1" >> /usr/local/sbin/post-boot
dropbear > /dev/null 2>&1
flashfs save
flashfs commit
flashfs enable

Ñäåëàë êàê â ýòîé èíñòðóêöèè è íåçíàþ, ÷òî ìíå äåëàòü äàëüøå. Ìíå íóæíî ÷òîáû ÿ ìîã îáðàùàòüñÿ ê ñâîåìó äèñêó óäàëåííî êàê ê ñåòåâîìó äèñêó.

ß ñêà÷àë â èíåòå ïðîãó: SSH Tunel, íî íå ìîãó ïîäêîíåêòèòüñÿ ê SSH ñåðâåðó è ïðîñìàòðèâàòü ñâîé äèñê!

ÏÎÌÎÃÈÒÅ ÏÎÆÀËÓÉÑÒÎ! ÍÅÇÍÀÞ ÓÆÅ ×ÒÎ ÄÅËÀÒÜ!
Çàðàíåå ñïàñèáî!

Õî÷ó ñïðîñèòü.

PHP Code:

#post-boot dropbear -p 8022 ----------------- #post-firewall # set default policy iptables -P INPUT DROP # remove last default rule iptables -D INPUT -j DROP iptables -A INPUT -p tcp --syn --dport 8022 -j ACCEPT

Ïðîäåëàë âîò òàêèå íàñòðîéêè, ÷òîá îòêðûòü ssh íà 8022 ïîðòó.
Ïîðò äîñòóïåí ïî 8022, íî ïðè åòîì è ïî 22 íîðìàëüíî ëîãèíèòñÿ.
Êàê çàêðûòü òîãäà 22 ïîðò?
Ñïàñèáî.

Ñíàðóæè ëîãèíèòñÿ?

Quote:

Originally Posted by dimaka

Ñíàðóæè ëîãèíèòñÿ?

À íåò ñíàðóæè âèäíî òîëüêî ñ 8022, ñïñèáî.

êîìó êàêèå ïðîáëåììû :)
ó ìåíÿ âñå ñ òî÷íîñòüþ íî íàîáîðîò...
ó ìåíÿ íåò äîñòóïà èç âíå ïî ssh
ïðîäåëàíî:
÷åðåç âåá â Virtual Server äîáàâëåííî
÷òî çàïðîñû ñ 22 ïîðòà ïåðåñûëàåòñÿ íà 22 âíóòðåííåãî ip(11.11.11.1) ðîóòåðà
â Status & Log/Port Forwarding ïîÿâèëàñü
Destination Proto. Port Range Redirect to
all TCP 22 11.11.11.1
all TCP 8080 11.11.11.1

â ëîãå
Oct 14 23:01:51 kernel: DROP IN=ppp0 OUT= MAC= SRC=<èï àäðåñ èñòî÷íèêà> DST=11.11.11.1 LEN=48 TOS=0x00 PREC=0x00 TTL=59 ID=29812 DF PROTO=TCP SPT=58536 DPT=22 SEQ=2212093550 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204055456020001)

Ïî÷åìó ïàêåòû äðîïÿòñÿ?!

ïîïðîáîâàë äîáàâèòü
iptables -A INPUT -p tcp --syn --dport 22 -j ACCEPT
ýôåêòà 0

çàáûë
ïðè êîíåêòå ïî òåëíåòó â ëîãå òîæå ñàìîå òîëüêî DST=âíåøíåìó ip

Quote:

Originally Posted by ipkiller

êîìó êàêèå ïðîáëåììû :)
ó ìåíÿ âñå ñ òî÷íîñòüþ íî íàîáîðîò...
ó ìåíÿ íåò äîñòóïà èç âíå ïî ssh

Äàâàéòå âûâîä iptables-save, ïîñìîòðèì.

À âîîáùå, ìåíÿ íåñêîëüêî óäèâëÿåò, íàñêîëüêî øèðîêî íà ýòîì ôîðóìå ðàñïðîñòðàíåíà ïðàêòèêà äîáàâëåíèÿ â virtual server ïîðòîâ, ïàêåòû íà êîòîðûå ïðåäíàçíà÷åíû ñàìîìó ðîóòåðó - âåäü ýòî äåéñòâèå íè÷åãî íå äà¸ò ñ òî÷êè çðåíèÿ îòêðûòèÿ ïîðòà.

Ïåðå÷èòàâ âñå ïîñòû êàñàþùèåñÿ áåçîïàñíîñòè SSH íà ýòîì ôîðóìå ïðèøåë â òàêîìó âàðèàíòó:

pre-boot:

Code:

#!/bin/sh insmod ipt_recent

post-firewall:

Code:

#!/bin/sh logger " --- Post-Firewall Event" WAN=$(nvram get wan_ifname) FW_LOG_TYPE=$(nvram get fw_log_x) if [ $FW_LOG_TYPE == "drop" -o $FW_LOG_TYPE == "both" ] then DROP="logdrop" else DROP="DROP" fi DROP_CMD="iptables -D INPUT -j $DROP" if [ -z "$($DROP_CMD 2>&1)" ] then DROPPED="1" else DROPPED="0" fi iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --set --name SSH_ATTACKER --rsource iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --rcheck --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j LOG --log-prefix "SSH_ATTACKER " iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --update --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j DROP iptables -t nat -A PREROUTING -i $WAN -p tcp --dport ssh -j ACCEPT iptables -A INPUT -i $WAN -p tcp --dport ssh -j ACCEPT if [ $DROPPED == "1" ] then iptables -A INPUT -j $DROP fi

Ýòîò êîä ïîçâîëèò ðàáîòàòü DB äàæå â òîì ñëó÷àå, êîãäà ÷åðåç âåá-èíòåðôåéñ â ðàçäåëå ôàéðâîëà áûëà óñòàíîâëåíà êàêàÿ-ëèáî îïöèÿ ëîãèðîâàíèÿ ïàêåòîâ.

Âñå-òàêè íå ïîíèìàþ ÿ òàêîé ïîëèòèêè. Çà÷åì áëîêèðîâàòü áðóòåôîðñíèêîâ íà ïîëòîðû ìèíóòû ?! Èõ íàäî áëîêèðîâàòü íàâñåãäà èëè ïî êðàéíåé ìåðå íà ñåàíñ çàãðóçêè ðîóòåðà, ÷òî áû íå çàáèâàòü òàáëèöû.
Íàïðèìåð òàê:

Code:

iptables -N TESTBRUTE iptables -N ATTACK # Ñðàçó ïîñëå ïðàâèëà accept all via br0 iptables -I INPUT 5 -m recent --name attack --rcheck -j DROP iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j TESTBRUTE iptables -A INPUT -p tcp --dport 21 -m state --state NEW -j TESTBRUTE iptables -A INPUT -p tcp --dport 5190 -m state --state NEW -j TESTBRUTE iptables -A TESTBRUTE -m recent --name test_brute --set iptables -A TESTBRUTE -m recent --name test_brute --rcheck --seconds 300 --hitcount 10 -j ATTACK iptables -A ATTACK -m recent --name attack --set iptables -A ATTACK -j LOG --log-level info --log-prefix "ATTACKer blocked: " iptables -A ATTACK -j DROP

Öåïî÷êà ATTACK îäíà, ñòàâèò ïðèçíàê áëîêèðîâêè. Â ïîñëåäñòâèè îí ïðîâåðÿåòñÿ îäíèì ïðàâèëîì. Öåïî÷åê âðîäå TESTBRUTE ìîæåò áûòü íåñêîëüêî. Êàæäàÿ ñî ñâîèìè âõîæäåíèÿìè è ïåðèîäè÷íîñòüþ. Íàïðèìåð ìîæíî ñîçäàòü åùå äâå öåïî÷êè TESTSCAN äëÿ îòëàâëèâàíèÿ ñêàíèðîâàíèÿ well-known ïîðòîâ è TESTDOS äëÿ áëîêèðîâàíèÿ õîñòîâ, êîòîðûå çàïðàøèâàþò ñëèøêîì ìíîãî ñîåäèíåíèé çà êîðîòêèé ìîìåíò âðåìåíè. Â èòîãå êàæäàÿ ïîäîáíàÿ öåïî÷êà ïåðåíàïðàâëÿåò ïðîâåðêó íà ATTACK, ãäå ìåòèòñÿ çàïàëèâøèéñÿ õîñò.

Code:

# Generated by iptables-save v1.2.7a on Wed Oct 15 12:43:29 2008 *nat :PREROUTING ACCEPT [9799:1158353] :POSTROUTING ACCEPT [5282:316636] :OUTPUT ACCEPT [5366:335654] :VSERVER - [0:0] -A PREROUTING -d <ïóáëè÷íûé ip>-j VSERVER -A PREROUTING -d 10.5.82.222 -j VSERVER -A POSTROUTING -s ! <ïóáëè÷íûé ip> -o ppp0 -j MASQUERADE -A POSTROUTING -s ! 10.5.82.222 -o vlan1 -j MASQUERADE -A POSTROUTING -s 11.11.11.0/255.255.255.0 -d 11.11.11.0/255.255.255.0 -o br0 -j MASQUERADE -A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 11.11.11.1:80 -A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22 COMMIT # Completed on Wed Oct 15 12:43:29 2008 # Generated by iptables-save v1.2.7a on Wed Oct 15 12:43:29 2008 *mangle :PREROUTING ACCEPT [110889:20661480] :INPUT ACCEPT [92465:15470718] :FORWARD ACCEPT [9625:4123963] :OUTPUT ACCEPT [94071:20055008] :POSTROUTING ACCEPT [130447:34088972] COMMIT # Completed on Wed Oct 15 12:43:29 2008 # Generated by iptables-save v1.2.7a on Wed Oct 15 12:43:29 2008 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [224:10720] :OUTPUT ACCEPT [94040:20043813] :MACS - [0:0] :SECURITY - [0:0] :logaccept - [0:0] :logdrop - [0:0] -A INPUT -m state --state INVALID -j logdrop -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -m state --state NEW -j ACCEPT -A INPUT -i br0 -m state --state NEW -j ACCEPT -A INPUT -i ppp0 -m state --state NEW -j SECURITY -A INPUT -d 11.11.11.1 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -j logdrop -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT -A FORWARD -i br0 -o br0 -j ACCEPT -A FORWARD -m state --state INVALID -j logdrop -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i ! br0 -o ppp0 -j logdrop -A FORWARD -i ! br0 -o vlan1 -j logdrop -A FORWARD -i ! br0 -m state --state NEW -j SECURITY -A FORWARD -m conntrack --ctstate DNAT -j ACCEPT -A FORWARD -o br0 -j logdrop -A SECURITY -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN -A SECURITY -p udp -m limit --limit 5/sec -j RETURN -A SECURITY -p icmp -m limit --limit 5/sec -j RETURN -A SECURITY -j logdrop -A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options -A logaccept -j ACCEPT -A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options -A logdrop -j DROP COMMIT # Completed on Wed Oct 15 12:43:29 2008

Quote:

À âîîáùå, ìåíÿ íåñêîëüêî óäèâëÿåò, íàñêîëüêî....

õì, à ïî÷åìó?! îíäå äåëàåò ïðîáðîñ íà ëîêàëüíûé èï, à èç ëîêàëêè ðàáîòàòå....
-A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 11.11.11.1:80
òîæå ñàìîå... ïåðåáðàñûâàåò ñ ðåàëüíèêà íà âíóòðåíèé
à âîò 22-é ïîðò ïî÷åìó òî äðîïèòñÿ :(
-A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22

Quote:

-A INPUT -j logdrop
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT

íó è ÷åãî ìû õî÷åì --- ñíà÷àëà logdrop âñåãî, à ïîòîì ðàçðåøàåì õîäèòü íà ïîðò 22. Òóäà õîäèòü òî óæå íå÷åìó...

Quote:

Originally Posted by ipkiller

õì, à ïî÷åìó?! îíäå äåëàåò ïðîáðîñ íà ëîêàëüíûé èï, à èç ëîêàëêè ðàáîòàòå....
-A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 11.11.11.1:80
òîæå ñàìîå... ïåðåáðàñûâàåò ñ ðåàëüíèêà íà âíóòðåíèé
à âîò 22-é ïîðò ïî÷åìó òî äðîïèòñÿ :(
-A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22

Îáúÿñíÿþ. Òîò ôàêò, ÷òî ïàêåò ïðîø¸ë ÷åðåç ïðåîáðàçîâàíèå àäðåñà íàçíà÷åíèÿ (DNAT, ýòî òî, ÷òî äåëàåò Virtual Server) â òàáëèöå nat, âîâñå íå îçíà÷àåò, ÷òî îí ñìîæåò ïðîéòè ÷åðåç öåïî÷êó INPUT (òóäà íàïðàâëÿþòñÿ ïàêåòû, ïðåäíàçíà÷åííûå ñàìîìó ðîóòåðó) òàáëèöû filter. Â öåïî÷êå FORWARD (÷åðåç êîòîðóþ ïðîõîäÿò "òðàíçèòíûå" ïàêåòû) åñòü ïðàâèëî -A FORWARD -m conntrack --ctstate DNAT -j ACCEPT, êîòîðîå êàê ðàç è ïðîïóñêàåò ïàêåòû, êîòîðûå ïðîøëè DNAT (êñòàòè, íàñòðàèâàåòñÿ â ñåêöèè "WAN to LAN Filter", ïîëå Port Forwarding default policy), è ïîýòîìó äëÿ ëîêàëüíîé ñåòè ýòî ðàáîòàåò, à äëÿ ñàìîãî ðîóòåðà - íåò.

Êîíêðåòíî äëÿ âàøåãî ñëó÷àÿ, âñ¸ óæå îïèñûâàëîñü. ïðåæäå ÷åì äîáàâëÿòü ïðàâèëî â INPUT, íóæíî ñíà÷àëà óäàëèòü ïîñëåäíåå ïðàâèëî îòòóäà (-A INPUT -j logdrop), òàê êàê îíî ñáðàñûâàåò âñå ïàêåòû è äàëüøå îíè íå èäóò.

Code:

iptables -D INPUT -j logdrop iptables -A INPUT -p tcp --syn --dport 22 -j ACCEPT iptables -A INPUT -j logdrop

îòêðîåò âàø 22 ïîðò.

È -A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22 íå íóæíî.

ÎÃÐÎÌÍÎÅ Ñïàñèáî çà ðàçúÿñíåíèÿ....
è çà ïîìîùü,
âñå çàðàáîòàëî....

ïðîáëåìà â òîì, ÷òî ipt_recent ïîäñ÷èòûâàåò íå òîëüêî íåóäà÷íûå ïîïûòêè, íî è óäà÷íûå òîæå. Òàê ÷òî åñòü øàíñ çàáàíèòü ñàìîãî ñåáÿ "íàâñåãäà"

Äîñòóï ïî ssh (+)

Привет всем!
http://www.wl500g.info/showthread.php?p=70645 читал внимательно.
У меня wl500gpv1, прошивка Олега...7-10.

Проблема такая: из wan коннектится только на 22 порт. Из лан - на любой.
Трабл и у меня, и у друга - у него тоже wl500gpv1.

В web интерфейсе роутера файрвол отключен.
Если запускать
dropbear -p 443
то процесс появляется в списке, при попытке соединения
ssh <адрес wl500gpv1> -p 443 - сессия с дугого компа подвисает намертво
При этом на роутере создается еще 1 процесс dropbear -p 443.
Лог роутера:
Mar 3 13:24:24 dropbear[178]: Running in background # запуск соединения
Mar 3 13:24:36 dropbear[179]: Child connection from ::ffff:217.118.85.89:45461 # черное окошко putty другого компа, зависает
Mar 3 13:26:15 dropbear[179]: exit before auth: Exited normally # закрываешь окно putty

Маршрут на всякий случай прописан:
iptables -I INPUT -p tcp --syn --dport 443 -j ACCEPT

Подскажите плз, что делать? С рабочего компа не могу зайти :( - 22 порт отрублен.

Заранее благодарю,
Константин

À åñëè îáðàùàòüñÿ íà 443 ïîðò èç LAN?

Quote:

Originally Posted by Oleg

À åñëè îáðàùàòüñÿ íà 443 ïîðò èç LAN?

Òî âñå ÎÊ - çàõîäèò, ñåññèÿ íå âèñíåò.

Äàéòå âèâîä êîìàíä

Code:

iptables -nvL

è

Code:

iptables -L -nvt nat

Âûâîä êîìàíä:

$ iptables -nvL
Chain INPUT (policy ACCEPT 32235 packets, 2707K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 flags:0x16/0x02
59 4520 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
435K 36M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3000 180K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
11728 4330K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW

Chain FORWARD (policy ACCEPT 292 packets, 18640 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
292 18640 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 TCPMSS clamp to PMTU
5337 2789K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP all -- !br0 ppp0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- !br0 vlan1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT

Chain OUTPUT (policy ACCEPT 709K packets, 845M bytes)
pkts bytes target prot opt in out source destination

Chain MACS (0 references)
pkts bytes target prot opt in out source destination

Chain SECURITY (0 references)
pkts bytes target prot opt in out source destination
0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 limit: avg 1/sec burst 5
0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5
0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/sec burst 5
0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/sec burst 5
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain logaccept (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `ACCEPT '
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0

Chain logdrop (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state
NEW LOG flags 7 level 4 prefix `DROP '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

$ iptables -L -nvt nat
Chain PREROUTING (policy ACCEPT 14493 packets, 1255K bytes)
pkts bytes target prot opt in out source destination
10246 782K VSERVER all -- * * 0.0.0.0/0 78.106.60.42
12 576 VSERVER all -- * * 0.0.0.0/0 10.29.75.190

Chain POSTROUTING (policy ACCEPT 6133 packets, 368K bytes)
pkts bytes target prot opt in out source destination
290 18544 MASQUERADE all -- * ppp0 !78.106.60.42 0.0.0.0/0
0 0 MASQUERADE all -- * vlan1 !10.29.75.190 0.0.0.0/0
53 11496 MASQUERADE all -- * br0 192.168.1.0/24 192.168.1.0/24

Chain OUTPUT (policy ACCEPT 6186 packets, 380K bytes)
pkts bytes target prot opt in out source destination

Chain VSERVER (2 references)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:32506 to:192.168.1.122:32506
0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:32506 to:192.168.1.122:32506

Äîáàâüòå ïðàâèëî

PHP Code:

iptables -I INPUT -i WANIF -d WANIP -p tcp --dport 443 -j LOG --log-prefix '** SSH FROM WAN **' --log-level 4

Âðåçóëüòàòå áóäåòå âèäèòü êòî è êîãäà ñòó÷àëñÿ íà Âàø ïîðò.

Quote:

Originally Posted by Less

Врезультате будете видить кто и когда стучался на Ваш порт.

Добавил (WANIF - ppp0, WANIP - IP туннеля) - в системный лог на вебморде ничего нового не попадает.
В каком логе смотреть?
Подскажите плз, а зачем Вы просили вывод iptables?

Âûâåäèòå ëèñòèíã êîìàíäû

Code:

/usr/sbin/iptables-save

òàê íàãëÿäíåé. Ïëþñ âûâåäèòå ëèñòèíã êîìàíäû

Code:

/bin/netstat -al

Ïåðâàÿ êîìàíäà íóæíà, ÷òîá âûÿñíèòü, êàê íàñòðîåí âàø ôàåðâîë è êàêèå ïàêåòû îí íå ïóñêàåò.
Âòîðàÿ êîìàíäà íóæíà, ÷òîá âûÿñíèòü, ïî êàêèì àäðåñàì è èíòåðôåéñàì ñëóøàåò ñëóæáà íà 443 ïîðòå

Вывод команд:

$ /usr/sbin/iptables-save
# Generated by iptables-save v1.2.7a on Wed Mar 4 23:10:38 2009
*nat
:PREROUTING ACCEPT [5740:607938]
:POSTROUTING ACCEPT [5633:338293]
:OUTPUT ACCEPT [5651:341795]
:VSERVER - [0:0]
-A PREROUTING -d 78.106.xx.xx -j VSERVER
-A PREROUTING -d 10.29.xx.xx -j VSERVER
-A POSTROUTING -s ! 78.106.xx.xx -o ppp0 -j MASQUERADE
-A POSTROUTING -s ! 10.29.xx.xx -o vlan1 -j MASQUERADE
-A POSTROUTING -s 192.168.1.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -o br0 -j MASQUERADE
-A VSERVER -p tcp -m tcp --dport 32506 -j DNAT --to-destination 192.168.1.122:32506
-A VSERVER -p udp -m udp --dport 32506 -j DNAT --to-destination 192.168.1.122:32506
COMMIT
# Completed on Wed Mar 4 23:10:39 2009
# Generated by iptables-save v1.2.7a on Wed Mar 4 23:10:39 2009
*mangle
:PREROUTING ACCEPT [8714174:2743562014]
:INPUT ACCEPT [8697843:2735621632]
:FORWARD ACCEPT [15279:7834490]
:OUTPUT ACCEPT [13309041:14864647035]
:POSTROUTING ACCEPT [13331423:14875104148]
COMMIT
# Completed on Wed Mar 4 23:10:39 2009
# Generated by iptables-save v1.2.7a on Wed Mar 4 23:10:39 2009
*filter
:INPUT ACCEPT [25031:2220015]
:FORWARD ACCEPT [758:36384]
:OUTPUT ACCEPT [5709391:5483432254]
:MACS - [0:0]
:SECURITY - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ! br0 -o ppp0 -j DROP
-A FORWARD -i ! br0 -o vlan1 -j DROP
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A SECURITY -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A SECURITY -p udp -m limit --limit 5/sec -j RETURN
-A SECURITY -p icmp -m limit --limit 5/sec -j RETURN
-A SECURITY -j DROP
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP
COMMIT
# Completed on Wed Mar 4 23:10:39 2009

$ /bin/netstat -al
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:51777 *:* LISTEN
tcp 0 0 *:printer *:* LISTEN
tcp 0 0 WL-0022152B:netbios-ssn *:* LISTEN
tcp 0 0 *:laserjet *:* LISTEN
tcp 0 0 *:www *:* LISTEN
tcp 0 0 *:domain *:* LISTEN
tcp 0 0 *:3838 *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:telnet *:* LISTEN
tcp 0 0 *:https *:* LISTEN
udp 0 0 *:1024 *:*
udp 0 0 WL-0022152BC:netbios-ns *:*
udp 0 0 *:netbios-ns *:*
udp 0 0 WL-0022152B:netbios-dgm *:*
udp 0 0 *:netbios-dgm *:*
udp 0 0 localhost.localdo:34954 *:*
udp 0 0 localhost.localdom:1038 *:*
udp 0 0 *:9999 *:*
udp 0 0 *:domain *:*
udp 0 0 *:bootps *:*
raw 0 0 *:1 *:* 0
raw 0 0 *:255 *:* 0
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 833 /tmp/screens/S-p2p/160.rtorrent
unix 2 [ ACC ] STREAM LISTENING 79612 /var/run/pptp/255.255.255.255:85.21.xx.xx

Получается, что роутер пускает все пакеты, но не слушает порт 443?
Но ведь:
$ ps -ef|grep drop
admin 222 1 0 16:15 ? 00:00:00 dropbear -p 443
И с LAN интерфейса заходит на 443...

iptables -I INPUT -i vlan1 -p tcp --destination-port 443 -j ACCEPT

ïîïðîáóé.....

tcp 0 0 *:https *:* LISTEN
ýòî è åñòü 443 ïîðò --- ò.å. ñëóøàåò îê.

ê ñîæàëåíèþ, --dport = --destination-port, òàê ÷òî íè÷åãî íîâîãî îæèäàòü íå ïðèõîäèòñÿ.

â îáùåì, âñå ïðîêèíóòî, âñå ñëóøàåò, íî ... íå ðàáîòàåò. ß áû ñêàçàë, ÷òî åùå ïðîâàéäåð ìîæåò áëîêèðîâàòü ïîðò, íî åñëè "Ïðè ýòîì íà ðîóòåðå ñîçäàåòñÿ åùå 1 ïðîöåññ dropbear -p 443.", òî áîëüøå èäåé íåò.

P.S. à ó âåá ñåðâåðà ñëó÷àéíî íå íàñòðîåí https? Õîòÿ â ýòîì ñëó÷àå êòî-òî èç äâóõ (èëè îí èëè dropbear) äîëæåí âûëåòàòü ñ îøèáêîé.

Ïîõîæå âàðèàíòû çàêîí÷èëèñü :(

Ïîïðîáîâàë âìåñòî dropbear openssh - ðåçóëüòàò òîò æå.
Ïîïðîáîâàë çàéòè ñ äðóãîãî êëèåíòà íà 443-
ssh <ëîãèí>@<ðîóòåð> -p 443
ãîâîðèò:
ssh_exchange_identification: read: Connection reset by peer

Ïîõîæå ÷òî-òî âíóòðè ðîóòåðà ðåæåò.
Âå÷åðîì ïîäêëþ÷ó ê wan êàáåëü - ïîïðîáóþ ïðîâåðèòü íàïðÿìóþ, áåç òóííåëÿ è ïðîâàéäåðà.
Ïîòîì ñáðîøó âñå íàñòðîéêè, çàíîâî íàêà÷ó ïðîøèâêó.
Íî, ñäàåòñÿ ìíå, íå ïîìîæåò. Íåóæåëèò íè ó êîãî íå áûëî ïîõîæåé ïðîáëåìû?

åñòü âàðèàíò - âûáðàòü äðóãîé ïîðò
ïîìîåìó 443 - https (ìîæåò åãî ïåðåõâàòûâàåò âåáá ñåðâåð, êîòîðûé â âåáá ìîðäå?)
ïî ïîâîäó òîãî ÷òî ñîçäàåòñÿ åùå îäèí ïðîöåññ dropbear - òàê è äîëæíî áûòü
òàê êàê ïåðâûé ïðîöåññ ýòî íàïîäîáå äåìîíà
à âòîðîé - ñàìî ñîåäåíåíèå
ñîëüêî ñîåäåíåíèé íà dropbear ñòîëüêî è ïðîöåññîâ +1

Ïðîáîâàëè íà 2õ ðîóòåðàõ (2 ðàçíûõ ïðîâàéäåðà) íà 21, 81, 443 ïîðòàõ.