Remote ssh access

Quote:

Originally Posted by kostik

Ïðîáîâàëè íà 2õ ðîóòåðàõ (2 ðàçíûõ ïðîâàéäåðà) íà 21, 81, 443 ïîðòàõ.

âû ñïåöèàëüíî òàêèå ïîðòû âûáèðàåòå?
http://www.cnt.ru/~wh/articles/ref19.html
âñå ÷òî íàõîäèòüñÿ îò 1 äî 1024 - ëó÷øå íå èñïîëüçîâàòü

Âñåì ñïàñèáî!!!!!
Ïî ïîðòó 5190 - ñîåäèíèëñÿ.
Âñå ñáðîñèë, îñòàâèë òîëüêî:
dropbear -p 5190
iptables -I INPUT -p tcp --dport 5190 -j ACCEPT
Âîïðîñ çàêðûò. Òîëüêî íåïîíÿòíî, ïî÷åìó íà 443 íå ñðàáàòûâàëî?
(sftp íàñòðîåí íå áûë)

Quote:

Originally Posted by DarkSide

Ïåðå÷èòàâ âñå ïîñòû êàñàþùèåñÿ áåçîïàñíîñòè SSH íà ýòîì ôîðóìå ïðèøåë â òàêîìó âàðèàíòó:

pre-boot:

Code:

#!/bin/sh insmod ipt_recent

post-firewall:

Code:

#!/bin/sh logger " --- Post-Firewall Event" WAN=$(nvram get wan_ifname) FW_LOG_TYPE=$(nvram get fw_log_x) if [ $FW_LOG_TYPE == "drop" -o $FW_LOG_TYPE == "both" ] then DROP="logdrop" else DROP="DROP" fi DROP_CMD="iptables -D INPUT -j $DROP" if [ -z "$($DROP_CMD 2>&1)" ] then DROPPED="1" else DROPPED="0" fi iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --set --name SSH_ATTACKER --rsource iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --rcheck --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j LOG --log-prefix "SSH_ATTACKER " iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --update --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j DROP iptables -t nat -A PREROUTING -i $WAN -p tcp --dport ssh -j ACCEPT iptables -A INPUT -i $WAN -p tcp --dport ssh -j ACCEPT if [ $DROPPED == "1" ] then iptables -A INPUT -j $DROP fi

Ýòîò êîä ïîçâîëèò ðàáîòàòü DB äàæå â òîì ñëó÷àå, êîãäà ÷åðåç âåá-èíòåðôåéñ â ðàçäåëå ôàéðâîëà áûëà óñòàíîâëåíà êàêàÿ-ëèáî îïöèÿ ëîãèðîâàíèÿ ïàêåòîâ.

À ïî÷åìó òû ïðîâåðêó íà SSH äåëàåøü â ïðåðîóòèíãå? Åñòü êàêàÿ-òî âåñêàÿ ïðè÷èíà íå âûíîñèòü ýòî â INPUT?

È âîïðîñ îáùèé, ÷òî-òî ãóãë íå î÷åíü ãîâîðëèâ. Â ÷åì ðàçíèöà --update è --rcheck ? Òî÷íåå, ÷òî äëÿ ÷åãî íóæíî? :-[

--updated--

p.s. Ïðî áëîêèðîâàíèå - ÿ ñåé÷àñ ïðîáóþ íàïèñàòü ñêðèïò, âûäèðàþùèé èç ëîãà ôàåðâîëà ïîïûòêè SSH âçëîìà è âïèñûâàåò èõ â ssh.deny ñ êîììåíòàìè. Ïî êðàéíåé ìåðå, ýòî áóäåò ñîõðàíÿòüñÿ ïîñëå ðåñòàðòà ñåðâåðà - ðàç, è ìîæíî áóäåò "ïî÷èñòèòü" - äâà.

Quote:

Â ÷åì ðàçíèöà --update è --rcheck ?

http://snowman.net/projects/ipt_recent/

PHP Code:

iptables -m recent -h

åñëè êîðîòêî, òî --update æåñò÷å.

Óâàæàåìûå ãóðó, íå ìîãëè áû ïîìî÷ü? Òóò âîïðîñîâ íàêîïèëîñü, ôîðóì ïåðåðûâàþ, íî îòâåòà íå íàõîæó, ìîæåò èç-çà çíàíèé óçêèõ.. Â ëèíóõå ÷àéíèê:confused:
1) ÷èòàþ â Äëÿ íîâè÷êîâ è ëåíèâûõ:
2. Äëÿ telnet/ssh:
2.1. Ñìåíèòü ïàðîëü íóæíîãî (ñóùåñòâóþùåãî) þçåðà:

Code:

passwd username

Ïèøó

Code:

passwd admin

, ââîæó 2 íîâûõ ïàðîëÿ, âñå îê ìåíÿåò, çàòåì

Code:

flashfs save flasfs commit flashfs enable

Çàâåðøàþ ñåññèþ, äåëàþ íîâóþ ñ íîâûì ïàðîëåì - ðàáîòàåò, ñòàðûé ïàðîëü óæå íå ðàáîòàåò, â ïðèíöèïå ÷åãî è íàäî áûëî. Ïåðåçàãðóæàþ ðîóòåð - ïàðîëü ñëåòàåò íà äåôàóëò %) Êàê æå ñäåëàòü òàê, ÷òîá ïîñëå ïåðåçàãðóçêè ïàðîëü ñîõðàíèëñÿ??
2) ×èòàë ïðî áåçîïàñíîñòü ssh, ïðî òî, ÷òî ëîìàíóòü ìîãóò.. Íî òàê è íå ïîíÿë êàê æå ïåðåâåñòè åãî ñ 22 ïîðòà íà êàêîé-òî ñâîé? Èìåííî ïåðåâåñòè, ÷òîá 22 ïåðåñòàë ðàáîòàòü.

Quote:

Originally Posted by Codeserfer

Íî òàê è íå ïîíÿë êàê æå ïåðåâåñòè åãî ñ 22 ïîðòà íà êàêîé-òî ñâîé? Èìåííî ïåðåâåñòè, ÷òîá 22 ïåðåñòàë ðàáîòàòü.

Çàïóñêàéòå dropbear ñ ïàðàìåòðîì -p xxx
ãäå xxx íîìåð âûáðàííîãî ïîðòà.

à ïî ïåðâîìó âîïðîñó --- èùèòå ïî ôàéëó ñ íàçâàíèåì .files

Quote:

Originally Posted by al37919

à ïî ïåðâîìó âîïðîñó --- èùèòå ïî ôàéëó ñ íàçâàíèåì .files

Íî òàì êàæåòñÿ ïàðîëè êîäèðóþòñÿ îñîáûì îáðàçîì..

Quote:

Originally Posted by al37919

Çàïóñêàéòå dropbear ñ ïàðàìåòðîì -p xxx
ãäå xxx íîìåð âûáðàííîãî ïîðòà.

À îí ðàçâå àâòîìàòîì íå ñòàðòóåò ïðè çàïóñêå ðîóòåðà? Åñëè äà, òî ãäå æå ïîìåíÿòü ïàðàìåòðû çàïóñêà?

Quote:

À îí ðàçâå àâòîìàòîì íå ñòàðòóåò ïðè çàïóñêå ðîóòåðà? Åñëè äà, òî ãäå æå ïîìåíÿòü ïàðàìåòðû çàïóñêà?

âîîáùå òî íîðìàëüíî, êîãäà âîïðîøàþùèé äåëèòñÿ ïîäðîáíîñòÿìè --- õîòÿ áû êàêîå óñòðîéñòâî è î êàêîé ïðîøèâêå èäåò ðå÷ü. Èëè ïðåäëàãàåòñÿ îïèñàòü ïîâåäåíèå âñåõ ïðîøèâîê äëÿ âñåõ âîçìîæíûõ óñòðîéñòâ? :mad:

Quote:

Originally Posted by al37919

âîîáùå òî íîðìàëüíî, êîãäà âîïðîøàþùèé äåëèòñÿ ïîäðîáíîñòÿìè --- õîòÿ áû êàêîå óñòðîéñòâî è î êàêîé ïðîøèâêå èäåò ðå÷ü. Èëè ïðåäëàãàåòñÿ îïèñàòü ïîâåäåíèå âñåõ ïðîøèâîê äëÿ âñåõ âîçìîæíûõ óñòðîéñòâ? :mad:

Ïðîøó ïðîùåíèÿ, âèíîâàò:(
Ïðîøèâêà îò Îëåãà 1.9.2.7-10, ðîóòåð Asus Wl-500 gP v2. Ñòîèò âñå îòñþäà è mc.

Quote:

Originally Posted by Codeserfer

Ïðîøó ïðîùåíèÿ, âèíîâàò:(
Ïðîøèâêà îò Îëåãà 1.9.2.7-10, ðîóòåð Asus Wl-500 gP v2. Ñòîèò âñå îòñþäà è mc.

Íà ýòîé ïðîøèâêå îí àâòîìàòîì íå çàïóñêàåòñÿ. Íàäî ïðîïèñûâàòü êîìàíäó â post-boot. Â "íàñòðîéêàõ ñ íóëÿ..." îïèñàíî.

Quote:

Originally Posted by Serge_K

Íà ýòîé ïðîøèâêå îí àâòîìàòîì íå çàïóñêàåòñÿ. Íàäî ïðîïèñûâàòü êîìàíäó â post-boot. Â "íàñòðîéêàõ ñ íóëÿ..." îïèñàíî.

à â post-firewall åñòü ñòðî÷êà:

Code:

iptables -I INPUT -p tcp --dport 8081 ACCEPT

Ýòî íå òî?
Â post-boot ïóñòî

Quote:

Originally Posted by Codeserfer

Â post-boot ïóñòî

È áóäåò ïóñòî, åñëè åãî íå ñîçäàòü è â íåãî íè÷åãî íå çàïèñàòü.

Quote:

Originally Posted by Serge_K

È áóäåò ïóñòî, åñëè åãî íå ñîçäàòü è â íåãî íè÷åãî íå çàïèñàòü.

Íó îí ñîçäàí óæå, ïðîñòî òàì ïî÷òè ïóñòî:

Code:

#!/bin/sh dropbear > /dev/null 2>&1

Ñêàæèòå, ïîæàëóéñòà, ÷òî èìåííî íåîáõîäèìî ïðîïèñàòü?

Quote:

Originally Posted by Codeserfer

Íó îí ñîçäàí óæå, ïðîñòî òàì ïî÷òè ïóñòî:

Code:

#!/bin/sh dropbear > /dev/null 2>&1

Ñêàæèòå, ïîæàëóéñòà, ÷òî èìåííî íåîáõîäèìî ïðîïèñàòü?

Íó âîò çäåñü æå âñå íàïèñàíî:
http://wl500g.info/showthread.php?t=3171

Ïî ssh ìîæíî çàéòè òîëüêî ïîñëå íàæàòèÿ êíîïêè update â âåá-èíòåðôåéñå

Äîáàâèë â post-firewall íóæíóþ ñòðîêó (â ñîîòâåòñâèè ñ ðåêîìåíäàöèÿìè Mam(o)n), íî ïî ssh âñ¸ ðàâíî íåâîçìîæíî çàéòè íà ðóòåð ñ âíåõè... òîëüêî åñëè íàæàòü êíîïêó Update â âåá-èíòåðôåéñå ðóòåðà (IP Config-Misc-Update) Ïîëó÷àåòñÿ çàéòè îäèí ðàç. Ïîäñêàæèòå, ÷òî äåëàòü:confused:

Mam(o)n ñîâåòîâàë åùå ýòî:

Quote:

Íó ÿ äóìàþ åùå ìîæíî ïîêàçàòü ðåçóëüòàò âûïîëíåíèÿ êîìàíä iptables -L INPUT -vn è iptables -L -vnt nat äëÿ óâåðåííîñòè, ÷òî ôàéðâîë íàñòðîåí ïðàâèëüíî.

Code:

[admin@gexsrv root]$ iptables -L INPUT -vn Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 46 5299 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 220K 248M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 3013 181K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 19395 5868K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 1007 30224 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 19752 27M ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 648K 33M SECURITY all -- vlan2 * 0.0.0.0/0 0.0.0.0/0 state NEW 1 328 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 1 48 BRUTE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x17/0x02 0 0 BRUTE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 flags:0x17/0x02 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.1 tcp dpt:80 10 640 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 114K 8425K DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Code:

[admin@gexsrv root]$ iptables -L -vnt nat Chain PREROUTING (policy ACCEPT 811K packets, 49M bytes) pkts bytes target prot opt in out source destination 651K 33M VSERVER all -- * * 0.0.0.0/0 10.255.165.44 Chain POSTROUTING (policy ACCEPT 10750 packets, 902K bytes) pkts bytes target prot opt in out source destination 153K 16M MASQUERADE all -- * vlan2 !10.255.165.44 0.0.0.0/0 110 24521 SNAT all -- * br0 192.168.1.0/24 192.168.1.0/24 to:192.168.1.1 Chain OUTPUT (policy ACCEPT 10820 packets, 922K bytes) pkts bytes target prot opt in out source destination Chain VSERVER (1 references) pkts bytes target prot opt in out source destination 2 88 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:192.168.1.1:80 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:26578 to:192.168.1.65:26578 1 95 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:26578 to:192.168.1.65:26578 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:19505 to:192.168.1.65:19505 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:19505 to:192.168.1.65:19505 27 1440 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:36041 to:192.168.1.65:36041 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:36041 to:192.168.1.65:36041 5 224 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:24500 to:192.168.1.65:24500 1 95 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:24500 to:192.168.1.65:24500 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:36130 to:192.168.1.65:36130 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:36130 to:192.168.1.65:36130 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:29921 to:192.168.1.65:29921 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:29921 to:192.168.1.65:29921 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:28992 to:192.168.1.65:28992 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:28992 to:192.168.1.65:28992 30 3438 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51411 to:192.168.1.65:51411

â äàííûé ìîìåíò âèäíî, ÷òî ïðîøèâêà ñòîèò 1.9.2.7-d, ssh ïðîêèíóò ÷åðåç âåá èíòåðôåéñ è òàì æå âêëþ÷åíà çàùèòà îò bruteforce ïóòåì ipt_recent. Âû ïûòàåòåñü ïðîêèíóòü ssh ÷åðåç post-firewall âòîðîé ðàç è åùå ðàç âêëþ÷èòü òó æå çàùèòó. Ïîëàãàþ íè÷åãî õîðîøåãî æäàòü îò ýòîãî íå ïðèõîäèòñÿ.

Îòêëþ÷èë â âåá-èíòåðôåéñå çàùèòó îò áðóò-ôîðñà. Äîñòóï ïî ssh èç WAN ïîÿâèëñÿ,íî ðàáîòàåò ïî÷åìó-òî íå âñåãäà(ðàçà 3 èç 5, â 2 ñëó÷àÿõ âîçíèêàåò îøèáêà connection refusd). Ìîæåò áûòü ïðîáëåìà â íåäîñòóïíîñòè DynDNS èë ðóòåð ÷åì-òî î÷åíü ñèëüíî çàíÿò?
Íà âñÿêèé ñëó÷àé:

Code:

[admin@gexsrv root]$ iptables -L INPUT -vn Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 26 2008 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 837K 1092M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 3179 191K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 18268 6082K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 657 18920 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 64 9408 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 349K 18M SECURITY all -- vlan2 * 0.0.0.0/0 0.0.0.0/0 state NEW 4 1312 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 1 48 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x17/0x02 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 flags:0x17/0x02 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.1 tcp dpt:80 7 448 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 81854 5800K DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Code:

[admin@gexsrv root]$ iptables -L -vnt nat Chain PREROUTING (policy ACCEPT 409K packets, 24M bytes) pkts bytes target prot opt in out source destination 354K 18M VSERVER all -- * * 0.0.0.0/0 10.255.165.44 Chain POSTROUTING (policy ACCEPT 12496 packets, 1050K bytes) pkts bytes target prot opt in out source destination 51085 5128K MASQUERADE all -- * vlan2 !10.255.165.44 0.0.0.0/0 143 31868 SNAT all -- * br0 192.168.1.0/24 192.168.1.0/24 to:192.168.1.1 Chain OUTPUT (policy ACCEPT 12572 packets, 1074K bytes) pkts bytes target prot opt in out source destination Chain VSERVER (1 references) pkts bytes target prot opt in out source destination 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:192.168.1.1:80 40 1816 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:26578 to:192.168.1.65:26578 1 95 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:26578 to:192.168.1.65:26578 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:19505 to:192.168.1.65:19505 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:19505 to:192.168.1.65:19505 27 1452 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:36041 to:192.168.1.65:36041 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:36041 to:192.168.1.65:36041 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:24500 to:192.168.1.65:24500 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:24500 to:192.168.1.65:24500 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:36130 to:192.168.1.65:36130 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:36130 to:192.168.1.65:36130 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:29921 to:192.168.1.65:29921 1 95 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:29921 to:192.168.1.65:29921 0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:28992 to:192.168.1.65:28992 0 0 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:28992 to:192.168.1.65:28992 35 4045 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51411 to:192.168.1.65:51411

âîçìîæíî, ïî êðàéíåé ìåðå ñ òî÷êè çðåíèÿ ôàéðâîëëà ïðîêèíóòî âñå îê.

Â ÷åì æå äåëî?
Ïðÿìî ùàñ ñ ðàáîòû ïðîâåðÿþ è ïîëó÷àþ Connection Refused :(
Õîòÿ íà âåá èíòåðôåéñ çàõîäèò...
Ðàäè èíòåðåñà ïîêàïàëñÿ â ëîãàõ è âîò, ÷òî îáíàðóæèë

Code:

Jan 1 05:00:10 ddns update: connected to members.dyndns.org (204.13.248.112) on port 80. Jan 1 05:00:11 ddns update: authentication failure Jan 1 05:00:11 ddns update: failure to update vlan2->10.255.165.44 (gex45.ath.cx) Jan 1 05:00:11 ddns update: shutting down updater for gex45.ath.cx due to fatal error

Ïîõîæå, ÷òî íåâîçìîæíî ïðîéòè àóòåíòèôèêàöèþ, õîòÿ íèêàêèå íàñòðîéêè íå ìåíÿë è ðàíüøå ïåðèîäè÷åñêè ìîæíî áûëî çàõîäèòü ïî ssh.

UPD. Îòòóäà æå èç ëîãà

Code:

Jan 1 05:00:09 dropbear[131]: Failed listening on '22': Error listening: Address already in use Jan 1 05:00:10 dropbear[131]: premature exit: No listening ports available. Jan 1 05:00:10 ddns update: connected to members.dyndns.org (204.13.248.112) on port 80. Jan 1 05:00:11 ddns update: request successful Jan 1 05:00:11 ddns update: successful update for vlan2->10.255.165.44 (gex45.ath.cx)

Õì, ïî÷åìó æå 22 ïîðò in use?

Quote:

Õì, ïî÷åìó æå 22 ïîðò in use?

çíà÷èò dropbear óæå çàïóùåí.

Quote:

Originally Posted by al37919

À åñëè ñîâñåì ïî òåìå, òî òàáëèöà ïîñòåïåííî çàïîëíÿåòñÿ. Ýòà øòóêà ðàáîòàåò ÷àñà 4, à â SSH_ATTACKER óæå 3 çàïèñè âêëþ÷àÿ ìîé òåñò. Àïòàéì ê äàííîìó ìîìåíòó 11 äíåé è íàäåþñü, ÷òî äî ñâîåãî âîçâðàùåíèÿ èç êîìàíäèðîâêè îí äîéäåò ãäå-íèáóäü äíåé äî 40. Ñêîëüêî æå çàïèñåé áóäåò â ýòîé òàáëèöå è ïî÷åìó íå óäàëÿþòñÿ áåñïîëåçíûå çàïèñè (òå, ñðîê äàâíîñòè ïî êîòîðûì óæå âûøåë). Âåäü åñëè ãîñòü ñ ýòîãî æå àäðåñà çàãëÿíåò åùå ðàçîê, òî îí áóäåò äîáàâëåí ñ íóëÿ áåç ïðîáëåì. À âåäü ãäå-òî ýòî äîëæíî õðàíèòüñÿ, äà è ïðîâåðêà èäòè ïî âñåì àäðåñàì --- ëèøíèå íàêëàäíûå ðàñõîäû. Íåò ëè òàì âàðèàíòà ñàìîî÷èñòêè îò áåñïîëåçíîé èíôîðìàöèè. Èëè ýòà òàáëèöà èç ñåáÿ ÷òî òî âðîäå ëîãà ïðåäñòàâëÿåò?

P.S. Íó äà ÿ ïîíÿë, ïî êðàéíåé ìåðå äëÿ ADSL ñîåäèíåíèÿ òàêàÿ ïðîáëåìà íå ñóùåñòâóåò, ò.ê. ïðè åæåñóòî÷íîì ðàçðûâå ñîåäèíåíèÿ iptables ïåðåçàïóñêàþòñÿ.

Òîæå ýòîò âîïðîñ çàèíòåðåñîâàë
Àâòîð ìîäóëÿ âîò ÷òî ïèøåò:

Quote:

The module itself accepts parameters, defaults shown:
ip_list_tot=100 ; Number of addresses remembered per table
ip_pkt_list_tot=20 ; Number of packets per address remembered
ip_list_hash_size=0 ; Hash table size
0 means to calculate it based on ip_list_tot, default: 512
ip_list_perms=0644 ; Permissions for /proc/net/ipt_recent/* files
debug=0 ; Set to 1 to get lots of debugging info

Ïàðàìåòðû ìåíÿþòñÿ íàâåðíîå òàê:

Code:

modprobe ipt_recent ip_list_tot=1000

Ðàñïóòàéòå ìåíÿ ïîæàëóéñòà.

Ïûòàëñÿ íàñòðîèòü áåçîïàñíûé äîñòóï ê ssh. Íî ÷òî-òî ñàì çàïóòàëñÿ.
ssh ðàáîòàåò íà ñòàíäàðòíîì ïîðòó (22).
Íî äîñòóï ñ ðàáîòû ÿ ìîãó èìåòü òîëüêî ïî 80 èëè 443 ïîðòàì.
Ïîýòîìó äåëàþ ïðîêèäûâàíèå 443 íà ëîêàëüíûé 22.
Ñåé÷àñ ýòîò êóñîê â ïîñò-ôàéðâîëë âûãëÿäèò òàê:

Code:

# Ëîâèì àòàêóþùèõ íà shh (22) ïîðò # - ñîçäàëè òàáëèöó äëÿ ïàêåòîâ íà 22 ïîðò iptables -N SSH_EVAL # - Óäàëÿþ çàïðåùàþùåå ïðàâèëî iptables -D INPUT -j DROP # - âñå, ÷òî ïðèõîä íà 22 ïîðò îòïðàâëÿåì â íàøó òàáëèöó iptables -A INPUT -p tcp --dport $SSH_PORT -j SSH_EVAL # - ôèëüòðóåì âñå, ÷òî íå ïðèøëî ñ âíóòðåííåãî èíòåðôåéñà br0 iptables -A SSH_EVAL -i ! $BR0IF -p tcp -m state --state NEW --dport $SSH_PORT -m recent --set --name SSH_ATTACKER --rsource iptables -A SSH_EVAL -i ! $BR0IF -p tcp -m state --state NEW --dport $SSH_PORT -m recent --update --seconds 600 --hitcount 4 --name SSH_ATTACKER --rsource -j DROP # - óñòàíîâëåííûå ñîåäèíåíèÿ ðàçðåøàþ iptables -A SSH_EVAL -p tcp --syn --dport $SSH_PORT -j ACCEPT # - Âîçâðàùàþ íàçàä çàïðåùàþùåå ïðàâèëî iptables -A INPUT -j DROP # - ïðîáðàñûâàåì âíåøíèé ïîðò íà 22 âíóòðåííèé iptables -t nat -I PREROUTING -i $PPP0IF -p tcp --dport $PPP0_SSH_PORT -j DNAT --to-destination $BR0IP:$SSH_PORT

ãäå

Code:

PPP0IP=$2 VLAN1IP=$6 BR0IP=$4 PPP0IF=$1 VLAN1IF=$5 BR0IF=$3 SSH_PORT=22 PPP0_SSH_PORT=443

Â ðåçóëüòàòå ïîëó÷àþòñÿ îòêðûòûìè â èíòåðíåò îáà ïîðòà è 22 è 443.
Êàê ñäåëàòü òàê ÷òîáû îñòàëñÿ îòêðûòûì ñíàðóæè òîëüêî 443, à âíóòðè îñòàëñÿ 22 ?

Quote:

Originally Posted by igor77777

Ïûòàëñÿ íàñòðîèòü áåçîïàñíûé äîñòóï ê ssh. Íî ÷òî-òî ñàì çàïóòàëñÿ.
ssh ðàáîòàåò íà ñòàíäàðòíîì ïîðòó (22).
Íî äîñòóï ñ ðàáîòû ÿ ìîãó èìåòü òîëüêî ïî 80 èëè 443 ïîðòàì.
Ïîýòîìó äåëàþ ïðîêèäûâàíèå 443 íà ëîêàëüíûé 22.

À åñëè ñäåëàòü ÒÎËÜÊÎ äîñòóï ïî 443 ïîðòó âåçäå? Â âåá ìîðäå. È íå çàìîðà÷èâàòüñÿ ñ ïðîáðîñàìè?

Quote:

Originally Posted by vectorm

À åñëè ñäåëàòü ÒÎËÜÊÎ äîñòóï ïî 443 ïîðòó âåçäå? Â âåá ìîðäå. È íå çàìîðà÷èâàòüñÿ ñ ïðîáðîñàìè?

Ýòî òîæå âàðèàíò, íî ÿ êàæåòñÿ ðåøèë ïðîáëåìó.
Ïåðå÷èòàâ man ïî iptables â ÷àñòíîñòè ïî DNAT, ïîíÿë ÷òî òàì ïðîèñõîäèò ñ àäðåñàìè.
Êîðî÷å. Â ïðàâèëî, îòêðûâàþùåå äîñòóï ê 22 ïîðòó äîáàâèë ïðîâåðêó ïî öåëåâîìó ip.
Òåïåðü ýòî ïðàâèëî âûãëÿäèò òàê:

Code:

# - âñå, ÷òî ïðèõîä íà 22 ïîðò îòïðàâëÿåì â íàøó òàáëèöó iptables -A INPUT -d $BR0IP -p tcp --dport $SSH_PORT -j SSH_EVAL

à áûëî òàê:

Code:

# - âñå, ÷òî ïðèõîä íà 22 ïîðò îòïðàâëÿåì â íàøó òàáëèöó iptables -A INPUT -p tcp --dport $SSH_PORT -j SSH_EVAL

Íà WL-700gE îòêëþ÷àåòñÿ ssh

Òàêàÿ âîò ïðîáëåìà æèòü ìåøàåò.

Ðîóòåð WL-700gE, ïðîøèâêà îò KFurge.

×åðåç êàêîå-òî âðåìÿ ðàáîòû ïåðåñòàåò ïóñêàòü ê ñåáå ïî ssh.
Ò.å. ñíà÷àëà ìîãó íîðìàëüíî çàëîãèíèòüñÿ ÷åðåç PuTTy è nTorrent c ÁÁ èëè ëþáîãî íîóòà.
×åðåç êàêîå-òî âðåìÿ nTorrent ïèøåò disconnected. Ïðè ïîïûòêå çàïóñòèòü åãî ïî íîâîé (îïÿòü æå íà ëþáîì êîìïå) ïèøåò Auth fail.
Ïðè ïîïûòêå çàõîäà ÷åðåç PuTTy ïîñëå ââîäà ïàðîëÿ ïèøåò Access denied.
Ïî òåëíåòó ïðè ýòîì ïóñêàåò áåç ïðîáëåì.

Â ÷åì ìîæåò áûòü ïðè÷èíà è êàê åå ïîáîðîòü?

Quote:

Originally Posted by Wadson

Òàêàÿ âîò ïðîáëåìà æèòü ìåøàåò.
Â ÷åì ìîæåò áûòü ïðè÷èíà è êàê åå ïîáîðîòü?

Ñìîòðåòü ëîãè.

Quote:

Originally Posted by vectorm

Ñìîòðåòü ëîãè.

Ëîãè ÷åãî è ãäå?

Quote:

Originally Posted by Wadson

Ëîãè ÷åãî è ãäå?

Ðîóòåðà. Â ðîóòåðå.

Îïèñàííûìè ñïîñîáàìè ìîæíî îãðàíè÷èòü èíòåíñèâíîñòü àòàê, ò.å., íàïðèìåð, íå áîëåå 3 êîííåêòîâ â òå÷åíèå 10 ìèíóò. À êàê ìîæíî îãðàíè÷èòü êîëè÷åñòâî îäíîâðåìåííûõ êîííåêòîâ ê ssh-ñåðâåðó ñ îäíîãî àäðåñà? Êàê ìîæíî îãðàíè÷èòü òàéìàóò ìåæäó óñòàíîâëåíèåì ñîåäèíåíèÿ ñ ssh-ñåðâåðîì è àâòîðèçàöèåé íà íåì?

Quote:

À êàê ìîæíî îãðàíè÷èòü êîëè÷åñòâî îäíîâðåìåííûõ êîííåêòîâ ê ssh-ñåðâåðó ñ îäíîãî àäðåñà?

Ýòî î÷åíü ñòðåìíîå äåéñòâî, ò.ê. íå êàæäàÿ ñåññèÿ çàêðûâàåòñÿ ïðè ðàçðûâå è òàê ìîæíî î÷åíü ëåãêî ñåáÿ îñòàâèòü áåç äîñòóïà âîîáùå.

Äîëãî îí äåðæàëñÿ, â ò.÷. åùå ñåãîäíÿ óòðîì, íî âîò îïÿòü íå ïóñêàåò.
nTorrent âûäàåò "Auth fail".
Â Putty ââîæó root, ââîæó ïàðîëü - ãîâîðèò: "Access denied".
Âîò êîíåö ëîãà:

Quote:

Oct 17 07:32:42 -- MARK --
Oct 17 07:52:46 -- MARK --
Oct 17 08:12:46 -- MARK --
Oct 17 08:32:46 -- MARK --
Oct 17 08:48:04 dropbear[1186]: Child connection from 192.168.1.5:2875
Oct 17 08:48:07 dropbear[1186]: password auth succeeded for 'admin' from 192.168.1.5:2875
Oct 17 08:52:46 -- MARK --
Oct 17 09:12:46 -- MARK --
Oct 17 09:32:46 -- MARK --
Oct 17 09:52:46 -- MARK --
Oct 17 10:12:46 -- MARK --
Oct 17 10:32:46 -- MARK --
Oct 17 10:52:50 -- MARK --
Oct 17 11:12:50 -- MARK --
Oct 17 11:17:52 dropbear[1186]: exit after auth (admin): error reading: Connection reset by peer
Oct 17 11:32:50 -- MARK --
Oct 17 11:52:50 -- MARK --
Oct 17 12:12:51 -- MARK --
Oct 17 12:32:51 -- MARK --
Oct 17 12:52:51 -- MARK --
Oct 17 13:12:51 -- MARK --
Oct 17 13:32:51 -- MARK --
Oct 17 13:52:57 -- MARK --
Oct 17 14:09:15 dropbear[1233]: Child connection from 192.168.1.5:2686
Oct 17 14:09:18 dropbear[1233]: login attempt for nonexistent user from 192.168.1.5:2686
Oct 17 14:09:18 dropbear[1233]: exit before auth: Disconnect received
Oct 17 14:11:53 dropbear[1241]: Child connection from 192.168.1.5:2943
Oct 17 14:12:24 dropbear[1241]: user 'root' has blank password, rejected
Oct 17 14:12:57 -- MARK --
Oct 17 14:13:16 dropbear[1241]: user 'root' has blank password, rejected
Oct 17 14:13:22 dropbear[1241]: user 'root' has blank password, rejected
Oct 17 14:13:27 dropbear[1241]: exit before auth (user 'root', 6 fails): Exited normally
Oct 17 14:16:22 dropbear[1243]: Child connection from 192.168.1.5:3242
Oct 17 14:16:42 dropbear[1243]: user 'root' has blank password, rejected
Oct 17 14:16:47 dropbear[1243]: user 'root' has blank password, rejected
Oct 17 14:21:48 dropbear[1243]: exit before auth (user 'root', 4 fails): Timeout before auth

à) âû óæ âûÿñíèòå - àäìèí èëè ðóò.
Òåì áîëåå, ÷òî îí âàì àíãëèéñêèì ÿçûêîì ïèøåò -
Oct 17 08:48:07 dropbear[1186]: password auth succeeded for 'admin' from 192.168.1.5:2875
Oct 17 14:13:22 dropbear[1241]: user 'root' has blank password, rejected

Quote:

Originally Posted by asp

à) âû óæ âûÿñíèòå - àäìèí èëè ðóò.
Òåì áîëåå, ÷òî îí âàì àíãëèéñêèì ÿçûêîì ïèøåò -
Oct 17 08:48:07 dropbear[1186]: password auth succeeded for 'admin' from 192.168.1.5:2875
Oct 17 14:13:22 dropbear[1241]: user 'root' has blank password, rejected

À ÷òî òóò âûÿñíÿòü? Ýòî çàõîäû èç ðàçíûõ ïðîãðàìì â ðàçíîå âðåìÿ. Ñ óòðà àâòîðèçàöèÿ ïðîõîäèëà, ïîòîì ïåðåñòàëà. È ïðî òîãî æå àäìèíà ëîã íàïèñàë óæå "íåñóùåñòâóþùèé þçåð". ß ïîòîìó è ïðèâåë âåñü êóñîê.
Åñëè Âàñ ýòî ñìóùàåò, âîò ïîñëåäíèå äåéñòâèÿ:

Quote:

Oct 17 20:21:04 dropbear[643]: Child connection from 192.168.1.5:1203
Oct 17 20:21:07 dropbear[643]: password auth succeeded for 'admin' from 192.168.1.5:1203
Oct 17 20:21:23 dropbear[644]: Child connection from 192.168.1.5:1271
Oct 17 20:21:32 dropbear[644]: password auth succeeded for 'root' from 192.168.1.5:1271

À âîò ïî÷åìó îí îòðóáàåòñÿ è ïåðåñòàåò ïðèíèìàòü ïàðîëü - âîïðîñ.

à êàê æå íàñ÷åò òîãî, ÷òî dropbear äåðæèò íå áîëåå 30 ñîåäèíåíèé îäíîâðåìåííî? òàê äåéñòâèòåëüíî ìîæíî îñòàòüñÿ áåç ñâîáîäíûõ ñîåäèíåíèé.

Ëîãèí/ïàðîëü íà SSH

Ìîæíî ëè ñäåëàòü ëîãèí / ïàðîëü íà SSH òàêèì îáðàçîì, ÷òîáû îí îòëè÷àëñÿ îò telnet?

Quote:

Originally Posted by YVM

Ìîæíî ëè ñäåëàòü ëîãèí / ïàðîëü íà SSH òàêèì îáðàçîì, ÷òîáû îí îòëè÷àëñÿ îò telnet?

âû è òàì è òàì çàõîäèòå ïîä ðóòîì.
íåëüçÿ.

FTP brut force

Ïðîøó ïîìî÷ü ðàçîáðàòüñÿ ñ brut force FTP. Çàäðàëè íàøè æåëòîëèöûå ñîñåäè.
Ïåðå÷èòàâ äàííóþ âåòêó â post-firewall äîáàâèë ñëåäóþùåå ïðàâèëî:

Code:

# for FTP FTP_PORT=21 iptables -N FTPSCAN iptables -A INPUT -p tcp --dport $FTP_PORT -j FTPSCAN iptables -A FTPSCAN -i ! $3 -p tcp --dport $FTP_PORT / -m state --state NEW -m recent --set --name FTP_BR_FR --rsource iptables -A FTPSCAN -i ! $3 -p tcp --dport $FTP_PORT / -m state --state NEW -m recent --update --seconds 60 --hitcount 3 / --name FTP_BR_FR --rsource -j DROP iptables -A FTPSCAN -p tcp --dport $FTP_PORT -j ACCEPT

Code:

$ lsmod Module Size Used by Tainted: P ......... ip_nat_ftp 3912 0 (unused) ip_conntrack_ftp 5216 1 wl 892280 0 (unused) et 31288 0 (unused) ipt_recent 11640 2

Âîò ÷òî ãîâîðèò iptables -L INPUT -vn

Code:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes) 34 3076 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 27147 2454K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 188 11280 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 1129 385K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 31 868 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 1850 233K DROP all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FTPSCAN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21

Äîñòóïà, ñîîòâåòñòâåííî, ê FTP íåò. Ïîðò â òàéìàóòå. Äðóçüÿ, êóäà êîïàòü :confused:

Çàðàíåå áëàãîäàðåí çà ïîìîùü!