Remote ssh access

Quote:

---

Originally Posted by kostik

Ïðîáîâàëè íà 2õ ðîóòåðàõ (2 ðàçíûõ ïðîâàéäåðà) íà 21, 81, 443 ïîðòàõ.

---

âû ñïåöèàëüíî òàêèå ïîðòû âûáèðàåòå?
http://www.cnt.ru/~wh/articles/ref19.html
âñå ÷òî íàõîäèòüñÿ îò 1 äî 1024 - ëó÷øå íå èñïîëüçîâàòü

Âñåì ñïàñèáî!!!!!
Ïî ïîðòó 5190 - ñîåäèíèëñÿ.
Âñå ñáðîñèë, îñòàâèë òîëüêî:
dropbear -p 5190
iptables -I INPUT -p tcp --dport 5190 -j ACCEPT
Âîïðîñ çàêðûò. Òîëüêî íåïîíÿòíî, ïî÷åìó íà 443 íå ñðàáàòûâàëî?
(sftp íàñòðîåí íå áûë)

Quote:

---

Originally Posted by DarkSide

Ïåðå÷èòàâ âñå ïîñòû êàñàþùèåñÿ áåçîïàñíîñòè SSH íà ýòîì ôîðóìå ïðèøåë â òàêîìó âàðèàíòó:

pre-boot:

Code:

---

#!/bin/sh

insmod ipt_recent

---

post-firewall:

Code:

---

#!/bin/sh

logger " --- Post-Firewall Event"

WAN=$(nvram get wan_ifname)

FW_LOG_TYPE=$(nvram get fw_log_x)
if [ $FW_LOG_TYPE == "drop" -o $FW_LOG_TYPE == "both" ]
then
    DROP="logdrop"
else
    DROP="DROP"
fi

DROP_CMD="iptables -D INPUT -j $DROP"
if [ -z "$($DROP_CMD 2>&1)" ]
then
    DROPPED="1"
else
    DROPPED="0"
fi

iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --set --name SSH_ATTACKER --rsource

iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --rcheck --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j LOG --log-prefix "SSH_ATTACKER "
iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --update --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j DROP
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport ssh -j ACCEPT
iptables        -A INPUT      -i $WAN -p tcp --dport ssh -j ACCEPT

if [ $DROPPED == "1" ]
then
    iptables -A INPUT -j $DROP
fi

---

Ýòîò êîä ïîçâîëèò ðàáîòàòü DB äàæå â òîì ñëó÷àå, êîãäà ÷åðåç âåá-èíòåðôåéñ â ðàçäåëå ôàéðâîëà áûëà óñòàíîâëåíà êàêàÿ-ëèáî îïöèÿ ëîãèðîâàíèÿ ïàêåòîâ.

---

À ïî÷åìó òû ïðîâåðêó íà SSH äåëàåøü â ïðåðîóòèíãå? Åñòü êàêàÿ-òî âåñêàÿ ïðè÷èíà íå âûíîñèòü ýòî â INPUT?

È âîïðîñ îáùèé, ÷òî-òî ãóãë íå î÷åíü ãîâîðëèâ.  ÷åì ðàçíèöà --update è --rcheck ? Òî÷íåå, ÷òî äëÿ ÷åãî íóæíî? :-[

--updated--

p.s. Ïðî áëîêèðîâàíèå - ÿ ñåé÷àñ ïðîáóþ íàïèñàòü ñêðèïò, âûäèðàþùèé èç ëîãà ôàåðâîëà ïîïûòêè SSH âçëîìà è âïèñûâàåò èõ â ssh.deny ñ êîììåíòàìè. Ïî êðàéíåé ìåðå, ýòî áóäåò ñîõðàíÿòüñÿ ïîñëå ðåñòàðòà ñåðâåðà - ðàç, è ìîæíî áóäåò "ïî÷èñòèòü" - äâà.

Quote:

---

 ÷åì ðàçíèöà --update è --rcheck ?

---

http://snowman.net/projects/ipt_recent/

PHP Code:

---

iptables -m recent -h 


---

åñëè êîðîòêî, òî --update æåñò÷å.

Óâàæàåìûå ãóðó, íå ìîãëè áû ïîìî÷ü? Òóò âîïðîñîâ íàêîïèëîñü, ôîðóì ïåðåðûâàþ, íî îòâåòà íå íàõîæó, ìîæåò èç-çà çíàíèé óçêèõ..  ëèíóõå ÷àéíèê:confused:
1) ÷èòàþ â Äëÿ íîâè÷êîâ è ëåíèâûõ:
2. Äëÿ telnet/ssh:
2.1. Ñìåíèòü ïàðîëü íóæíîãî (ñóùåñòâóþùåãî) þçåðà:

Code:

---

passwd username

---

Ïèøó

Code:

---

passwd admin

---

, ââîæó 2 íîâûõ ïàðîëÿ, âñå îê ìåíÿåò, çàòåì

Code:

---

flashfs save
flasfs commit
flashfs enable

---

Çàâåðøàþ ñåññèþ, äåëàþ íîâóþ ñ íîâûì ïàðîëåì - ðàáîòàåò, ñòàðûé ïàðîëü óæå íå ðàáîòàåò, â ïðèíöèïå ÷åãî è íàäî áûëî. Ïåðåçàãðóæàþ ðîóòåð - ïàðîëü ñëåòàåò íà äåôàóëò %) Êàê æå ñäåëàòü òàê, ÷òîá ïîñëå ïåðåçàãðóçêè ïàðîëü ñîõðàíèëñÿ??
2) ×èòàë ïðî áåçîïàñíîñòü ssh, ïðî òî, ÷òî ëîìàíóòü ìîãóò.. Íî òàê è íå ïîíÿë êàê æå ïåðåâåñòè åãî ñ 22 ïîðòà íà êàêîé-òî ñâîé? Èìåííî ïåðåâåñòè, ÷òîá 22 ïåðåñòàë ðàáîòàòü.

Quote:

---

Originally Posted by Codeserfer

Íî òàê è íå ïîíÿë êàê æå ïåðåâåñòè åãî ñ 22 ïîðòà íà êàêîé-òî ñâîé? Èìåííî ïåðåâåñòè, ÷òîá 22 ïåðåñòàë ðàáîòàòü.

---

Çàïóñêàéòå dropbear ñ ïàðàìåòðîì -p xxx
ãäå xxx íîìåð âûáðàííîãî ïîðòà.

à ïî ïåðâîìó âîïðîñó --- èùèòå ïî ôàéëó ñ íàçâàíèåì .files

Quote:

---

Originally Posted by al37919

à ïî ïåðâîìó âîïðîñó --- èùèòå ïî ôàéëó ñ íàçâàíèåì .files

---

Íî òàì êàæåòñÿ ïàðîëè êîäèðóþòñÿ îñîáûì îáðàçîì..

Quote:

---

Originally Posted by al37919

Çàïóñêàéòå dropbear ñ ïàðàìåòðîì -p xxx
ãäå xxx íîìåð âûáðàííîãî ïîðòà.

---

À îí ðàçâå àâòîìàòîì íå ñòàðòóåò ïðè çàïóñêå ðîóòåðà? Åñëè äà, òî ãäå æå ïîìåíÿòü ïàðàìåòðû çàïóñêà?

Quote:

---

À îí ðàçâå àâòîìàòîì íå ñòàðòóåò ïðè çàïóñêå ðîóòåðà? Åñëè äà, òî ãäå æå ïîìåíÿòü ïàðàìåòðû çàïóñêà?

---

âîîáùå òî íîðìàëüíî, êîãäà âîïðîøàþùèé äåëèòñÿ ïîäðîáíîñòÿìè --- õîòÿ áû êàêîå óñòðîéñòâî è î êàêîé ïðîøèâêå èäåò ðå÷ü. Èëè ïðåäëàãàåòñÿ îïèñàòü ïîâåäåíèå âñåõ ïðîøèâîê äëÿ âñåõ âîçìîæíûõ óñòðîéñòâ? :mad:

Quote:

---

Originally Posted by al37919

âîîáùå òî íîðìàëüíî, êîãäà âîïðîøàþùèé äåëèòñÿ ïîäðîáíîñòÿìè --- õîòÿ áû êàêîå óñòðîéñòâî è î êàêîé ïðîøèâêå èäåò ðå÷ü. Èëè ïðåäëàãàåòñÿ îïèñàòü ïîâåäåíèå âñåõ ïðîøèâîê äëÿ âñåõ âîçìîæíûõ óñòðîéñòâ? :mad:

---

Ïðîøó ïðîùåíèÿ, âèíîâàò:(
Ïðîøèâêà îò Îëåãà 1.9.2.7-10, ðîóòåð Asus Wl-500 gP v2. Ñòîèò âñå îòñþäà è mc.

Quote:

---

Originally Posted by Codeserfer

Ïðîøó ïðîùåíèÿ, âèíîâàò:(
Ïðîøèâêà îò Îëåãà 1.9.2.7-10, ðîóòåð Asus Wl-500 gP v2. Ñòîèò âñå îòñþäà è mc.

---

Íà ýòîé ïðîøèâêå îí àâòîìàòîì íå çàïóñêàåòñÿ. Íàäî ïðîïèñûâàòü êîìàíäó â post-boot. Â "íàñòðîéêàõ ñ íóëÿ..." îïèñàíî.

Quote:

---

Originally Posted by Serge_K

Íà ýòîé ïðîøèâêå îí àâòîìàòîì íå çàïóñêàåòñÿ. Íàäî ïðîïèñûâàòü êîìàíäó â post-boot. Â "íàñòðîéêàõ ñ íóëÿ..." îïèñàíî.

---

à â post-firewall åñòü ñòðî÷êà:

Code:

---

iptables -I INPUT -p tcp --dport 8081 ACCEPT

---

Ýòî íå òî?
 post-boot ïóñòî

Quote:

---

Originally Posted by Codeserfer

 post-boot ïóñòî

---

È áóäåò ïóñòî, åñëè åãî íå ñîçäàòü è â íåãî íè÷åãî íå çàïèñàòü.

Quote:

---

Originally Posted by Serge_K

È áóäåò ïóñòî, åñëè åãî íå ñîçäàòü è â íåãî íè÷åãî íå çàïèñàòü.

---

Íó îí ñîçäàí óæå, ïðîñòî òàì ïî÷òè ïóñòî:

Code:

---

#!/bin/sh
dropbear > /dev/null 2>&1

---

Ñêàæèòå, ïîæàëóéñòà, ÷òî èìåííî íåîáõîäèìî ïðîïèñàòü?

Quote:

---

Originally Posted by Codeserfer

Íó îí ñîçäàí óæå, ïðîñòî òàì ïî÷òè ïóñòî:

Code:

---

#!/bin/sh
dropbear > /dev/null 2>&1

---

Ñêàæèòå, ïîæàëóéñòà, ÷òî èìåííî íåîáõîäèìî ïðîïèñàòü?

---

Íó âîò çäåñü æå âñå íàïèñàíî:
http://wl500g.info/showthread.php?t=3171