Remote ssh access

[macek]

Ñîãðàæäàíå, ïîäñêàæèòå ÷òî äåëàòü.
Çàìåòèë íà ðîóòåðå æóòêèå òîðìîçà, ïðîâåðèë ëîã è îáíàðóæèë âîò òàêóþ ïîðòÿíêó âåñîì 194 Ê:

Oct 6 03:01:48 dropbear[6091]: exit before auth: Disconnect received
Oct 6 03:01:48 dropbear[6092]: Child connection from ::ffff:148.235.144.119:60377
Oct 6 03:01:50 dropbear[6092]: login attempt for nonexistent user from ::ffff:148.235.144.119:60377
Oct 6 03:01:51 dropbear[6092]: exit before auth: Disconnect received
Oct 6 03:01:51 dropbear[6093]: Child connection from ::ffff:148.235.144.119:50684
Oct 6 03:01:53 dropbear[6093]: login attempt for nonexistent user from ::ffff:148.235.144.119:50684


Àéïèøíèê îäèí è òîò æå.

Ïîäñêàæèòå, åñòü ëè êàêîå-òî ðåøåíèå, ÷òîá ïîñëå òð¸õ ïîïûòîê ëîãèíà àéïèøíèê áàíèëñÿ?

[rattis]

íå ðàç îáñóæäàëîñü. â ïîèñê - "áåçîïàñíîñòü ssh"
è âîîáùå äëÿ íà÷àëà ïîìåíÿéòå ïîðò ñî ñòàíäàðòíîãî 22 íà êàêîé-íèáóäü äðóãîé ïîñëå 10000. ñðàçó ïðîáëåì ñòàíåò ìåíüøå.

[macek]

ñïàñèáî çà íàâîäêó.

[bornnewyear]

Âñåì äîáðûé âå÷åð! Íå ìîãó ñàì ñäåëàòü! Èçâåíèòå çà ãëóïóé âîïðîñ, íî ÿ íå ìîãó!
Íåäàâíî ïðèîáðåë ðîóòåð Asus WL-500g Premium è äèñê íà 2 òåðàáàéòà. Òàê âîò â ÷åì çàäà÷à. Ìíå íóæíî ñîçäàòü òóíåëü SSH, ÷òîáû ÿ ìîã îáðàùàòüñÿ ê ñâîåìó äèñêó ÷åðåç èíåò! Ó äèñêà åñòü èíòåðôåéñ Ethernet. Ò.å. ÿ ìîãó ê íåìó îáðàùàòüñÿ äàæå ïðè âûêëþ÷åííîì êîìïå.
Íà ôîðóìå ïðî÷èòàë, ÷òî ìîæíî íà ðîóòåðå Asus WL-500g Premium ïîäíÿòü SSH ñåðâåð è ñîçäàâ òóíåëü îáðàùàòüñÿ ê ýòîìó äèñêó ïî çàùèùåííîìó êàíàëó.
Çäåñü æå íà ôîðóìå íàøåë âîò òàêóþ èíñòðóêöèþ, ÷òîáû ïîäíÿòü SSH ñåðâåð:

mkdir -p /usr/local/etc/dropbear
dropbearkey -t dss -f /usr/local/etc/dropbear/dropbear_dss_host_key
dropbearkey -t rsa -f /usr/local/etc/dropbear/dropbear_rsa_host_key
mkdir -p /usr/local/sbin/
echo "#!/bin/sh" >> /usr/local/sbin/post-boot
cp /usr/local/sbin/post-boot /usr/local/sbin/post-firewall
cp /usr/local/sbin/post-boot /usr/local/sbin/post-mount
cp /usr/local/sbin/post-boot /usr/local/sbin/pre-shutdown
chmod +x /usr/local/sbin/p*
echo "dropbear > /dev/null 2>&1" >> /usr/local/sbin/post-boot
dropbear > /dev/null 2>&1
flashfs save
flashfs commit
flashfs enable

Ñäåëàë êàê â ýòîé èíñòðóêöèè è íåçíàþ, ÷òî ìíå äåëàòü äàëüøå. Ìíå íóæíî ÷òîáû ÿ ìîã îáðàùàòüñÿ ê ñâîåìó äèñêó óäàëåííî êàê ê ñåòåâîìó äèñêó.

ß ñêà÷àë â èíåòå ïðîãó: SSH Tunel, íî íå ìîãó ïîäêîíåêòèòüñÿ ê SSH ñåðâåðó è ïðîñìàòðèâàòü ñâîé äèñê!

ÏÎÌÎÃÈÒÅ ÏÎÆÀËÓÉÑÒÎ! ÍÅÇÍÀÞ ÓÆÅ ×ÒÎ ÄÅËÀÒÜ!
Çàðàíåå ñïàñèáî!

[kosilas]

Õî÷ó ñïðîñèòü.

#post-boot
dropbear -p 8022  
-----------------
#post-firewall

# set default policy
iptables -P INPUT DROP
# remove last default rule
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --syn --dport 8022 -j ACCEPT 

Ïðîäåëàë âîò òàêèå íàñòðîéêè, ÷òîá îòêðûòü ssh íà 8022 ïîðòó.
Ïîðò äîñòóïåí ïî 8022, íî ïðè åòîì è ïî 22 íîðìàëüíî ëîãèíèòñÿ.
Êàê çàêðûòü òîãäà 22 ïîðò?
Ñïàñèáî.

[dimaka]

Ñíàðóæè ëîãèíèòñÿ?

[kosilas]

Ñíàðóæè ëîãèíèòñÿ?

À íåò ñíàðóæè âèäíî òîëüêî ñ 8022, ñïñèáî.

[ipkiller]

êîìó êàêèå ïðîáëåììû
ó ìåíÿ âñå ñ òî÷íîñòüþ íî íàîáîðîò...
ó ìåíÿ íåò äîñòóïà èç âíå ïî ssh
ïðîäåëàíî:
÷åðåç âåá â Virtual Server äîáàâëåííî
÷òî çàïðîñû ñ 22 ïîðòà ïåðåñûëàåòñÿ íà 22 âíóòðåííåãî ip(11.11.11.1) ðîóòåðà
â Status & Log/Port Forwarding ïîÿâèëàñü
Destination Proto. Port Range Redirect to
all TCP 22 11.11.11.1
all TCP 8080 11.11.11.1

â ëîãå
Oct 14 23:01:51 kernel: DROP IN=ppp0 OUT= MAC= SRC=<èï àäðåñ èñòî÷íèêà> DST=11.11.11.1 LEN=48 TOS=0x00 PREC=0x00 TTL=59 ID=29812 DF PROTO=TCP SPT=58536 DPT=22 SEQ=2212093550 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204055456020001)

Ïî÷åìó ïàêåòû äðîïÿòñÿ?!

ïîïðîáîâàë äîáàâèòü
iptables -A INPUT -p tcp --syn --dport 22 -j ACCEPT
ýôåêòà 0


çàáûë
ïðè êîíåêòå ïî òåëíåòó â ëîãå òîæå ñàìîå òîëüêî DST=âíåøíåìó ip

[Power]

êîìó êàêèå ïðîáëåììû
ó ìåíÿ âñå ñ òî÷íîñòüþ íî íàîáîðîò...
ó ìåíÿ íåò äîñòóïà èç âíå ïî ssh

Äàâàéòå âûâîä iptables-save, ïîñìîòðèì.

À âîîáùå, ìåíÿ íåñêîëüêî óäèâëÿåò, íàñêîëüêî øèðîêî íà ýòîì ôîðóìå ðàñïðîñòðàíåíà ïðàêòèêà äîáàâëåíèÿ â virtual server ïîðòîâ, ïàêåòû íà êîòîðûå ïðåäíàçíà÷åíû ñàìîìó ðîóòåðó - âåäü ýòî äåéñòâèå íè÷åãî íå äà¸ò ñ òî÷êè çðåíèÿ îòêðûòèÿ ïîðòà.

[DarkSide]

Ïåðå÷èòàâ âñå ïîñòû êàñàþùèåñÿ áåçîïàñíîñòè SSH íà ýòîì ôîðóìå ïðèøåë â òàêîìó âàðèàíòó:

pre-boot:

#!/bin/sh

insmod ipt_recent

post-firewall:

#!/bin/sh

logger " --- Post-Firewall Event"

WAN=$(nvram get wan_ifname)

FW_LOG_TYPE=$(nvram get fw_log_x)
if [ $FW_LOG_TYPE == "drop" -o $FW_LOG_TYPE == "both" ]
then
    DROP="logdrop"
else
    DROP="DROP"
fi

DROP_CMD="iptables -D INPUT -j $DROP"
if [ -z "$($DROP_CMD 2>&1)" ]
then
    DROPPED="1"
else
    DROPPED="0"
fi

iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --set --name SSH_ATTACKER --rsource

iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --rcheck --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j LOG --log-prefix "SSH_ATTACKER "
iptables -t nat -A PREROUTING -i $WAN -p tcp -m state --state NEW --dport ssh -m recent --update --seconds 90 --hitcount 4 --name SSH_ATTACKER --rsource -j DROP
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport ssh -j ACCEPT
iptables        -A INPUT      -i $WAN -p tcp --dport ssh -j ACCEPT

if [ $DROPPED == "1" ]
then
    iptables -A INPUT -j $DROP
fi

Ýòîò êîä ïîçâîëèò ðàáîòàòü DB äàæå â òîì ñëó÷àå, êîãäà ÷åðåç âåá-èíòåðôåéñ â ðàçäåëå ôàéðâîëà áûëà óñòàíîâëåíà êàêàÿ-ëèáî îïöèÿ ëîãèðîâàíèÿ ïàêåòîâ.

[Krey]

Âñå-òàêè íå ïîíèìàþ ÿ òàêîé ïîëèòèêè. Çà÷åì áëîêèðîâàòü áðóòåôîðñíèêîâ íà ïîëòîðû ìèíóòû ?! Èõ íàäî áëîêèðîâàòü íàâñåãäà èëè ïî êðàéíåé ìåðå íà ñåàíñ çàãðóçêè ðîóòåðà, ÷òî áû íå çàáèâàòü òàáëèöû.
Íàïðèìåð òàê:

iptables -N TESTBRUTE
iptables -N ATTACK
# Ñðàçó ïîñëå ïðàâèëà accept all via br0
iptables -I INPUT 5 -m recent --name attack --rcheck -j DROP


iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j TESTBRUTE
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -j TESTBRUTE
iptables -A INPUT -p tcp --dport 5190 -m state --state NEW -j TESTBRUTE

iptables -A TESTBRUTE -m recent --name test_brute --set
iptables -A TESTBRUTE -m recent --name test_brute --rcheck --seconds 300 --hitcount 10 -j ATTACK

iptables -A ATTACK -m recent --name attack --set
iptables -A ATTACK -j LOG --log-level info --log-prefix "ATTACKer blocked: "
iptables -A ATTACK -j DROP

Öåïî÷êà ATTACK îäíà, ñòàâèò ïðèçíàê áëîêèðîâêè.  ïîñëåäñòâèè îí ïðîâåðÿåòñÿ îäíèì ïðàâèëîì. Öåïî÷åê âðîäå TESTBRUTE ìîæåò áûòü íåñêîëüêî. Êàæäàÿ ñî ñâîèìè âõîæäåíèÿìè è ïåðèîäè÷íîñòüþ. Íàïðèìåð ìîæíî ñîçäàòü åùå äâå öåïî÷êè TESTSCAN äëÿ îòëàâëèâàíèÿ ñêàíèðîâàíèÿ well-known ïîðòîâ è TESTDOS äëÿ áëîêèðîâàíèÿ õîñòîâ, êîòîðûå çàïðàøèâàþò ñëèøêîì ìíîãî ñîåäèíåíèé çà êîðîòêèé ìîìåíò âðåìåíè.  èòîãå êàæäàÿ ïîäîáíàÿ öåïî÷êà ïåðåíàïðàâëÿåò ïðîâåðêó íà ATTACK, ãäå ìåòèòñÿ çàïàëèâøèéñÿ õîñò.

[ipkiller]

# Generated by iptables-save v1.2.7a on Wed Oct 15 12:43:29 2008
*nat
:PREROUTING ACCEPT [9799:1158353]
:POSTROUTING ACCEPT [5282:316636]
:OUTPUT ACCEPT [5366:335654]
:VSERVER - [0:0]
-A PREROUTING -d <ïóáëè÷íûé ip>-j VSERVER 
-A PREROUTING -d 10.5.82.222 -j VSERVER 
-A POSTROUTING -s ! <ïóáëè÷íûé ip> -o ppp0 -j MASQUERADE 
-A POSTROUTING -s ! 10.5.82.222 -o vlan1 -j MASQUERADE 
-A POSTROUTING -s 11.11.11.0/255.255.255.0 -d 11.11.11.0/255.255.255.0 -o br0 -j MASQUERADE 
-A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 11.11.11.1:80 
-A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22 
COMMIT
# Completed on Wed Oct 15 12:43:29 2008
# Generated by iptables-save v1.2.7a on Wed Oct 15 12:43:29 2008
*mangle
:PREROUTING ACCEPT [110889:20661480]
:INPUT ACCEPT [92465:15470718]
:FORWARD ACCEPT [9625:4123963]
:OUTPUT ACCEPT [94071:20055008]
:POSTROUTING ACCEPT [130447:34088972]
COMMIT
# Completed on Wed Oct 15 12:43:29 2008
# Generated by iptables-save v1.2.7a on Wed Oct 15 12:43:29 2008
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [224:10720]
:OUTPUT ACCEPT [94040:20043813]
:MACS - [0:0]
:SECURITY - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A INPUT -m state --state INVALID -j logdrop 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i lo -m state --state NEW -j ACCEPT 
-A INPUT -i br0 -m state --state NEW -j ACCEPT 
-A INPUT -i ppp0 -m state --state NEW -j SECURITY 
-A INPUT -d 11.11.11.1 -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -j logdrop 
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT 
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT 
-A FORWARD -i br0 -o br0 -j ACCEPT 
-A FORWARD -m state --state INVALID -j logdrop 
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j TCPMSS --clamp-mss-to-pmtu 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i ! br0 -o ppp0 -j logdrop 
-A FORWARD -i ! br0 -o vlan1 -j logdrop 
-A FORWARD -i ! br0 -m state --state NEW -j SECURITY 
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT 
-A FORWARD -o br0 -j logdrop 
-A SECURITY -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN 
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN 
-A SECURITY -p udp -m limit --limit 5/sec -j RETURN 
-A SECURITY -p icmp -m limit --limit 5/sec -j RETURN 
-A SECURITY -j logdrop 
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options 
-A logaccept -j ACCEPT 
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options 
-A logdrop -j DROP 
COMMIT
# Completed on Wed Oct 15 12:43:29 2008

À âîîáùå, ìåíÿ íåñêîëüêî óäèâëÿåò, íàñêîëüêî....

õì, à ïî÷åìó?! îíäå äåëàåò ïðîáðîñ íà ëîêàëüíûé èï, à èç ëîêàëêè ðàáîòàòå....
-A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 11.11.11.1:80
òîæå ñàìîå... ïåðåáðàñûâàåò ñ ðåàëüíèêà íà âíóòðåíèé
à âîò 22-é ïîðò ïî÷åìó òî äðîïèòñÿ
-A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22

[al37919]

-A INPUT -j logdrop
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT

íó è ÷åãî ìû õî÷åì --- ñíà÷àëà logdrop âñåãî, à ïîòîì ðàçðåøàåì õîäèòü íà ïîðò 22. Òóäà õîäèòü òî óæå íå÷åìó...

[Power]

õì, à ïî÷åìó?! îíäå äåëàåò ïðîáðîñ íà ëîêàëüíûé èï, à èç ëîêàëêè ðàáîòàòå....
-A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 11.11.11.1:80
òîæå ñàìîå... ïåðåáðàñûâàåò ñ ðåàëüíèêà íà âíóòðåíèé
à âîò 22-é ïîðò ïî÷åìó òî äðîïèòñÿ
-A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22

Îáúÿñíÿþ. Òîò ôàêò, ÷òî ïàêåò ïðîø¸ë ÷åðåç ïðåîáðàçîâàíèå àäðåñà íàçíà÷åíèÿ (DNAT, ýòî òî, ÷òî äåëàåò Virtual Server) â òàáëèöå nat, âîâñå íå îçíà÷àåò, ÷òî îí ñìîæåò ïðîéòè ÷åðåç öåïî÷êó INPUT (òóäà íàïðàâëÿþòñÿ ïàêåòû, ïðåäíàçíà÷åííûå ñàìîìó ðîóòåðó) òàáëèöû filter.  öåïî÷êå FORWARD (÷åðåç êîòîðóþ ïðîõîäÿò "òðàíçèòíûå" ïàêåòû) åñòü ïðàâèëî -A FORWARD -m conntrack --ctstate DNAT -j ACCEPT, êîòîðîå êàê ðàç è ïðîïóñêàåò ïàêåòû, êîòîðûå ïðîøëè DNAT (êñòàòè, íàñòðàèâàåòñÿ â ñåêöèè "WAN to LAN Filter", ïîëå Port Forwarding default policy), è ïîýòîìó äëÿ ëîêàëüíîé ñåòè ýòî ðàáîòàåò, à äëÿ ñàìîãî ðîóòåðà - íåò.

Êîíêðåòíî äëÿ âàøåãî ñëó÷àÿ, âñ¸ óæå îïèñûâàëîñü. ïðåæäå ÷åì äîáàâëÿòü ïðàâèëî â INPUT, íóæíî ñíà÷àëà óäàëèòü ïîñëåäíåå ïðàâèëî îòòóäà (-A INPUT -j logdrop), òàê êàê îíî ñáðàñûâàåò âñå ïàêåòû è äàëüøå îíè íå èäóò.

iptables -D INPUT -j logdrop
iptables -A INPUT -p tcp --syn --dport 22 -j ACCEPT
iptables -A INPUT -j logdrop

îòêðîåò âàø 22 ïîðò.

È -A VSERVER -p tcp -m tcp --dport 22 -j DNAT --to-destination 11.11.11.1:22 íå íóæíî.

[ipkiller]

ÎÃÐÎÌÍÎÅ Ñïàñèáî çà ðàçúÿñíåíèÿ....
è çà ïîìîùü,
âñå çàðàáîòàëî....