Remote ssh access

**BORODA(C)** · 09-11-2007, 09:38

Originally Posted by Mam(O)n

Íàäåþñü post-firewall íå â âåíäå(äîïóñòèì â áëîêíîòå) ïðàâèë?

À ÷òî, îò 0D0A ó Þíèêñà êðûøà ïîåäåò?

**Dmitry** · 09-11-2007, 09:53

Originally Posted by BORODA(C)

À ÷òî, îò 0D0A ó Þíèêñà êðûøà ïîåäåò?

Èìåííî òàê è ïðîèñõîäèò.
Îí ÷èòàåò ïåðâóþ ñòðîêó â ñêðèïòå â êà÷åñòâå èíòåðïðåòàòîðà, è íå íàõîäèò /bin/sh<0D>

**BORODA(C)** · 09-11-2007, 10:18

Originally Posted by Dmitry

Èìåííî òàê è ïðîèñõîäèò.
Îí ÷èòàåò ïåðâóþ ñòðîêó â ñêðèïòå â êà÷åñòâå èíòåðïðåòàòîðà, è íå íàõîäèò /bin/sh<0D>

Oleg,
ìîæåò òîãäà â êîä sh (õîòÿ ÿ äóìàþ, ÷òî ýòî fopen() â libc) ââåñòè ïîïðàâêó íà êîíåö ñòðîêè 0D or 0D0A? Âåäü íå âñå íà âèíäàõ FAR`îì ïîëüçóþòñÿ.

**Reyter** · 09-11-2007, 10:36

Originally Posted by BORODA(C)

Oleg,
ìîæåò òîãäà â êîä sh (õîòÿ ÿ äóìàþ, ÷òî ýòî fopen() â libc) ââåñòè ïîïðàâêó íà êîíåö ñòðîêè 0D or 0D0A? Âåäü íå âñå íà âèíäàõ FAR`îì ïîëüçóþòñÿ.

Î êàê... À ìîæåò âñå-òàêè ïðîùå FAR óñòàíîâèòü ÷åì ëèíóêñ ïàò÷èòü?

**gsnake** · 09-11-2007, 13:37

Originally Posted by Mam(O)n

Åñëè áû áûëî ñäåëàíî, êàê ÿ íàïèñàë, òî â post-firewall áûëî áû:

Code:

#!/bin/sh
iptables -I INPUT -p tcp --dport xxxx -j ACCEPT

ãäå xxxx - íîìåð ïîðòà. Èëè ýòî â êîíåö ïîñò-ôàéðâîëà äîáàâèëîñü áû. Ãëàâíîå, ÷òîá ïåðâàÿ ñòðî÷êà - #!/bin/sh. Âûâîä iptables -L INPUT -vn áûë áû òàêèì:

Code:

$ iptables -L INPUT -vn
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 3061  291K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:xxxx 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID
 187K   17M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED, ESTABLISHED
16687 1001K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0          state NEW
96672   35M ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0          state NEW
 4537 1650K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          udp spt:67 dpt:68
  245  139K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

ãäå xxxx - íîìåð ïîðòà. Íàäåþñü post-firewall íå â âåíäå(äîïóñòèì â áëîêíîòå) ïðàâèë?

Íà äàííîì ýòàïå èíòåðåñíû âûâîäû êîìàíä:
cat /usr/local/sbin/post-firewall
ls -la /usr/local/sbin/

âîò âûâîäû:
cat /usr/local/sbin/post-firewall
#!/bin/sh
iptables -I INPUT -p tcp --dport xxxx -j ACCEPT

ls -la /usr/local/sbin/
drwxr-xr-x 1 gxxxx root 0 Oct 31 13:39 .
drwxr-xr-x 1 gxxxx root 0 Dec 31 1999 ..
-rwxr-xr-x 1 gxxxx root 142 Nov 8 16:19 post-boot
-rwxr-xr-x 1 gxxxx root 58 Nov 9 02:06 post-firewall

âñå âðîäå ïðàâèëüíî..

**gsnake** · 09-11-2007, 13:39

Originally Posted by Reyter

Î êàê... À ìîæåò âñå-òàêè ïðîùå FAR óñòàíîâèòü ÷åì ëèíóêñ ïàò÷èòü?

âñå ââåäåíî FARîì, èëè VI-åì

**Reyter** · 09-11-2007, 13:53

Originally Posted by gsnake

cat /usr/local/sbin/post-firewall
#!/bin/sh
iptables -I INPUT -p tcp --dport xxxx -j ACCEPT

ls -la /usr/local/sbin/
drwxr-xr-x 1 gxxxx root 0 Oct 31 13:39 .
drwxr-xr-x 1 gxxxx root 0 Dec 31 1999 ..
-rwxr-xr-x 1 gxxxx root 142 Nov 8 16:19 post-boot
-rwxr-xr-x 1 gxxxx root 58 Nov 9 02:06 post-firewall

âñå âðîäå ïðàâèëüíî..

Òàê... Âîïðîñ ìîæåò è ãëóïûé, íî âñå-òàêè...
Ðîóòåð ïîñëå ñîçäàíèÿ è ñîõðàíåíèÿ post-firewall ïåðåãðóæàëè?
Ëèáî - âðó÷íóþ post-firewall çàïóñêàòü ïðîáîâàëè?
Ëèáî - âðó÷íóþ ââåñòè â øåëëå iptables -I INPUT -p tcp --dport xxxx -j ACCEPT ïðîáîâàëè?

**gsnake** · 09-11-2007, 14:35

Originally Posted by Reyter

Òàê... Âîïðîñ ìîæåò è ãëóïûé, íî âñå-òàêè...
Ðîóòåð ïîñëå ñîçäàíèÿ è ñîõðàíåíèÿ post-firewall ïåðåãðóæàëè?
Ëèáî - âðó÷íóþ post-firewall çàïóñêàòü ïðîáîâàëè?
Ëèáî - âðó÷íóþ ââåñòè â øåëëå iptables -I INPUT -p tcp --dport xxxx -j ACCEPT ïðîáîâàëè?

äà - êîíå÷íî. âûïîëíèë âñå 3 êîìàíäû flashfs save, commit and enable. ïîòîì reboot.
âðó÷íóþ post-firewall çàïóñêàòü íå ïðîáîâàë.. íî ÿ æå ñ ëîêàëêè ìîãó íà ïîðò õõõõ çàéòè ïîñëå òîãî êàê âñå çàïóñêàþ. åñëè ÿ íîìåð ïîðòà ïîìåíÿþ òî ñîîòâåòñâåííî è íà äðóãîé ïîðò çàõîæó. òî åñòü ñòàíäàòíûé 22-îé êîíå÷íî íå ðàáîòàåò, à õõõõ (êîòîðûé óêàçàí â post-firewall è post-boot) ïðèíèìàåò âûçîâû.. ìîæåò ïîðò íå ñàìûé ëó÷øèé âûáðàë?
ÿ èñïîëüçóþ 4662

gsnake

**BORODA(C)** · 09-11-2007, 14:48

Êàê óçíàòü, çàãðóæàëñÿ ëè /usr/local/sbin/post-firewall ? Ñåé ôàêò â ëîãàõ äîëæåí îòðàçèòüñÿ?

À íåò ëè ÷åãî â post-boot, ÷òî ïåðåáèâàåò post-firewall?..

**gsnake** · 09-11-2007, 15:17

Originally Posted by BORODA(C)

Êàê óçíàòü, çàãðóæàëñÿ ëè /usr/local/sbin/post-firewall ? Ñåé ôàêò â ëîãàõ äîëæåí îòðàçèòüñÿ?

À íåò ëè ÷åãî â post-boot, ÷òî ïåðåáèâàåò post-firewall?..

в post-boot только команда на старт dropbear..

**al37919** · 09-11-2007, 16:35

ÿ æå ñ ëîêàëêè ìîãó íà ïîðò õõõõ çàéòè ïîñëå òîãî êàê âñå çàïóñêàþ.

Ýòî íå àðãóìåíò. Äëÿ òîãî, ÷òîáû çàéòè ñ ëîêàëêè îòêðûâàòü âîîáùå íè÷åãî íå íàäî. Ôàéðâîëë âèñèò íà WAN. Íà ìîé âçãëÿä êîïàòü íàäî ïî âîïðîñó çàïóñêàåòñÿ ëè post-firewall, à åñëè íåò, òî ïî÷åìó. Â ñâÿçè ñ ýòèì ïðåäëàãàþ:

Êàê óçíàòü, çàãðóæàëñÿ ëè /usr/local/sbin/post-firewall ? Ñåé ôàêò â ëîãàõ äîëæåí îòðàçèòüñÿ?

äîáàâèòü êîììàíäó, ñêàæåì:
logger "Executing post-firewall."

**gsnake** · 11-11-2007, 00:29

Originally Posted by al37919

Ýòî íå àðãóìåíò. Äëÿ òîãî, ÷òîáû çàéòè ñ ëîêàëêè îòêðûâàòü âîîáùå íè÷åãî íå íàäî. Ôàéðâîëë âèñèò íà WAN. Íà ìîé âçãëÿä êîïàòü íàäî ïî âîïðîñó çàïóñêàåòñÿ ëè post-firewall, à åñëè íåò, òî ïî÷åìó. Â ñâÿçè ñ ýòèì ïðåäëàãàþ:

äîáàâèòü êîììàíäó, ñêàæåì:
logger "Executing post-firewall."

äà - ñîãëàñåí. dropbear ìåíÿ ñ òîëêó ñáèë. îí æå íà ýòîì ïîðòó ðàáîòàåò è ïîýòîìó êîííåêò íà ýòîì ïîðòó åñòü à íà äðóãèõ íåò. òîðìîçíóë ÿ..
äîáàâèë logger. òåïåðü post-firewall âûãëÿäèò òàê

#!/bin/sh
logger starting the iptables command
iptables -I INPUT -p tcp --dport 4662 -j ACCEPT
logger iptables initialized

------
syslog.log:

Nov 10 13:14:22 xxxx: starting the iptables command
Nov 10 13:14:22 xxxx: iptables initialized

ïîïðîáîâàë äîáàâèòü åùå îäèí ïîðò. (ó îáîèõ dropbear è iptables) - íå ïîìîãëî.. êñòàòè âîò âûâîä òàêîé êîìàíäû

iptables -L |grep ACCEPT
Chain INPUT (policy ACCEPT)
ACCEPT tcp -- anywhere anywhere tcp dpt:4524
ACCEPT tcp -- anywhere anywhere tcp dpt:4662
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
Chain FORWARD (policy ACCEPT)
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere ctstate DNAT
Chain OUTPUT (policy ACCEPT)
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence
tcp-options ip-options prefix `ACCEPT '
ACCEPT all -- anywhere anywhere

**gsnake** · 12-11-2007, 20:58

Åñòü ïîäîçðåíèå ÷òî èíòåðíåò-ïðîâàéäåð çàêðûë âñå ïîðòû ñîâñåì íåäàâíî.

Õîòÿ ÿ ñëûøàë ÷òî ïîðò 1720 âñåãäà èì îòêðûò (äëÿ voice-over-ip). ß ïðîáîâàë íà ýòîì ïîðòó è òîæå áåç òîëêó..
Êàê ìîæíî âû÷èñëèòü ïîðòû, êîòîðûå íå çàáëîêèðîâàíû ïðîâàéäåðîì?

**Mam(O)n** · 12-11-2007, 21:43

Ìîæíî òàê:

Code:

# Ñîçäà¸ì êàòàëîã äëÿ âåá ñåðâåðà
mkdir -p /tmp/www
# Ñîçäà¸ì èíäåêñ ñòðàíèöó äëÿ ïðîâåðêè
echo "Preved!!" > /tmp/www/index.html
# Çàâîðà÷èâàåì âõîäÿùèé òðàôèê, ïðåäíàçíà÷åííûé ðîóòåðó ñî âñåõ ïîðòîâ íà ïîðò 81 ðîóòåðà
iptables -t nat -I PREROUTING -s ip_ñ_êîòîðîãî_áóäåò_èäòè_ñêàí -d èíòåðíåò_èï_àäðåñ_ðîóòåðà -p tcp -j DNAT --to lan_àäðåñ_ðîóòåðà:81
# Îòêðâàåì 81 ïîðò ðîóòåðà
iptables -I INPUT -p tcp --dport 81 -j ACCEPT
# Çàïóñêàåì âåá-ñåðâåð
busybox_httpd -p 81 -h /tmp/www

È ïîñëå (áåç ïåðåçàãðóçêè!) ñêàíèðóé ïîðòû ðîóòåðà ñ êàêîãî-íèáóäü õîñòà èç èíåòà.

**gsnake** · 13-11-2007, 03:15

Originally Posted by Mam(O)n

Ìîæíî òàê:

Code:

# Ñîçäà¸ì êàòàëîã äëÿ âåá ñåðâåðà
mkdir -p /tmp/www
# Ñîçäà¸ì èíäåêñ ñòðàíèöó äëÿ ïðîâåðêè
echo "Preved!!" > /tmp/www/index.html
# Çàâîðà÷èâàåì âõîäÿùèé òðàôèê, ïðåäíàçíà÷åííûé ðîóòåðó ñî âñåõ ïîðòîâ íà ïîðò 81 ðîóòåðà
iptables -t nat -I PREROUTING -s ip_ñ_êîòîðîãî_áóäåò_èäòè_ñêàí -d èíòåðíåò_èï_àäðåñ_ðîóòåðà -p tcp -j DNAT --to lan_àäðåñ_ðîóòåðà:81
# Îòêðâàåì 81 ïîðò ðîóòåðà
iptables -I INPUT -p tcp --dport 81 -j ACCEPT
# Çàïóñêàåì âåá-ñåðâåð
busybox_httpd -p 81 -h /tmp/www

È ïîñëå (áåç ïåðåçàãðóçêè!) ñêàíèðóé ïîðòû ðîóòåðà ñ êàêîãî-íèáóäü õîñòà èç èíåòà.

Mam(O)n,
ñóïåð! Íàêîíåö-òî ðàçîáðàëñÿ, îãðîìíîå ñïàñèáî!!!
Ãð..ûé ïðîâàéäåð çàêðûë âñå ïîðòû, êðîìå 8080, 443, 21, 22, 8000. Åùå íåäàâíî âñå áûëî íîðìàëüíî.
Êîðî÷å - âñå íàñòðîèë è ìîãó çàéòè ñ ðàáîòû. Âîïðîñ - êàê ñäåëàòü îãðàíè÷åííîå êîëè÷åñòâî ïîïûòîê âõîäà? ß ïûòàëñÿ èñêàòü è íàøåë âîò ýòî
----
äîáàâèòü â post-boot ñòðî÷êó â êîíöå
Êîä:

insmod ipt_recent

á) äîáàâèòü â post-firewall äâå ñòðî÷êè â êîíöå
Êîä:

iptables -t nat -I PREROUTING -i $1 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i $1 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

ãäå 1555 - ïîðò ssh
-----
íî ïî÷åìó-òî íè÷åãî íå ðàáîòàåò..
gsnake

Thread: Remote ssh access

Thread Tools

Rate This Thread

Display

Similar Threads

Enable Web Access from WAN? YES-NO. Ðàáîòàåò ëè çàùèòà?

Ïðîáëåìû ñ RAdmin è Remote Desktop

[HowTo]Aria2 Torrent, FTP, HTTP mit Remote Control

Can't access my firmware

Access to NAS in LAN from WAN

Tags for this Thread

Posting Permissions