Áåçîïàñíîñòü SSH (dropbear)

**alexnik** · 17-01-2007, 14:01

Originally Posted by Mam(O)n

alexnik, ó ìåíÿ âîò òàê âîò ïîëó÷àåòñÿ:

Code:

[root@router /tmp]$ iptables -t nat -I PREROUTING -i ppp0 -p tcp -m state --state NEW --dport 22 -m recent --set --name SSH_ATTACKER --rsource
iptables: No chain/target/match by that name

Òû êàêèåíèáóäü ìîäóëè äîïîëíèòåëüíûå ê ÿäðó ïðèêðó÷èâàë?

Âñå â ïðîøèâêå åñòü, ïðîñòî ipt_recent íå çàïóøåí.
insmod ipt_recent òåáå ïîìîæåò.
Äëÿ èñïîëüçîâàíèÿ ïðàâèëà â post-firewall-å äîáàâèòü ýòó ñòðî÷êó â post-boot.
è çàìåíèòü $WAN íà $1

**Mam(O)n** · 17-01-2007, 14:27

alexnik, ñïàñèáî çà íàâîäêó. Ñàì íåäîãàäàëñÿ. Âñå ïðàâèëà ïðîïèñàëèñü

**seeker** · 17-01-2007, 14:34

Originally Posted by alexnik

Âñå â ïðîøèâêå åñòü, ïðîñòî ipt_recent íå çàïóøåí.
insmod ipt_recent òåáå ïîìîæåò.
Äëÿ èñïîëüçîâàíèÿ ïðàâèëà â post-firewall-å äîáàâèòü ýòó ñòðî÷êó â post-boot.
è çàìåíèòü $WAN íà $1

ÿ ïðàâèëüíî ïîíèìàþ, ÷òî íàäî
à) äîáàâèòü â post-boot ñòðî÷êó â êîíöå

Code:

insmod ipt_recent

á) äîáàâèòü â post-firewall äâå ñòðî÷êè â êîíöå

Code:

iptables -t nat -I PREROUTING -i $1 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i $1 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

ãäå 1555 - ïîðò ssh

×¸ òà íå ðàáîòàåò íèôèãà...

**alexnik** · 17-01-2007, 15:26

seeker
èìåííî òàê.
Âîçìîæíî íå òîò èíòåðôåéñ ïîäñòàâëÿåòñÿ â post-firewall-å.

Code:

 iptables -L -v | grep SSH_ATTACKER

÷òî ãîâîðèò?

**alexnik** · 17-01-2007, 15:32

Code:

 25  1428 DROP       tcp  --  vlan1  any     anywhere             anywhere            state NEW tcp dpt:22 recent: UPDATE seconds: 600 hit_count: 3 name: SSH_ATTACKER side: source

Èíòåðåñóåò íàëè÷èå òàêîé ñòðî÷êè, ïîä÷åðêíóòûé èíòåðôåéñ è òèï ñîåäèíåíèÿ

**seeker** · 18-01-2007, 14:13

Originally Posted by alexnik

Code:

 25  1428 DROP       tcp  --  vlan1  any     anywhere             anywhere            state NEW tcp dpt:22 recent: UPDATE seconds: 600 hit_count: 3 name: SSH_ATTACKER side: source

Èíòåðåñóåò íàëè÷èå òàêîé ñòðî÷êè, ïîä÷åðêíóòûé èíòåðôåéñ è òèï ñîåäèíåíèÿ

ñîåäèíåíèå vpn - ppp0. âîò ÷òî ãîâîðèò

Code:

    0     0 DROP       tcp  --  ppp0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: UPDATE seconds: 600 hit_count: 3 name: SS
H_ATTACKER side: source

íóæíî ÷òî áû çàùèòà ðàáîòàëà ñî ñòîðîíû wan íåçàâèñèìî îò òîãî, àòàêóþò ëè èç íåòà ÷åðåç âïí èëè èç ëîêàëêè ñî âíåøíåé ñòîðîíû.

**alexnik** · 18-01-2007, 16:10

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

**seeker** · 18-01-2007, 16:16

Originally Posted by alexnik

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

à ÷òî îçíà÷àåò $3?

**seeker** · 18-01-2007, 18:40

Originally Posted by alexnik

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

â ðåçóëüòàòå ýòèõ ñòðîê ssh òåïåðü âñåãäà ïîñûëàåò ìåíÿ

äàæå ñ ëàíà

**seeker** · 19-01-2007, 21:07

Originally Posted by alexnik

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

âîáùåì äîáàâëåíèå äàííûõ ñòðî÷åê íå ïîìîãëî - êîííåêòèòñÿ ïûòàòüñÿ ìîæíî ñêîëüêî óãîäíî ñ âàíà.
âîò ÷òî ãîâîðèò
iptables -L -v | grep SSH_ATTACKER

Code:

    0     0 DROP       tcp  --  !br0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: UPDATE seconds: 600 hit_count: 3 name: SS
H_ATTACKER side: source
    0     0            tcp  --  !br0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: SET name: SSH_ATTACKER side: source

**Mam(O)n** · 06-02-2007, 04:44

Originally Posted by alexnik

insmod ipt_recent òåáå ïîìîæåò.
Äëÿ èñïîëüçîâàíèÿ ïðàâèëà â post-firewall-å äîáàâèòü ýòó ñòðî÷êó â post-boot

Çàìåòèë, ÷òî ó ìåíÿ ïîñëå äîáàâëåíèÿ ýòîé ñòðîêè â êîíåö post-boot íå óñïåâàë ïîäãðóæàòüñÿ äàííûé ìîäóëü, ïðåæäå, ÷åì çàïóñòèòñÿ post-firewall, ïî ïðè÷èíå òîãî, ÷òî äî ýòîãî âûïîëíÿëîñü åùå ìíîãî ñòðîê bost-boot'à è â ñëåäñòâèå ÷åãî ïðàâèëà, îãðàíè÷èâàþùèå äîñòóï ê ssh íå ïðîïèñûâàëèñü. Áóäüòå âíèìàòåëüíû! Ëó÷øå "insmod ipt_recent" äîáàâèòü â pre-boot.

**shooter** · 08-02-2007, 22:26

Äëÿ óñèëåíèÿ ïàðàíîè ìîæíî ïîäíÿòü stunnel è òðåáîâàòü ïðîâåðêè ñåðòèôèêàòà íà ïîðòó, îòêðûâàåìîì ïîñëå ñõåìû ñ ñòóêîì ïî äîï. ïîðòàì. À èç stunnel ïî 127.0.0.1 íà 22 ïîðò.

À ñåðò ñ êëþ÷àìè íîñèòü ñ ñîáîé íà ÊÏÊ/ôëøêå.
Â ñëó÷àå ôëåøêè ðåãóëÿðíî âíîñèòü åãî â CRL ïîñëå èñïîëüçîâàíèÿ â òåìíîì ìåñòå è ãåíåðèðîâàòü íîâûé. =)

**imdex** · 08-02-2007, 22:42

Originally Posted by shooter

Äëÿ óñèëåíèÿ ïàðàíîè ìîæíî ïîäíÿòü stunnel è òðåáîâàòü ïðîâåðêè ñåðòèôèêàòà íà ïîðòó, îòêðûâàåìîì ïîñëå ñõåìû ñ ñòóêîì ïî äîï. ïîðòàì. À èç stunnel ïî 127.0.0.1 íà 22 ïîðò.

À ñåðò ñ êëþ÷àìè íîñèòü ñ ñîáîé íà ÊÏÊ/ôëøêå.
Â ñëó÷àå ôëåøêè ðåãóëÿðíî âíîñèòü åãî â CRL ïîñëå èñïîëüçîâàíèÿ â òåìíîì ìåñòå è ãåíåðèðîâàòü íîâûé. =)

Åñëè âû íå ïàðàíîèê, ýòî âîâñå íå çíà÷èò, ÷òî çà âàìè íå ñëåäÿò.

Thread: Áåçîïàñíîñòü SSH (dropbear)

Thread Tools

Rate This Thread

Display

Hybrid View

Similar Threads

Âíèìàíèå! Áåçîïàñíîñòü Linux-based MIPSel ðîóòåðîâ!

Tags for this Thread

Posting Permissions