Áåçîïàñíîñòü SSH (dropbear)

**sergeich** · 26-10-2008, 10:48

Originally Posted by vectorm

Ïóòü äî sftp ïîëíîñòüþ óêàçàí?

Äà, ñïàñèáî, ÿ ðàçîáðàëñÿ. Íå õâàòàëî ôàéëà libcrypto.so.0.9.7 â ïàïêå lib
Áåç íåãî íå çàïóñêàëñÿ, õîòÿ íà ôîðóìå ïðî÷èòàë, ÷òî äîñòàòî÷íî òîëüêî ôàéëà ñàìîãî ñåðâåðà sftp-server

**GDR** · 12-01-2009, 12:03

Íå çàïóñêàåòñÿ sftp-server. ß òàê ïîíèìàþ åãî äîëæåí çàïóñêàòü dropbear? Ñàì dropbear ó ìåíÿ åñòü â ñïèñêå ïðîöåñîâ, à sftp-server - íåò. Ïðè ðó÷íîì çàïóñêå sftp-server îí îòâàëèâàåòñÿ ïî òàéìàóòó. Â ÷åì ìîæåò áûòü äåëî?

Code:

[admin@WL500G root]$ ipkg  list_installed | grep ssh
openssh-sftp-server - 5.1p1-1 - sftp-server only from a FREE version of the SSH protocol suite of network connectivity tools.

[admin@WL500G root]$ ipkg files openssh-sftp-server 
Package openssh-sftp-server (5.1p1-1) is installed on /opt/ and has the following files:
/opt/libexec/sftp-server

Successfully terminated.
[admin@WL500G root]$ ls -al /opt/libexec/
drwxr-xr-x    3 admin    root         4096 Jan 12 14:40 .
drwxr-xr-x   16 admin    root         4096 Jan 12 15:48 ..
drwxr-xr-x    2 admin    root         4096 Jan 12 11:44 awk
-rwxrwxr-x    1 admin    root        64356 Jul 23 04:06 sftp-server

[admin@WL500G root]$ ps ax
  PID TTY      STAT   TIME COMMAND
    1 ?        S      0:01 /sbin/init
    2 ?        S      0:00 [keventd]
    3 ?        SN     0:02 [ksoftirqd_CPU0]
    4 ?        S      0:00 [kswapd]
    5 ?        S      0:00 [bdflush]
    6 ?        S      0:00 [kupdated]
    7 ?        S      0:00 [mtdblockd]
   60 ?        S      0:00 telnetd
   65 ?        S      0:00 httpd vlan1
   68 ?        S      0:00 syslogd -m 0 -O /tmp/syslog.log -S -l 7
   71 ?        S      0:00 klogd
   76 ?        S      0:00 [dnsmasq]
   78 ?        S      0:00 [khubd]
   88 ?        Ss     0:00 waveservermain
   90 ?        Ss     0:00 rcamdmain
   96 ?        S      0:00 [usb-storage-0]
   97 ?        S      0:00 [scsi_eh_0]
  109 ?        Ss     0:00 watchdog
  112 ?        Ss     0:00 ntp
  119 ?        S      0:00 dropbear -p 443
  125 ?        S      0:00 upnp -D -L br0 -W vlan1
  129 ?        S      0:00 [kjournald]
  132 ?        Ss     0:00 /usr/sbin/vsftpd
  152 ?        Ss     0:00 dropbear -p 443
  153 pts/0    Ss     0:00 -sh
  160 pts/0    R+     0:00 ps ax

[admin@WL500G root]$ cat /usr/local/sbin/post-mount
#!/bin/sh

#mount drives
/bin/mount -o sync,noatime,rw /dev/discs/disc0/disc /opt

#enable swap
/sbin/mkswap /opt/swap.file > /dev/null 2>&1
/sbin/swapon /opt/swap.file

[admin@WL500G root]$ cat /usr/local/sbin/post-firewall
#!/bin/sh
iptables -P INPUT DROP
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --syn --dport 443 -j ACCEPT

[admin@WL500G root]$ cat /usr/local/sbin/post-boot
#!/bin/sh
dropbear -p 443 > /dev/null 2>&1

**GDR** · 12-01-2009, 13:52

Îêàçàëîñü ñàì äóðàê. Ïðîöåññ sftp-server ïîÿâëÿåòñÿ, êîãäà ïîïûòàåøñÿ ñîåäèíèòüñÿ ñ ñåðâåðîì íàïðèìåð èç WinSPC. Â îáû÷íîì ñîñòîÿíèè åãî â ñïèñêå íå áóäåò.

WinSPC - êëàññíàÿ øòóêà.

**the** · 04-02-2009, 15:03

Ïîäñêàæèòå çàîäíî, ïîæàëóéòà

Åñëè ìíå íóæíî ñõîäèòü èç ïîä ðîóòåðà ïî ïðîòîêîëó sftp íà äðóãîé âíåøíèé àäðåñ, òî êàêèì êëèåíòîì (êàêîé êîìàíäîé) ýòî ìîæíî ñäåëàòü?

Â òåëíåòå ó ìåíÿ íåïîëó÷èëîñü èñïîëüçîâàòü wget äëÿ ýòîãî, ïîëàãàþ îí êóøàåò òîëüêî îáû÷íûé ftp.

È êîìàíäû ftp è sftp ðîóòåð ïðèçíàâàòü îòêàçûâàåòñÿ (openssh-sftp-server íå óñòàíàâëèâàë).

Ïîä âèíäàìè ÿ ïîíèìàþ ýòî äåëàåòñÿ ñ ïîìîùüþ òóëçû psftp, à âîò êàê èç ïîä ðîóòåðà?

**al37919** · 04-02-2009, 15:17

sftp --- âõîäèò â êîìïëåêò ïîëíîãî openssh

**qqq1971** · 31-01-2009, 12:46

Âîò òàêèå ëîãè âåñü äåíü:

Jan 31 15:36:05 vsftpd[5493]: CONNECT: Client "122.116.180.110"
Jan 31 15:36:06 vsftpd[5492]: [linux] FAIL LOGIN: Client "122.116.180.110"
Jan 31 15:36:07 vsftpd[5492]: [linux] FAIL LOGIN: Client "122.116.180.110"
Jan 31 15:36:09 vsftpd[5492]: [linux] FAIL LOGIN: Client "122.116.180.110"
Jan 31 15:36:11 vsftpd[5495]: CONNECT: Client "122.116.180.110"
Jan 31 15:36:12 vsftpd[5494]: [linux] FAIL LOGIN: Client "122.116.180.110"
Jan 31 15:36:14 vsftpd[5494]: [linux] FAIL LOGIN: Client "122.116.180.110"
Jan 31 15:36:16 vsftpd[5494]: [linux] FAIL LOGIN: Client "122.116.180.110"

Âîïðîñ â òîì êàê íà ðàáîòàþùåì ðîóòåðå çàêðûòü ïîðò 21 íà äîñòóï èçâíå. Îñòàíàâëèâàòü è ïåðåãðóæàòü î÷åíü íå õî÷åòñÿ.

Ïðîøèâêà Îëåãà ïîñëåäíÿÿ.

**qqq1971** · 31-01-2009, 12:58

Ïîêà ñîâñåì çàêðûë äîñòóï ïî 21 ïîðòó:

iptables -I INPUT -p tcp --dport 21 -j DROP

Êàê çàêðûòü äîñòóï òîëüêî èçâíå?

**ABATAPA** · 05-03-2009, 19:38

Originally Posted by qqq1971

Ïîêà ñîâñåì çàêðûë äîñòóï ïî 21 ïîðòó:

iptables -I INPUT -p tcp --dport 21 -j DROP

Êàê çàêðûòü äîñòóï òîëüêî èçâíå?

iptables -I INPUT -p tcp -i \! br0 --dport 21 -j DROP

**cipipi** · 31-01-2009, 13:07

Âàì ïîìîæåò vsftpd c ïîääåðæêîé tcpwrappers:
http://wl500g.info/showpost.php?p=119458&postcount=132

Â ôàéëå hosts.allow ïðîïèñàòü ñòðî÷êó

Code:

vsftpd: 122.116.180.110: DENY

Åñëè ÿ íå îøèáàþñü..

Åñëè âàì íóæíî, ÷òîá äîñòóï èìåëè òîëüêî ëîêàëüíûå ïîëüçîâàòåëè, òî
ïðîïèøèòå â êîíôèãå vsftpd ÿâíûì îáðàçîì

Code:

listen_address=âíóòðåííèé IP ðîóòåðà

è óäàëèòå âñå ïðàâèëà êàñàåìî DNAT ïî 21 ïîðòó â iptables.

**cipipi** · 31-01-2009, 13:12

Åñëè âû ðàáîòàåòå c ÔÒÏ ÷åðåç âåá ìîðäó, òî ïðåäïîëîæó, ÷òî íàäî ñäåëàòü òàê
USB application/FTP sever/Enable FTP Server: Yes, LAN only

**qqq1971** · 31-01-2009, 13:18

Ñïàñèáî çà áûñòðûé îòâåò.

Ó ìåíÿ ftp èç ïðîøèâêè ðàáîòàåò, íåëüçÿ ëè îáîéòèñü áåç óñòàíîâêè äðóãîé âåðñèè vsftpd? Êàê íèáóäü íà óðîâíå iptables ðàçðåøèòü äîñòóï íà ftp äëÿ âíóòðåííåé ñåòè è çàïðåòèòü äëÿ âíåøíåé?

Êñòàòè, îøèáñÿ. Ïðîøèâêà îò ôîðóìíûõ ðàçðàáîò÷èêîâ 10-d7.

**qqq1971** · 31-01-2009, 13:20

Àààà, ñïàñèáî!!!

ß ýòîò ñïèñîê è íå îòêðûâàë íè ðàçó, äóìàë òàì îïöèé òîëüêî Äà è Íåò.

**AlekseyM** · 05-03-2009, 19:17

Originally Posted by qqq1971

Ñïàñèáî çà áûñòðûé îòâåò.

Ó ìåíÿ ftp èç ïðîøèâêè ðàáîòàåò, íåëüçÿ ëè îáîéòèñü áåç óñòàíîâêè äðóãîé âåðñèè vsftpd? Êàê íèáóäü íà óðîâíå iptables ðàçðåøèòü äîñòóï íà ftp äëÿ âíóòðåííåé ñåòè è çàïðåòèòü äëÿ âíåøíåé?

Êñòàòè, îøèáñÿ. Ïðîøèâêà îò ôîðóìíûõ ðàçðàáîò÷èêîâ 10-d7.

ðåøèëîñü äî óæàñà ïðîñòî - äîáàâèë â ïóíêò Virtual Server List
21 ïîðò ñ âíóòðåíèì àäðåñîì ðîóòåðà, íà ïðîòîêîë TCP âñ¸ ðàáîòàåò!

**theMIROn** · 05-03-2009, 19:35

âîñïîëüçóéòåñü ïðîøèâêîé 1.9.2.7-d èç ïîäïèñè.
òàì âñòðîåíà âîçìîæíîñòü îãðàíè÷èòü êîëè÷åñòâî ïîïûòîê ïîäêëþ÷åíèé â òå÷åíèè îïðåäåëåííîãî ïåðèîäà âðåìåíè

**mixazen** · 07-02-2009, 10:07

wl500gpv2 ñ 10îé ïðîøèâêîé Îëåãîâñêîé (çà ÷òî ñïàñèáî îãðîìíîå) êðóòèëîñü ñâÿçêà: WD 1tb ext3+linux swap rtorrent+ados+mt-daapd+u-share+vnstat

ïîñëå ñáðîñà â äåôîëò, ïðîïàë SSH ïóñêàåò ïî òåëíåò è åñëè ÿ ñìîòðþ ls /opt/ ãîâîðèò êàòàëîã ïóñòîé, çàõîæó ïî ñàìáå è âèæó /opt/etc è âñå ñòàðûå

êàê ìîæíî ïîäíÿò ñòàðûå êîíôèãè, ïî ñóòè ïîñëå ñáðîñà çàòåðëàñü òîëüêî ïàìÿòü ðîóòåðà - à íà æåñòêîì âñå îñòàëîñü
ÊÀÊ ÏÐÎÙÅ ÏÎÄÍßÒÜ ÂÑÅ ÍÀÑÒÐÎÉÊÈ?
èëè ïðèäåòñÿ ïîäûìàòü âñå çàíîâî, ñïàñèáî?

Thread: Áåçîïàñíîñòü SSH (dropbear)

Thread Tools

Rate This Thread

Display

Hybrid View

Òàêàÿ æå ïðîáëåìà

Âîïðîñ ñíÿò

sftp êëèåíò áåç óñòàíîâêè sftp-server

Ïîìîãèòå èçáàâèòüñÿ îò ëîìàëüùèêîâ ftp... (ñðî÷íî)

ïîñëå ñáðîñà â äåôîëò, ïðîïàë SSH

Similar Threads

Âíèìàíèå! Áåçîïàñíîñòü Linux-based MIPSel ðîóòåðîâ!

Tags for this Thread

Posting Permissions