Áåçîïàñíîñòü SSH (dropbear)

**seeker** · 18-01-2007, 14:13

Originally Posted by alexnik

Code:

 25  1428 DROP       tcp  --  vlan1  any     anywhere             anywhere            state NEW tcp dpt:22 recent: UPDATE seconds: 600 hit_count: 3 name: SSH_ATTACKER side: source

Èíòåðåñóåò íàëè÷èå òàêîé ñòðî÷êè, ïîä÷åðêíóòûé èíòåðôåéñ è òèï ñîåäèíåíèÿ

ñîåäèíåíèå vpn - ppp0. âîò ÷òî ãîâîðèò

Code:

    0     0 DROP       tcp  --  ppp0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: UPDATE seconds: 600 hit_count: 3 name: SS
H_ATTACKER side: source

íóæíî ÷òî áû çàùèòà ðàáîòàëà ñî ñòîðîíû wan íåçàâèñèìî îò òîãî, àòàêóþò ëè èç íåòà ÷åðåç âïí èëè èç ëîêàëêè ñî âíåøíåé ñòîðîíû.

**alexnik** · 18-01-2007, 16:10

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

**seeker** · 18-01-2007, 16:16

Originally Posted by alexnik

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

à ÷òî îçíà÷àåò $3?

**midya** · 18-01-2007, 18:23

Originally Posted by seeker

à ÷òî îçíà÷àåò $3?

Ýòî ñêîëüêî Âû çàäîëæàëè ôîðóìó çà ñîâåòû=)))

**seeker** · 18-01-2007, 18:40

Originally Posted by alexnik

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

â ðåçóëüòàòå ýòèõ ñòðîê ssh òåïåðü âñåãäà ïîñûëàåò ìåíÿ

äàæå ñ ëàíà

**alexnik** · 19-01-2007, 09:17

Originally Posted by seeker

à ÷òî îçíà÷àåò $3?

$3 ýòî lan èíòåðôåéñ, äîëæíî ïîäñòàâèòüñÿ br0.

â ðåçóëüòàòå ýòèõ ñòðîê ssh òåïåðü âñåãäà ïîñûëàåò ìåíÿ äàæå ñ ëàíà

íà 22 ïîðò?

**seeker** · 19-01-2007, 21:07

Originally Posted by alexnik

ïðîùå âñåãî ñäåëàòü òàê

Code:

iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

âîáùåì äîáàâëåíèå äàííûõ ñòðî÷åê íå ïîìîãëî - êîííåêòèòñÿ ïûòàòüñÿ ìîæíî ñêîëüêî óãîäíî ñ âàíà.
âîò ÷òî ãîâîðèò
iptables -L -v | grep SSH_ATTACKER

Code:

    0     0 DROP       tcp  --  !br0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: UPDATE seconds: 600 hit_count: 3 name: SS
H_ATTACKER side: source
    0     0            tcp  --  !br0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: SET name: SSH_ATTACKER side: source

**black_128** · 19-01-2007, 21:44

Ñäåëàéòå ïðîùå:
---

#!/bin/sh
## WEB,SSH and FTP access from WAN
## Set default policy
iptables -P INPUT DROP
## Removes last default rule
iptables -D INPUT -j DROP
## Open FTP,SSH,WWW ports
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --syn --dport 22 -j brute_force
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
## Block SSH brute force attacks
iptables -N brute_force
iptables -F brute_force
iptables -A brute_force -m state --state NEW -m recent --name attack --set
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -m limit --limit 1/minute --limit-burst 1 -j LOG --log-prefix 'SSH brute force attack'
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -j DROP
iptables -A brute_force -j ACCEPT
## Drop other IPs
iptables -A INPUT -j DROP
#Test for post-firewall.log
echo "post-firewall running...">/var/log/post-firewall.log

**alexnik** · 20-01-2007, 14:50

Originally Posted by seeker

âîáùåì äîáàâëåíèå äàííûõ ñòðî÷åê íå ïîìîãëî - êîííåêòèòñÿ ïûòàòüñÿ ìîæíî ñêîëüêî óãîäíî ñ âàíà.
âîò ÷òî ãîâîðèò
iptables -L -v | grep SSH_ATTACKER

Code:

    0     0 DROP       tcp  --  !br0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: UPDATE seconds: 600 hit_count: 3 name: SS
H_ATTACKER side: source
    0     0            tcp  --  !br0   any     anywhere             anywhere
       state NEW tcp dpt:https recent: SET name: SSH_ATTACKER side: source

À ïåðåíàïðàâëàåøü 1555 ÷åðåç ïðåðîóòèíã? åñëè äà òîãäà ïîðò äîëæåí áûòü ïîðò äëÿ ïðàâèë äîëæåí áûòü 22.

**alexnik** · 20-01-2007, 14:56

Originally Posted by black_128

Ñäåëàéòå ïðîùå:
---

#!/bin/sh
## WEB,SSH and FTP access from WAN
## Set default policy
iptables -P INPUT DROP
## Removes last default rule
iptables -D INPUT -j DROP
## Open FTP,SSH,WWW ports
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --syn --dport 22 -j brute_force
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
## Block SSH brute force attacks
iptables -N brute_force
iptables -F brute_force
iptables -A brute_force -m state --state NEW -m recent --name attack --set
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -m limit --limit 1/minute --limit-burst 1 -j LOG --log-prefix 'SSH brute force attack'
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -j DROP
iptables -A brute_force -j ACCEPT
## Drop other IPs
iptables -A INPUT -j DROP
#Test for post-firewall.log
echo "post-firewall running...">/var/log/post-firewall.log

ýòî òîæå ñàìîå, ÷òî îáñóæäàåòñÿ. òîëüêî â öåïî÷êå ñðàçó çàäàåòñÿ âñå. È íàðóæó îòêðûâàåòñÿ 22 ïîðò.
Êñòàòè, åñëè êòî-òî õî÷åò ëîãèðîâàòü îòâåðãíóòûå ïîïûòêè, ðåêîìåíäóþ íå èñïîëüçîâàòü logdrop, à âçÿòü ïðàâèëî ñ îãðàíè÷åíèåì ëîãà, êàê â êîäå. Ëîã íå òàê ðàçáóõàòü áóäåò.

**seeker** · 20-01-2007, 18:34

Originally Posted by alexnik

À ïåðåíàïðàâëàåøü 1555 ÷åðåç ïðåðîóòèíã? åñëè äà òîãäà ïîðò äîëæåí áûòü ïîðò äëÿ ïðàâèë äîëæåí áûòü 22.

âîò post-firewall

Code:

iptables -D INPUT -j DROP
iptables -A INPUT -p tcp -m tcp -d 192.168.1.1 --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 1555 -j DNAT --to-destination 192.168.1.1:22
iptables -A INPUT -j DROP
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --set --name SSH_ATTACKER --rsource
iptables -I INPUT -i ! $3 -p tcp -m state --state NEW --dport 1555 -m recent --update --seconds 600 --hitcount 3 --name SSH_ATTACKER --rsource -j DROP

ïðîáîâàë ìåíÿòü ïîñëåäíèå äâå ñòðî÷êè - âìåñòî 1555 ïîñòàâèë 22 è ïåðåçàïóñòèë ðîóòåð - ïî êðàéíåé ìåðå ñ ëàíà ïóñêàåò ñêîêà óãîäíî òàêæå, èñî ñòîðîíû âàíà ïîêà ïðîâåðèòü íå ìîãó

.

**GearST** · 21-01-2007, 03:04

ÿ âîò âñå ñëåæó çà òåìîé êîãäà æå íàðîä íàéäåò îïòèìàëüíîå ðåøåíèå =)
íî âñåæå çàõîòåë ðàçîáðàòüñÿ ÷òî åñòü ýòî? :

Code:

## Open FTP,SSH,WWW ports
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --syn --dport 22 -j brute_force
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
## Block SSH brute force attacks
iptables -N brute_force
iptables -F brute_force
iptables -A brute_force -m state --state NEW -m recent --name attack --set
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -m limit --limit 1/minute --limit-burst 1 -j LOG --log-prefix 'SSH brute force attack'
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -j DROP
iptables -A brute_force -j ACCEPT
## Drop other IPs
iptables -A INPUT -j DROP

êîíêðåòíî êàê ðàáîòàåò ## Block SSH brute force attacks ÷òî òàì ñîáñòâåííî çàäàåòñÿ òî, à òî êîíåøíî ìîæíî òóïî âïèñàòü è íå ïàðèòüñÿ íî õîòåëîñü áû çíàòü êàê îíî ðàáîòàåò =)

**black_128** · 21-01-2007, 14:21

×òîáû ðàñøèôðîâàòü ÷òî è êàê ðàáîòàåò, ïîñìîòðèòå îïèñàíèå êîììàíäû iptables â èíòåðíåòå.

×òî êàñàåòñÿ ñòðî÷åê ##Block brute force, òî äàííûå èíñòðóêöèè áëîêèðóþò âõîäÿùèå îáðàùåíèÿ, ñ ÷àñòîòîé áîëüøå 4-õ â òå÷åíèè îäíîé ìèíóòû. Áëîêèðóåòñÿ îòïðàâèòåëü òàêæå íà îäíó ìèíóòó.

Ýòî ïîçâîëèò îòñåèòü ìàññó ðîáîòîâ.

**alexnik** · 22-01-2007, 15:54

Originally Posted by seeker

ïðîáîâàë ìåíÿòü ïîñëåäíèå äâå ñòðî÷êè - âìåñòî 1555 ïîñòàâèë 22 è ïåðåçàïóñòèë ðîóòåð - ïî êðàéíåé ìåðå ñ ëàíà ïóñêàåò ñêîêà óãîäíî òàêæå, èñî ñòîðîíû âàíà ïîêà ïðîâåðèòü íå ìîãó

.

íó ñî ñòîðîíû ëàíà òîæå ìîæíî ïðîâåðèòü óáðàâ -i ! $3.

GearST
Â îáùåì åñòü match recent êîòîðûé ïîçâîëÿåò ìàðêèðîâàòü ïàêåòû.

--rcheck --seconds x --hitcount y

ïðîâåðÿåò çà èíòåðâàë âðåìåíè x íàëè÷èå y ïàêåòîâ è â ñëó÷àå óñïåõà âûïîëíÿåò äåéñòâèå. ñîîòâåòñâåíî çà ïðîìåæóòîê âðåìåíè ïðîïóñêàåòñÿ y-1 ìàðêèðîâàíûé ïàêåò ïàêåò.

**black_128** · 22-01-2007, 20:07

Äîáðîãî âðåìåíè ñóòîê!
Ðåáÿòà, ñ íåäàâíåãî âðåìåíè âîçíèêëû íåêèå âîïðîñû ïî íåïîíÿòíîìó ïîâåäåíèþ ðîóòåðà. Ðîóòåð ðàáîòàåò ïðåêðàñíî ñ ñåòüþ netbynet.ru, ðàáîòàåò SAMBA, dropbear, ftp è WWW. Äîìàøíÿÿ ñåòü ñîñòîèò èç 2õ êîìïüþòåðîâ - íîóòáóêà âî WiFi è ñèñòåìíèêà ïî Ethernet êàáåëþ.

Ïîñëå óñòàíîâêè SSH (dropbear) è îòêðûòèþ ïîðòà 22 íàðóæó (òåëíåò îòêëþ÷¸í ðàç 22é îòêðûò), íà÷àëè ëîìèòüñÿ è áðóòôîðñèòü 22é ïîðò - íó äà ëàäíî, ÿ ñäåëàë post-firewall:

Code:

#!/bin/sh
## WEB,SSH and FTP access from WAN
## Set default policy
iptables -P INPUT DROP
## Removes last default rule
iptables -D INPUT -j DROP
## Open FTP,SSH,WWW ports
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --syn --dport 22 -j brute_force
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
## Block SSH brute force attacks
iptables -N brute_force
iptables -F brute_force
iptables -A brute_force -m state --state NEW -m recent --name attack --set
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -m limit --limit 1/minute --limit-burst 1 -j LOG --log-prefix 'SSH brute force attack'
iptables -A brute_force -m recent --name attack --rcheck --seconds 60 --hitcount 4 -j DROP
iptables -A brute_force -j ACCEPT
## Drop other IPs
iptables -A INPUT -j DROP
#Test for post-firewall.log
echo "post-firewall running...">/var/log/post-firewall.log

Ëîìèòüñÿ íà 22é ïîðò ïåðåñòàëè. ÍÎ! ÿ çàìåòèë, ÷òî çàõîäÿ ïî SSH, äèðåêòîðèè ïîÿâèëèñü ìàññà ôàéëîâ ñ íàñòðîéêàìè, êîòîðûå ÿ íèêîãäà íå ïðîïèñûâàë ðó÷êàìè.
Âîò ñêðèíøîò ôàéëîâ:

Ïðè÷åì âíóòðè ñêàæåì ôàéëà filter_rules ìîæíî óâèäåòü ñëåäóþùåå:

Code:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:MACS - [0:0]
:SECURITY - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A SECURITY -p tcp --syn -m limit --limit 1/s -j RETURN
-A SECURITY -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j RETURN
-A SECURITY -p udp -m limit --limit 5/s -j RETURN
-A SECURITY -p icmp -m limit --limit 5/s -j RETURN
-A SECURITY -j DROP
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -i ppp0 -m state --state NEW -j SECURITY
-A INPUT -p tcp -m tcp -d 192.168.1.1 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7776 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7777 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -p tcp --syn -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -o ppp0 ! -i br0 -j DROP
-A FORWARD -o vlan1 ! -i br0 -j DROP
-A FORWARD ! -i br0 -m state --state NEW -j SECURITY
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A FORWARD -o br0 -j DROP
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP
COMMIT

Ïðè÷åì íèêàêèõ ïîðòîâ 7777 è 7776 ÿ íå çàäàâàë. È WEB êàìåðû ó ìåíÿ íåò.

Â ëîãå ñòàëè ïîÿâëÿòüñÿ ñîîáùåíèÿ (îáðàòèòå âíèìàíèå íà êîëè÷åñòâî ïîñëàííûé è ïðèíÿòûõ áàéò).

Code:

Jan 22 11:53:38 pppd[112]: Child process /usr/sbin/pptp 10.7.255.249 --nolaunchpppd (pid 443) terminated with signal 15
Jan 22 11:53:38 pppd[112]: Modem hangup
Jan 22 11:53:38 pppd[112]: Connection terminated.
Jan 22 11:53:38 pppd[112]: Connect time 59.0 minutes.
Jan 22 11:53:38 pppd[112]: Sent 19494331 bytes, received 215195095 bytes.
Jan 22 11:53:38 pppd[112]: Connect time 59.0 minutes.
Jan 22 11:53:38 pppd[112]: Sent 19494331 bytes, received 215195095 bytes.
Jan 22 11:53:38 pppd[112]: Exit.

Jan 22 04:54:39 pppd[112]: Starting link
Jan 22 04:54:39 pppd[112]: Serial connection established.
Jan 22 04:54:39 pppd[112]: Connect: ppp0 <--> /dev/pts/0
Jan 22 04:54:39 pptp[390]: anon log[main:pptp.c:267]: The synchronous pptp option is NOT activated 
Jan 22 04:54:39 pptp[393]: anon warn[route_add:pptp_callmgr.c:457]: route_add: not adding existing route
Jan 22 04:54:39 pptp[393]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 1 'Start-Control-Connection-Request' 
Jan 22 04:54:39 pptp[393]: anon log[ctrlp_disp:pptp_ctrl.c:732]: Received Start Control Connection Reply
Jan 22 04:54:39 pptp[393]: anon log[ctrlp_disp:pptp_ctrl.c:766]: Client connection established.
Jan 22 04:54:40 pptp[393]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 7 'Outgoing-Call-Request' 
Jan 22 04:54:40 pptp[393]: anon log[ctrlp_disp:pptp_ctrl.c:851]: Received Outgoing Call Reply.
Jan 22 04:54:40 pptp[393]: anon log[ctrlp_disp:pptp_ctrl.c:890]: Outgoing call established (call ID 0, peer's call ID 32768). 
Jan 22 04:54:40 pppd[112]: MPPE 128-bit stateless compression enabled
Jan 22 04:54:43 pppd[112]: Remote IP address changed to 192.168.254.10
Jan 22 04:54:43 PPTP: connect to ISP

Ïðè÷åì â ýòî âðåìÿ (ÿ çíàþ òî÷íî), êîìïüþòåðû â ëîêàëêå áûëè âûêëþ÷åíû. Ñêàæèòå, ìîæíî ëè ñî âñåì ýòèì ðàçîáðàòüñÿ, è ÷òî äåëàòü???

Ïðîøó Âàñ ïðîòåñòèðîâàòü ìîþ ñèñòåìó íà ïðåäìåò óÿçâèìîñòåé, è ïîìî÷ü çàêðûòü îò àòàê ìîé ðîóòåð.

ÑÏÈÑÈÁÎ!

Thread: Áåçîïàñíîñòü SSH (dropbear)

Thread Tools

Rate This Thread

Display

Õàêåðû âçëîìàëè ðîóòåð? Ïîñìîòðèì ëîãè...

Similar Threads

Âíèìàíèå! Áåçîïàñíîñòü Linux-based MIPSel ðîóòåðîâ!

Tags for this Thread

Posting Permissions