Remote ssh access

[flanker]

 ïðåäûäóùåì ñîîáùåíèè âñå íå ïîìåñòèëîñü, ïðîäîëæó â ýòîì.

post-firewall âûãëÿäèò òàê:

#!/bin/sh

PATH=/sbin:/bin:/usr/sbin:usr/bin:/opt/sbin:/opt/bin:/opt/local/bin

logger "post-firewall started"

#this rule can be uncommented for the testing period
#iptables -A INPUT -p tcp --syn --dport 2222 -j ACCEPT

# set default policy
iptables -P INPUT DROP

# remove last default rule
iptables -D INPUT -j DROP

# ***ssh subsection begin***
SSH_PORT=12345
SSH_ALLOW=/usr/local/etc/ssh.allow
SSH_DENY=/usr/local/etc/ssh.deny

# Create a new SSH_EVAL chain which will evaluate incoming connections to ssh server from WAN
iptables -N SSH_EVAL

# Transfer all ssh connections to the SSH_EVAL chain
iptables -A INPUT -p tcp --dport $SSH_PORT -j SSH_EVAL

# Evaluate incoming ssh connections through ssh.allow and ssh.deny lists
for i in `awk '{print $1}' $SSH_ALLOW`
do
    iptables -A SSH_EVAL -p tcp --syn -s $i --dport $SSH_PORT -j ACCEPT
done
for i in `awk '{print $1}' $SSH_DENY`
do
    iptables -A SSH_EVAL -p tcp --syn -s $i --dport $SSH_PORT -j DROP
done

# Block annoying intruder's attemtps (after --hitcount connections occured, wait --seconds after the last connection attempt)
# Remember, that both successful and unsuccessful connections are counted
iptables -A SSH_EVAL -i ! $3 -p tcp -m state --state NEW --dport $SSH_PORT -m recent --set --name SSH_ATTACKER --rsource
iptables -A SSH_EVAL -i ! $3 -p tcp -m state --state NEW --dport $SSH_PORT -m recent --update --seconds 600 --hitcount 4 --name SSH_ATTACKER --rsource -j DROP

# Accept the rest of ssh connections which were able to pass through the filtering
iptables -A SSH_EVAL -p tcp --syn --dport $SSH_PORT -j ACCEPT
# ***ssh subsection end*** 

# Low PPTP speed fix
iptables -t nat -nvL POSTROUTING | grep MASQUERADE | awk '{
    "ifconfig "$7" | grep Mask" | getline ip;
    split(ip,ip,":"); split(ip[2],ip," ");
    split($8,src,"!");
    if (src[1]=="") {src="! -s "src[2]} else {src="-s "src[1]};
    if ($9=="0.0.0.0/0") {dst=""} else {dst="-d "$9};
    system("iptables -t nat -A POSTROUTING -o "$7" "src" "dst" -j SNAT --to-source "ip[1]);
    system("iptables -t nat -D POSTROUTING -o "$7" "src" "dst" -j MASQUERADE");
}'

Ñîáñòâåííî, ìåíÿ íå íàïðÿãàåò îòñóòñòâèå â ëîãàõ IP-àäðåñà àòàêóþùåãî. Íî äëÿ ïîëíîòû êàðòèíû íå ïîìåøàåò. Òåì áîëåå, ÷òî ðàíüøå âñå ðàáîòàëî. Ê òîìó æå, âîçìîæíî, ýòî ÿâëÿåòñÿ ïðèçíàêîì íåïðàâèëüíûõ íàñòðîåê â iptables èëè åùå ãäå.

Íå ïîäñêàæóò ëè óâàæàåìûå çíàòîêè, ãäå êîïàòü? Åñëè âîïðîñ óæå îáñóæäàëñÿ, ïîäñêàæèòå, ïîæàëóéñòà, ãäå ñìîòðåòü, ñàì íå íàøåë.