Dotaz: Pokusy o naruseni sluzeb

[Zdenek]

Dobry den provozuji malej linuxovej servrik na distru debian. pravidelne aktualizuju kdyz se vyskytne nejaka ta chybka. posledni dobou pozoruji nemylej jev v logu kde se par lidi, jedna se ted cca o 30 ip a sem tam nejaka pribude, pokousi pomoci nejakejch "robutku" pripojit na ssh ftp a dalsi veci .... neslo by tyto ip treba po 3 nebo treba 5 pokusech o pristup zablokovat nejak automaticky ? treba syslog vypada takto:(viz nize)

budu rad za jakoukoliv radu a diky

May 22 21:27:16 localhost proftpd[644]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:17 localhost proftpd[646]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:17 localhost proftpd[646]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:19 localhost last message repeated 2 times
May 22 21:27:19 localhost proftpd[646]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:20 localhost proftpd[648]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:21 localhost proftpd[648]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:22 localhost last message repeated 2 times
May 22 21:27:22 localhost proftpd[648]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:23 localhost proftpd[650]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:24 localhost proftpd[650]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:26 localhost last message repeated 2 times
May 22 21:27:26 localhost proftpd[650]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:26 localhost proftpd[652]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:27 localhost proftpd[652]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:29 localhost last message repeated 2 times
May 22 21:27:29 localhost proftpd[652]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:30 localhost proftpd[654]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:30 localhost proftpd[654]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:32 localhost last message repeated 2 times
May 22 21:27:32 localhost proftpd[654]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:33 localhost proftpd[656]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:34 localhost proftpd[656]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:35 localhost last message repeated 2 times
May 22 21:27:35 localhost proftpd[656]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:36 localhost proftpd[658]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:37 localhost proftpd[658]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:39 localhost last message repeated 2 times
May 22 21:27:39 localhost proftpd[658]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:40 localhost proftpd[660]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:40 localhost proftpd[660]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:42 localhost last message repeated 2 times
May 22 21:27:42 localhost proftpd[660]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session closed. 
May 22 21:27:43 localhost proftpd[662]: localhost.localdomain (211.93.13.131[211.93.13.131]) - FTP session opened. 
May 22 21:27:44 localhost proftpd[662]: localhost.localdomain (211.93.13.131[211.93.13.131]) - no such user 'Administrator' 
May 22 21:27:45 localhost last message repeated 2 times

Odpovědi

[temporary]

s uspechem jiz nejakou dobu pouzivam tento script: http://freshmeat.net/projects/blockhosts/. Navic jsem si k nemu dopsal jeste vlastni funkci, ktera veskere adresy nahazi do iptables.

[Zdenek]

mohl bych poprosit o ten upravenej skriptik pro inspiraci ? traba ne meil xah333*(zavinac)*seznam.cz jinak dik za typ

[temporary]

mno sem koukal ze sem to s tim slovem scriptik prehnal :]]]]
grep -e "^ALL" /etc/hosts.deny | awk '{ system("/usr/sbin/iptables -I INPUT -s " $2 " -j DROP")}'
nicmene jak jsem koukal tak existuji i sofistikovanejshi reseni viz. Michal Čihař predemnou podemnou

[Michal Čihař]

Třeba pomocí iptables můžeš omezit jak často se může někdo nový připojit. Pro ssh například max. 3 spojení za 60 sekund:

iptables -A inputchain -p tcp --dport ssh -m recent --update --hitcount 3 --seconds 60 --name SSH_PROBERS -j DROP
iptables -A inputchain -p tcp --dport ssh -m recent --set --name SSH_PROBERS -j ACCEPT

Pozor na nastavení, ať to neomezí normální uživatele.

[Zdenek]

no nevim nevim vyzkousel jsem ty tvoje pravidle presne tak jak jsi to to napsal(myslim ten limit) a spusobilo to to ze se na ssh zvenku zaboha nedostanu ani ja ... tem vecem mezi nebem a zemi nerozumim ...

[Michal Čihař]

No jestli si je opsal přesně, tak se přidaly do řetězce který asi vůbec nepoužíváš .

[Zdenek]

myslel jsem ten limit... takova lama zas nejsem ...

[ZAH]

Osobně doporučuji pam_abl

[Ondřej Čečák]

BTW: zvaz udelani poradku v hostname.