Új hozzászólás Aktív témák

• #25902 vargalex Topikgazda sto1911 #25900

  Új Válasz 2012-04-25 15:46:16 #25902

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  vargalex

  Topikgazda

  válasz sto1911 #25900 üzenetére

  Hi!

  Ja, hogy leszedted a dropbear-t. Akkor a remove törölte, ugyanis az scp a dropbear csomag része:

  root@OpenWrt:~# opkg files dropbear
  Package dropbear (2011.54-2) is installed on root and has the following files:
  /usr/bin/dbclient
  /usr/bin/scp
  /etc/dropbear/dropbear_rsa_host_key
  /etc/init.d/dropbear
  /usr/bin/dropbearkey
  /etc/config/dropbear
  /etc/dropbear/dropbear_dss_host_key
  /usr/sbin/dropbear
  /usr/bin/ssh

  iptables-save nincs. A /etc/config/firewall-ban tudod config-olni a tűzfalat, illetve a /etc/firewall.user-ben tudsz saját iptables parancsokat írni. Az 1.1-es build-emben így néz ki:

  /etc/config/firewall:

  config defaults
  option syn_flood 1
  option input ACCEPT
  option output ACCEPT
  option forward REJECT
  # Uncomment this line to disable ipv6 rules
  # option disable_ipv6 1
  
  config zone
  option name lan
  option network 'lan'
  option input ACCEPT
  option output ACCEPT
  option forward REJECT
  
  config zone
  option name wan
  option network 'wan'
  option input DROP
  option output ACCEPT
  option forward REJECT
  option masq 1
  option mtu_fix 1
  
  config forwarding
  option src lan
  option dest wan
  
  # We need to accept udp packets on port 68,
  # see https://dev.openwrt.org/ticket/4108
  config rule
  option src wan
  option proto udp
  option dest_port 68
  option target ACCEPT
  option family ipv4
  
  # Allow IPv4 ping
  config rule
  option src wan
  option proto icmp
  option icmp_type echo-request
  option family ipv4
  option target ACCEPT
  
  # Allow DHCPv6 replies
  # see https://dev.openwrt.org/ticket/10381
  config rule
  option src wan
  option proto udp
  option src_ip fe80::/10
  option src_port 547
  option dest_ip fe80::/10
  option dest_port 546
  option family ipv6
  option target ACCEPT
  
  # Allow essential incoming IPv6 ICMP traffic
  config rule
  option src wan
  option proto icmp
  list icmp_type echo-request
  list icmp_type destination-unreachable
  list icmp_type packet-too-big
  list icmp_type time-exceeded
  list icmp_type bad-header
  list icmp_type unknown-header-type
  list icmp_type router-solicitation
  list icmp_type neighbour-solicitation
  option limit 1000/sec
  option family ipv6
  option target ACCEPT
  
  # Allow essential forwarded IPv6 ICMP traffic
  config rule
  option src wan
  option dest *
  option proto icmp
  list icmp_type echo-request
  list icmp_type destination-unreachable
  list icmp_type packet-too-big
  list icmp_type time-exceeded
  list icmp_type bad-header
  list icmp_type unknown-header-type
  option limit 1000/sec
  option family ipv6
  option target ACCEPT
  
  # include a file with users custom iptables rules
  config include
  option path /etc/firewall.user
  
  config 'rule' 'transmission_web'
  option 'target' 'ACCEPT'
  option '_name' 'transmission_web'
  option 'src' 'wan'
  option 'proto' 'tcp'
  option 'dest_port' '9091'
  
  config 'rule'
  option 'target' 'ACCEPT'
  option '_name' 'ssh_WAN'
  option 'src' 'wan'
  option 'proto' 'tcp'
  option 'dest_ip' '192.168.1.1'
  option 'dest_port' '22'
  
  config 'rule'
  option 'target' 'ACCEPT'
  option '_name' 'ftp_WAN'
  option 'src' 'wan'
  option 'proto' 'tcp'
  option 'dest_ip' '192.168.1.1'
  option 'dest_port' '21'
  
  config 'rule'
  option 'target' 'ACCEPT'
  option '_name' 'Transmission'
  option 'src' 'wan'
  option 'proto' 'tcpudp'
  option 'dest_port' '21234'
  
  config 'rule'
  option 'target' 'ACCEPT'
  option '_name' 'Luci_HTTPS'
  option 'src' 'wan'
  option 'proto' 'tcp'
  option 'dest_port' '443'
  
  config rule
  option src 'lan'
  option name 'block_internet_access_IP'
  option src_ip '192.168.1.181'
  option target 'DROP'
  option dest 'wan'
  option extra '-m time --weekdays Mon,Tue,Wed,Thu,Fri --timestart 10:00 --timestop 22:00'
  option enabled '0'

  Ebből az utolsó rule-t ne tedd be, mert 10.03.1 alatt enabled opció biztos nincs, és az extra opcióban sem vagyok biztos, hogy lenne.

  /etc/firewall.user:

  # This file is interpreted as shell script.
  # Put your custom iptables rules here, they will
  # be executed with each firewall (re-)start.
  
  BRUTEFORCE_PROTECTION_START=3
  BRUTEFORCE_DROPPORT=55555
  PROTO=tcp
  ROUTERIP=$(uci get network.lan.ipaddr)
  
  ########################################
  #SSH Brute Force protection on port 2222
  PROTECTEDPORT=2222
  SERVICEPORT=22
  SERVICE=SSH
  
  echo Enabling Brute Force protection for $SERVICE on port $SERVICEPORT
  iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --set --name $SERVICE -j DNAT --to-destination $ROUTERIP:$SERVICEPORT
  iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --update --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j DNAT --to-destination $ROUTERIP:$BRUTEFORCE_DROPPORT
  iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --rcheck --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j LOG --log-prefix "BruteForce-${SERVICE} "
  ########################################
  
  ########################################
  #FTP Brute Force protection on port 2221
  PROTECTEDPORT=2221
  SERVICEPORT=21
  SERVICE=FTP
  
  echo Enabling Brute Force protection for $SERVICE on port $SERVICEPORT
  iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --set --name $SERVICE -j DNAT --to-destination $ROUTERIP:$SERVICEPORT
  iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --update --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j DNAT --to-destination $ROUTERIP:$BRUTEFORCE_DROPPORT
  iptables --table nat -I zone_wan_prerouting -p $PROTO --dport $PROTECTEDPORT -m state --state NEW -m recent --rcheck --seconds 60 --hitcount $BRUTEFORCE_PROTECTION_START --name $SERVICE -j LOG --log-prefix "BruteForce-${SERVICE} "
  ########################################
  
  ########################################
  #Block URL on certain time for specified IP
  #
  #URL_STRING=facebook.com
  #LOCAL_IP=192.168.1.188
  #TIME_START=10:00
  #TIME_END=16:00
  #
  #echo Blocking $URL_STRING from $LOCAL_IP at time interval $TIME_START - $TIME_END
  #iptables -I FORWARD -s $LOCAL_IP -m string --string $URL_STRING --algo bm -m time --weekdays Mon,Tue,Wed,Thu,Fri --timestart $TIME_START --timestop $TIME_END -j DROP
  ########################################

  Az idő alapú szűréshez viszont kell az iptables-mod-ipopt csomag.

  (#25901): Igen, ez a régi megoldás.

• #25901 sto1911 veterán sto1911 #25900

  Új Válasz 2012-04-25 15:03:45 #25901

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  sto1911

  veterán

  válasz sto1911 #25900 üzenetére

  Marmint a symlink nincs ott, de a META-fajlban ott a d scp bejegyzes.

Új hozzászólás Aktív témák