{"id":73,"date":"2010-03-30T19:57:42","date_gmt":"2010-03-30T17:57:42","guid":{"rendered":"http:\/\/antynet.pl\/word\/?p=73"},"modified":"2010-08-24T21:10:22","modified_gmt":"2010-08-24T19:10:22","slug":"hak-na-bruteforce-ssh-blacklist","status":"publish","type":"post","link":"https:\/\/www.antynet.pl\/index.php\/2010\/03\/30\/hak-na-bruteforce-ssh-blacklist\/","title":{"rendered":"Hak na bruteforce – SSH blacklist"},"content":{"rendered":"

Bruteforce na SSH to strasznie irytuj\u0105ca plaga, szanse na udane w\u0142amanie s\u0105 niewielkie gdy admin dba o serwer.
\nJednak\u017ce wiecznie za\u015bmiecone logi i sam fakt … no krew zalewa.
\nOpisa\u0142em ju\u017c wcze\u015bniej metod\u0119 opart\u0105 o haslimit, dzia\u0142a dobrze ale… dzi\u015b dodamy jeszcze jedno rozwi\u0105zanie.<\/p>\n

Powsta\u0142 fajny projekt, sshbl.org – (the SSH blacklist), co 15 minut tworzona jest czarna lista adres\u00f3w IP z kt\u00f3rych przeprowadzane s\u0105 ataki.
\nW prosty spos\u00f3b wykorzystamy t\u0105 list\u0119.<\/p>\n

mkdir \/etc\/ssh-brute
\ncd \/etc\/ssh-brute
\ntouch ssh.brute
\nchmod +x ssh.brute<\/p>\n

w plik ssh.brute umieszczamy zawarto\u015b\u0107:<\/p>\n

————————————————————————————————–
\n#!\/bin\/bash<\/p>\n

PATH=”\/bin:\/sbin:\/usr\/bin:\/usr\/sbin:\/usr\/local\/bin:\/usr\/local\/sbin”<\/p>\n

adresy=`cat \/tmp\/ipki | grep [0-9] | grep -v „#”`
\nfor x in $adresy
\ndo
\niptables -D INPUT -s $x -j DROP
\ndone<\/p>\n

wget\u00a0http:\/\/www.sshbl.org\/lists\/base.txt<\/a> -O \/tmp\/ipki<\/p>\n

adresy=`cat \/tmp\/ipki | grep [0-9] | grep -v „#”`
\nfor x in $adresy
\ndo
\niptables -I INPUT -s $x -j DROP
\ndone
\n————————————————————————————————–<\/p>\n

Teraz do crona dodamy wywo\u0142anie skryptu:
\n*\/15 * * * * root \/etc\/ssh-brute\/ssh.brute &>\/dev\/null<\/p>\n

Powodzenia \ud83d\ude09<\/p>\n

Update:<\/p>\n

Kilka maszyn szala\u0142o przy dodaniu kolejnych paru tysi\u0119cy wpis\u00f3w w iptables. Dlatego te\u017c pomy\u015bla\u0142em o innej metodzie blokowania listy host\u00f3w z sshbl.org.
\nPad\u0142o na routing.<\/p>\n

Gotowy skrypt:
\n######################################<\/p>\n

#!\/bin\/bash<\/p>\n

PATH=”\/bin:\/sbin:\/usr\/bin:\/usr\/sbin:\/usr\/local\/bin:\/usr\/local\/sbin”<\/p>\n

rm \/tmp\/ipki
\nwget -q\u00a0http:\/\/www.sshbl.org\/lists\/base.txt<\/a> -O \/tmp\/ipki<\/p>\n

adresy=`route -n | grep \\!H | awk '{print $1}’`
\nfor x in $adresy
\ndo
\nroute del -host $x reject
\ndone<\/p>\n

adresy=`cat \/tmp\/ipki | grep [0-9] | grep -v „#”`
\nfor x in $adresy
\ndo
\nroute add -host $x reject
\ndone<\/p>\n

###########################################<\/p>\n

Dzia\u0142a wy\u015bmienicie \ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"

Bruteforce na SSH to strasznie irytuj\u0105ca plaga, szanse na udane w\u0142amanie s\u0105 niewielkie gdy admin dba o serwer. Jednak\u017ce wiecznie za\u015bmiecone logi i sam fakt … no krew zalewa. Opisa\u0142em ju\u017c wcze\u015bniej metod\u0119 opart\u0105 o haslimit, dzia\u0142a dobrze ale… dzi\u015b dodamy jeszcze jedno rozwi\u0105zanie. Powsta\u0142 fajny projekt, sshbl.org – (the SSH blacklist), co 15 minut […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[6,4],"tags":[],"class_list":["post-73","post","type-post","status-publish","format-standard","hentry","category-iptables","category-sciaga-admina"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/73","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=73"}],"version-history":[{"count":2,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/73\/revisions"}],"predecessor-version":[{"id":89,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/73\/revisions\/89"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=73"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=73"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=73"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}