Gå til innhold

forsøk på å få root-tilgang

petterg

Av petterg
i Operativsystemer

Anbefalte innlegg

kyrsjo

kyrsjo

Skrevet
Skrevet
Med det samme vi er i gang: Er det mulig å sette opp sshd slik at den *kun* tillater scp/sftp, men ikke shell? (bortsett fra et par brukere)

sett shell til /dev/null. men ikke på root da =)

Har tenkt på det... Problemet er at hele poenget er at folk skal kunne komme til hjemmekatalogen sin hjemmefra - hjemmekatalogen de logger inn i på skolen...

Lenke til kommentar

Videoannonse

Videoannonse
Annonse
petterg

petterg

Skrevet
  • Forfatter
Skrevet (endret)

Jeg har ikke prøvd selv, men leste en plass at man kan sette shell=/usr/lib/misc/sftp-server for å tilate kun sftp for en bruker.

Edit: Adressen er til der jeg har sftp-server programmet. Husker ikke hva som var default fra openssh sin side. Forskjellige distror har den på forskjellig sted.

Endret av petterg
Lenke til kommentar
kyrsjo

kyrsjo

Skrevet
Skrevet

*hack alert hack alert*

 

Hmm... Fristende å ha /bin/bash som symlink til /bin/nologin på en maskin...

 

eller i alle fall i en chroot... Eller noe slikt i alle fall...

 

Tingen er, normal bruk av arbeidsstasjoner må være tillatt, men de skal ikke få shell når de logger seg på hjemmefra.

 

mao. har jeg egentlig to muligheter:

1. en hack som inkluderer bla. annet chroot

2. la dem få shell hjemmefra... De får det jo uansett på skolen...

3. bruke gammaldags FTP.

Lenke til kommentar
petterg

petterg

Skrevet
  • Forfatter
Skrevet

om man vil blokere for ssh og alt som benytter ssh authentiseringen er det jeg bare å liste opp brukere/grupper man vil tilate / ikke tilate i en access pam modul datafil.

Har alle mine brukere (untatt wheel) i chroot. chroot patchen til openssh er helt genial. Har laget en guide på denne, søk på chrooted ssh på forumet - postet ca mars/april 2004. (Guiden trenger en oppdatering for å virke med openssh 3.8+ i kombinasjon med pam.)

 

Ftp har ulempen av å ikke kryptere passord!

Eneste som får logge inn på uten å kryptere passord på mine servere er wap - der brukes et selvutviklet authentiserings system, og kun brukere som er chrooted får lov å skru på wapaccess på kontoen sin.

Lenke til kommentar
Gjest Slettet+6132

Gjest Slettet+6132

Skrevet
Skrevet

At loggene dine viser forsøk på innlogginger til root, og til ikke-eksisterende brukere er ikke unormalt... Har milevis med logger som viser forsøk på å logge inn som root, og standardnavn som "john, michael, george" osv... Ordnet dette enkelt ved å redigere "Port 22" i /etc/sshd_config :thumbup:

Lenke til kommentar
pgdx

pgdx

Skrevet
Skrevet

Er det noen muligheter for å øke tiden mellom hvert forsøk på innlogging, da? Kjedelig med all denne loggingen:

Jan  2 21:38:33 audioserve sshd[11938]: Failed password for invalid user nobody from 194.242.112.40 port 58644 ssh2
Jan  2 21:38:34 audioserve sshd[11940]: Failed password for invalid user patrick from 194.242.112.40 port 58667 ssh2
Jan  2 21:38:35 audioserve sshd[11942]: Failed password for invalid user patrick from 194.242.112.40 port 58677 ssh2
Jan  2 21:38:36 audioserve sshd[11944]: Failed password for invalid user root from 194.242.112.40 port 58694 ssh2
Jan  2 21:38:37 audioserve sshd[11946]: Failed password for invalid user root from 194.242.112.40 port 58712 ssh2
Jan  2 21:38:38 audioserve sshd[11948]: Failed password for invalid user root from 194.242.112.40 port 58735 ssh2
Jan  2 21:38:39 audioserve sshd[11950]: Failed password for invalid user root from 194.242.112.40 port 58767 ssh2
Jan  2 21:38:40 audioserve sshd[11952]: Failed password for invalid user root from 194.242.112.40 port 58805 ssh2
Jan  2 21:38:41 audioserve sshd[11954]: Failed password for invalid user rolo from 194.242.112.40 port 58854 ssh2
Jan  2 21:38:41 audioserve sshd[11956]: Failed password for invalid user iceuser from 194.242.112.40 port 58883 ssh2
Jan  2 21:38:42 audioserve sshd[11958]: Failed password for invalid user horde from 194.242.112.40 port 58913 ssh2
Jan  2 21:38:43 audioserve sshd[11960]: Failed password for invalid user cyrus from 194.242.112.40 port 58950 ssh2
Jan  2 21:38:44 audioserve sshd[11962]: Failed password for invalid user www from 194.242.112.40 port 58988 ssh2
Jan  2 21:38:45 audioserve sshd[11964]: Failed password for invalid user wwwrun from 194.242.112.40 port 59028 ssh2
Jan  2 21:38:46 audioserve sshd[11966]: Failed password for invalid user matt from 194.242.112.40 port 59070 ssh2
Jan  2 21:38:46 audioserve sshd[11968]: Failed password for invalid user test from 194.242.112.40 port 59107 ssh2
Jan  2 21:38:47 audioserve sshd[11970]: Failed password for invalid user test from 194.242.112.40 port 59144 ssh2
Jan  2 21:38:48 audioserve sshd[11972]: Failed password for invalid user test from 194.242.112.40 port 59181 ssh2
Jan  2 21:38:49 audioserve sshd[11974]: Failed password for invalid user test from 194.242.112.40 port 59221 ssh2
Jan  2 21:38:50 audioserve sshd[11976]: Failed password for invalid user www-data from 194.242.112.40 port 59257 ssh2
Jan  2 21:38:51 audioserve sshd[11978]: Failed password for invalid user mysql from 194.242.112.40 port 59299 ssh2
Jan  2 21:38:51 audioserve sshd[11980]: Failed password for invalid user operator from 194.242.112.40 port 59337 ssh2
Jan  2 21:38:52 audioserve sshd[11982]: Failed password for invalid user adm from 194.242.112.40 port 59372 ssh2
Jan  2 21:38:53 audioserve sshd[11984]: Failed password for invalid user apache from 194.242.112.40 port 59413 ssh2
Jan  2 21:38:54 audioserve sshd[11986]: Failed password for invalid user irc from 194.242.112.40 port 59456 ssh2
Jan  2 21:38:55 audioserve sshd[11988]: Failed password for invalid user irc from 194.242.112.40 port 59503 ssh2
Jan  2 21:38:56 audioserve sshd[11990]: Failed password for invalid user adm from 194.242.112.40 port 59543 ssh2
Jan  2 21:38:56 audioserve sshd[11992]: Failed password for invalid user root from 194.242.112.40 port 59585 ssh2
Jan  2 21:38:57 audioserve sshd[11994]: Failed password for invalid user root from 194.242.112.40 port 59630 ssh2
Jan  2 21:38:59 audioserve sshd[11996]: Failed password for invalid user root from 194.242.112.40 port 59672 ssh2
Jan  2 21:38:59 audioserve sshd[11998]: Failed password for invalid user jane from 194.242.112.40 port 59723 ssh2
Jan  2 21:39:00 audioserve sshd[12000]: Failed password for invalid user pamela from 194.242.112.40 port 59756 ssh2
Jan  2 21:39:01 audioserve sshd[12002]: Failed password for invalid user root from 194.242.112.40 port 59797 ssh2
Jan  2 21:39:02 audioserve sshd[12004]: Failed password for invalid user root from 194.242.112.40 port 59846 ssh2
Jan  2 21:39:03 audioserve sshd[12006]: Failed password for invalid user root from 194.242.112.40 port 59895 ssh2
Jan  2 21:39:04 audioserve sshd[12008]: Failed password for invalid user root from 194.242.112.40 port 59939 ssh2
Jan  2 21:39:05 audioserve sshd[12010]: Failed password for invalid user root from 194.242.112.40 port 59981 ssh2
Jan  2 21:39:06 audioserve sshd[12012]: Failed password for invalid user cosmin from 194.242.112.40 port 60032 ssh2
Jan  2 21:39:07 audioserve sshd[12014]: Failed password for invalid user root from 194.242.112.40 port 60068 ssh2
Jan  2 21:39:07 audioserve sshd[12016]: Failed password for invalid user root from 194.242.112.40 port 60112 ssh2
Jan  2 21:39:08 audioserve sshd[12018]: Failed password for invalid user root from 194.242.112.40 port 60165 ssh2
Jan  2 21:39:09 audioserve sshd[12020]: Failed password for invalid user root from 194.242.112.40 port 60211 ssh2
Jan  2 21:39:10 audioserve sshd[12022]: Failed password for invalid user root from 194.242.112.40 port 60251 ssh2
Jan  2 21:39:11 audioserve sshd[12024]: Failed password for invalid user root from 194.242.112.40 port 60302 ssh2
Jan  2 21:39:12 audioserve sshd[12026]: Failed password for invalid user root from 194.242.112.40 port 60354 ssh2
Jan  2 21:39:13 audioserve sshd[12028]: Failed password for invalid user root from 194.242.112.40 port 60398 ssh2
Jan  2 21:39:14 audioserve sshd[12030]: Failed password for invalid user root from 194.242.112.40 port 60452 ssh2
Jan  2 21:39:15 audioserve sshd[12032]: Failed password for invalid user root from 194.242.112.40 port 60500 ssh2
Jan  2 21:39:16 audioserve sshd[12034]: Failed password for invalid user root from 194.242.112.40 port 60543 ssh2
Jan  2 21:39:17 audioserve sshd[12036]: Failed password for invalid user root from 194.242.112.40 port 60597 ssh2
Jan  2 21:39:18 audioserve sshd[12038]: Failed password for invalid user root from 194.242.112.40 port 60644 ssh2
Jan  2 21:39:19 audioserve sshd[12040]: Failed password for invalid user root from 194.242.112.40 port 60692 ssh2
Jan  2 21:39:20 audioserve sshd[12042]: Failed password for invalid user root from 194.242.112.40 port 60737 ssh2
Jan  2 21:39:20 audioserve sshd[12044]: Failed password for invalid user root from 194.242.112.40 port 60781 ssh2
Jan  2 21:39:21 audioserve sshd[12046]: Failed password for invalid user root from 194.242.112.40 port 60835 ssh2
Jan  2 21:39:22 audioserve sshd[12048]: Failed password for invalid user root from 194.242.112.40 port 60884 ssh2
Jan  2 21:39:23 audioserve sshd[12050]: Failed password for invalid user root from 194.242.112.40 port 60930 ssh2
Jan  2 21:39:24 audioserve sshd[12052]: Failed password for invalid user root from 194.242.112.40 port 60974 ssh2
Jan  2 21:39:25 audioserve sshd[12054]: Failed password for invalid user root from 194.242.112.40 port 32788 ssh2
Jan  2 21:39:26 audioserve sshd[12056]: Failed password for invalid user root from 194.242.112.40 port 32823 ssh2
Jan  2 21:39:27 audioserve sshd[12058]: Failed password for invalid user root from 194.242.112.40 port 32859 ssh2
Jan  2 21:39:28 audioserve sshd[12060]: Failed password for invalid user root from 194.242.112.40 port 32895 ssh2
Jan  2 21:39:29 audioserve sshd[12062]: Failed password for invalid user root from 194.242.112.40 port 32936 ssh2
Jan  2 21:39:30 audioserve sshd[12064]: Failed password for invalid user root from 194.242.112.40 port 32983 ssh2
Jan  2 21:39:31 audioserve sshd[12066]: Failed password for invalid user root from 194.242.112.40 port 33038 ssh2
Jan  2 21:39:32 audioserve sshd[12068]: Failed password for invalid user root from 194.242.112.40 port 33084 ssh2
Jan  2 21:39:33 audioserve sshd[12070]: Failed password for invalid user root from 194.242.112.40 port 33131 ssh2
Jan  2 21:39:34 audioserve sshd[12072]: Failed password for invalid user root from 194.242.112.40 port 33170 ssh2
Jan  2 21:39:35 audioserve sshd[12074]: Failed password for invalid user root from 194.242.112.40 port 33213 ssh2
Jan  2 21:39:35 audioserve sshd[12076]: Failed password for invalid user root from 194.242.112.40 port 33253 ssh2
Jan  2 21:39:36 audioserve sshd[12078]: Failed password for invalid user root from 194.242.112.40 port 33290 ssh2
Jan  2 21:39:37 audioserve sshd[12080]: Failed password for invalid user root from 194.242.112.40 port 33333 ssh2
Jan  2 21:39:38 audioserve sshd[12082]: Failed password for invalid user root from 194.242.112.40 port 33382 ssh2
Jan  2 21:39:40 audioserve sshd[12084]: Failed password for invalid user root from 194.242.112.40 port 33423 ssh2
Jan  2 21:39:41 audioserve sshd[12086]: Failed password for invalid user cip52 from 194.242.112.40 port 33491 ssh2
Jan  2 21:39:42 audioserve sshd[12088]: Failed password for invalid user cip51 from 194.242.112.40 port 33528 ssh2
Jan  2 21:39:43 audioserve sshd[12090]: Failed password for invalid user root from 194.242.112.40 port 33563 ssh2
Jan  2 21:39:43 audioserve sshd[12092]: Failed password for invalid user noc from 194.242.112.40 port 33597 ssh2
Jan  2 21:39:44 audioserve sshd[12094]: Failed password for invalid user root from 194.242.112.40 port 33633 ssh2
Jan  2 21:39:45 audioserve sshd[12096]: Failed password for invalid user root from 194.242.112.40 port 33675 ssh2
Jan  2 21:39:46 audioserve sshd[12098]: Failed password for invalid user root from 194.242.112.40 port 33718 ssh2
Jan  2 21:39:47 audioserve sshd[12100]: Failed password for invalid user root from 194.242.112.40 port 33754 ssh2
Jan  2 21:39:48 audioserve sshd[12102]: Failed password for invalid user webmaster from 194.242.112.40 port 33796 ssh2
Jan  2 21:39:49 audioserve sshd[12104]: Failed password for invalid user data from 194.242.112.40 port 33838 ssh2
Jan  2 21:39:49 audioserve sshd[12106]: Failed password for invalid user user from 194.242.112.40 port 33877 ssh2
Jan  2 21:39:50 audioserve sshd[12108]: Failed password for invalid user user from 194.242.112.40 port 33906 ssh2
Jan  2 21:39:51 audioserve sshd[12110]: Failed password for invalid user user from 194.242.112.40 port 33940 ssh2
Jan  2 21:39:52 audioserve sshd[12112]: Failed password for invalid user web from 194.242.112.40 port 33981 ssh2
Jan  2 21:39:53 audioserve sshd[12114]: Failed password for invalid user web from 194.242.112.40 port 34011 ssh2
Jan  2 21:39:54 audioserve sshd[12116]: Failed password for invalid user oracle from 194.242.112.40 port 34044 ssh2
Jan  2 21:39:54 audioserve sshd[12118]: Failed password for invalid user sybase from 194.242.112.40 port 34087 ssh2
Jan  2 21:39:55 audioserve sshd[12120]: Failed password for invalid user master from 194.242.112.40 port 34124 ssh2
Jan  2 21:39:56 audioserve sshd[12122]: Failed password for invalid user account from 194.242.112.40 port 34162 ssh2
Jan  2 21:39:57 audioserve sshd[12124]: Failed password for invalid user backup from 194.242.112.40 port 34193 ssh2
Jan  2 21:39:58 audioserve sshd[12126]: Failed password for invalid user server from 194.242.112.40 port 34229 ssh2
Jan  2 21:39:59 audioserve sshd[12128]: Failed password for invalid user adam from 194.242.112.40 port 34267 ssh2
Jan  2 21:39:59 audioserve sshd[12130]: Failed password for invalid user alan from 194.242.112.40 port 34301 ssh2
Jan  2 21:40:00 audioserve sshd[12132]: Failed password for invalid user frank from 194.242.112.40 port 34330 ssh2
Jan  2 21:40:01 audioserve sshd[12134]: Failed password for invalid user george from 194.242.112.40 port 34366 ssh2
Jan  2 21:40:02 audioserve sshd[12136]: Failed password for invalid user henry from 194.242.112.40 port 34395 ssh2
Jan  2 21:40:03 audioserve sshd[12138]: Failed password for invalid user john from 194.242.112.40 port 34423 ssh2
Jan  2 21:40:04 audioserve sshd[12140]: Failed password for invalid user root from 194.242.112.40 port 34454 ssh2
Jan  2 21:40:05 audioserve sshd[12142]: Failed password for invalid user root from 194.242.112.40 port 34491 ssh2
Jan  2 21:40:05 audioserve sshd[12144]: Failed password for invalid user root from 194.242.112.40 port 34530 ssh2
Jan  2 21:40:06 audioserve sshd[12146]: Failed password for invalid user root from 194.242.112.40 port 34566 ssh2
Jan  2 21:40:07 audioserve sshd[12148]: Failed password for invalid user root from 194.242.112.40 port 34606 ssh2
Jan  2 21:40:08 audioserve sshd[12150]: Failed password for invalid user test from 194.242.112.40 port 34647 ssh2
Jan  4 00:38:10 audioserve sshd[12996]: Failed password for invalid user test from 128.134.56.203 port 58880 ssh2
Jan  4 00:38:13 audioserve sshd[12998]: Failed password for invalid user guest from 128.134.56.203 port 59005 ssh2
Jan  4 00:38:16 audioserve sshd[13000]: Failed password for invalid user admin from 128.134.56.203 port 59089 ssh2
Jan  4 00:38:19 audioserve sshd[13002]: Failed password for invalid user admin from 128.134.56.203 port 59177 ssh2
Jan  4 00:38:22 audioserve sshd[13004]: Failed password for invalid user user from 128.134.56.203 port 59278 ssh2
Jan  4 00:38:26 audioserve sshd[13006]: Failed password for invalid user root from 128.134.56.203 port 59359 ssh2
Jan  4 00:38:30 audioserve sshd[13008]: Failed password for invalid user root from 128.134.56.203 port 59486 ssh2
Jan  4 00:38:33 audioserve sshd[13010]: Failed password for invalid user root from 128.134.56.203 port 59583 ssh2
Jan  4 00:38:36 audioserve sshd[13012]: Failed password for invalid user test from 128.134.56.203 port 59667 ssh2
Jan  6 03:25:01 audioserve sshd[5702]: Failed password for invalid user jordan from 213.197.199.205 port 42473 ssh2
Jan  6 03:25:02 audioserve sshd[5704]: Failed password for invalid user michael from 213.197.199.205 port 42480 ssh2
Jan  6 03:25:03 audioserve sshd[5706]: Failed password for invalid user nicole from 213.197.199.205 port 42488 ssh2
Jan  6 03:25:05 audioserve sshd[5708]: Failed password for invalid user daniel from 213.197.199.205 port 42496 ssh2
Jan  6 03:25:14 audioserve sshd[5710]: Failed password for invalid user andrew from 213.197.199.205 port 42549 ssh2
Jan  6 03:25:23 audioserve sshd[5712]: Failed password for invalid user nathan from 213.197.199.205 port 42574 ssh2
Jan  6 03:40:25 audioserve sshd[5717]: Failed password for invalid user nobody from 213.197.199.205 port 56776 ssh2

Lenke til kommentar
Manuel

Manuel

Skrevet
Skrevet (endret)
Er det noen muligheter for å øke tiden mellom hvert forsøk på innlogging, da? Kjedelig med all denne loggingen:

 

Hvis SSH bruker pam kan du endre på innstillingene der. Jeg har f.eks satt inn en pause på 10 sekunder når man skriver feil passord/brukernavn.

Endret av Manuel
Lenke til kommentar
petterg

petterg

Skrevet
  • Forfatter
Skrevet

Nå er jeg kvitt dette problemet på min server: Syslog trigger et script hver gang sshd, imapd-ssl eller smptd har noe å logge. Scriptet sjekker så raskt som mulig om det er innloggings relatert. Dersom det er en feilet logging trigges et annet script, og er det en suksessfull login trigges et tredje script.

Feilet login vil logge putte ip'n som innloggingen kom fra i en "attempt-list" med telleverk og tidspunkt. Telleverket har to tellere - En vil nullstille seg dersom det ikke kommer flere forsøk innen et kort tidsrom, en annen som gjør det samme, men etter et mye lenger tidsrom.

Når en av tellerene har passert en definert grense lages en regel i iptables som vil sette alle forbindelser med den gitte ip'n i en tarpit. (Vurderer å utvide slik at det også autogenereres en mail til abuse@ip's_isp når noen blir låst ute.)

Dersom det kommer en suksessfull login på en ip i "attempt-list" vil denne ip'n bli fjernet fra lista.

Hvor fort tellerene skal telle avhenger stilles individuelt for hver service.

 

De samme scriptene kjøres dersom det kommer http/https-request som innholder "cmd.exe" eller "root.exe"

 

Etter litt debugging (og en kjøretur på 6 mil for å nullstille iptables) ser det nå ut til å fungere.

Lenke til kommentar
petterg

petterg

Skrevet
  • Forfatter
Skrevet

Manuel: Skal legge ut script når jeg føler meg litt mer sikker på at det virker, og får satt sammen dokumentasjon nok til at folk klarer å instalere det.

 

Deange_net: Ja, klok av skade legger jeg alltid inn en cron job som skal tilbakestille iptables etter en stund dersom noe går galt i config, men her klarte jeg faktisk til å få iptables til å henge seg slik at jeg måtte kjøre kill på den! Mens den var i lås gikk absolutt alle nettverksforbindelser til tarpit!

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste
×
×
  • Opprett ny...