Come prevenire gli attacchi UDP in uscita?

Question

Come prevenire gli attacchi UDP in uscita?

#1 da (3 voti)

1

Il mio server è stato il bersaglio degli hacker 3 volte nell'ultimo mese e l'attacco sembra seguire lo stesso schema. Attacca un altro sito da il mio server usando la connessione UDP. Il rapporto del mio ISP è il seguente:

19 Dec 2014 21:45:41:202 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:069 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:135 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:069 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:171 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:226 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:341 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:092 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:254 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP
19 Dec 2014 21:45:41:153 GMT      my.ip.addr.ess:35323     other.ip.addr.ess:30000           40         UDP

Ho installato e configurato iptables, ma suppongo che le mie impostazioni non siano abbastanza potenti da prevenire tali attacchi:

#! /bin/bash
### BEGIN INIT INFO
# Provides:          firewall
# Short-Description: Regles iptables
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: start/stop firewall
# Description:       Charge la configuration du pare-feu iptables
### END INIT INFO
#### Merci a Buddy pour l'aide apportee
###
#### adapter selon vos besoins et services actifs sur le serveur
###
case "$1" in
start)

## purge
/sbin/iptables -F
/sbin/iptables -X

# Bloque tout le trafic
     /sbin/iptables -t filter -P INPUT DROP
     /sbin/iptables -t filter -P FORWARD DROP
     /sbin/iptables -t filter -P OUTPUT DROP


# Autorise les connexions deja etablies et localhost
     /sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     /sbin/iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     /sbin/iptables -t filter -A INPUT -i lo -j ACCEPT
     /sbin/iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP (Ping)
# on bloque la demande de ping et on autorise ovh pour le monitoring
#/sbin/iptables -t filter -A INPUT -p icmp -j ACCEPT

#on garde la possibilite de faire des ping depuis le serveur
/sbin/iptables -t filter -A OUTPUT -p icmp -j ACCEPT

##RTM et ping OVH
/sbin/iptables -A INPUT -p icmp --source proxy.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.p19.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.rbx.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.rbx2.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.gra.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source a2.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.sbg.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.bhs.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source ping.ovh.net -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source proxy.ovh.net -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --dport 6100:6200 -j ACCEPT

#Mettre le debut IP du serveur a la place des xxx
/sbin/iptables -A INPUT -p icmp --source my.ip.addr.250 -j ACCEPT
/sbin/iptables -A INPUT -p icmp --source my.ip.addr.251 -j ACCEPT

# SSH port 22
        # SSH standard
        # si vous n'avez pas d'IP fixe
/sbin/iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT

# Elasticsearch debugging
/sbin/iptables -t filter -A INPUT -p tcp --dport 9200 -j ACCEPT
        # En cas d'IP fixe, vous pouvez n'autoriser le port 22 que sur vos IP
        # Commentez les lignes standard et decommentez celles-ci apres avoir mis votre/vos IP fixes
#/sbin/iptables -t filter -i eth0 --source VOTRE_IP1 -A INPUT -p TCP --dport 22 -j ACCEPT
#/sbin/iptables -t filter -i eth0 --source VOTRE_IP2 -A INPUT -p TCP --dport 22 -j ACCEPT
#/sbin/iptables -t filter -A OUTPUT -p tcp --dport 22 -j DROP

# DNS
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

# HTTP IPv4
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

# mySQL  : mis pour memoire mais il est en general activation inutile
#/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT

# FTP
#/sbin/iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
#/sbin/iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT

##
# Commentez les lignes si pas de service mail sur le serveur
##
# Mail SMTP
/sbin/iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT

/sbin/iptables -t filter -A INPUT -p tcp --dport 587 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 587 -j ACCEPT

# /sbin/iptables -t filter -A INPUT -p tcp --dport 465 -j ACCEPT
# /sbin/iptables -t filter -A OUTPUT -p tcp --dport 465 -j ACCEPT

# Mail POP3
# /sbin/iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
# /sbin/iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT

# Mail POP3S
# /sbin/iptables -t filter -A INPUT -p tcp --dport 995 -j ACCEPT
# /sbin/iptables -t filter -A OUTPUT -p tcp --dport 995 -j ACCEPT

# Mail IMAP
# /sbin/iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
# /sbin/iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT

# Mail IMAP SSL
# /sbin/iptables -t filter -A INPUT -p tcp --dport 993 -j ACCEPT
# /sbin/iptables -t filter -A OUTPUT -p tcp --dport 993 -j ACCEPT

# Rsync decommenter si besoin
    # /sbin/iptables -t filter -A OUTPUT -p tcp --dport rsync -j ACCEPT
    # /sbin/iptables -t filter -A INPUT -p tcp --dport rsync -j ACCEPT

# Panels sur le port 10000 : Webmin et Virtualmin
# configuration standard (commenter la ligne ci-dessous si vous utilisez la configuration avec IP fixe)
# /sbin/iptables -A INPUT -i eth0 -p tcp --dport 10000 -j ACCEPT

 # configuration si IP fixe, decommentez les lignes ci-dessous
    # /sbin/iptables -A INPUT -i eth0 -p tcp --dport 10000 --source VOTRE_IP-FIXE1 -j ACCEPT
    # /sbin/iptables -A INPUT -i eth0 -p tcp --dport 10000 --source VOTRE_IP_FIXE2 -j ACCEPT

# NTP (horloge du serveur)
/sbin/iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# on limite le nombre de demandes de connexions
/sbin/iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
/sbin/iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
/sbin/iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

#munin, si vous utilisez decommentez les lignes
    # /sbin/iptables -A OUTPUT -p tcp --sport 4949 -j ACCEPT
    # /sbin/iptables -A INPUT -p tcp --dport 4949 -s A.B.C.D -j ACCEPT

### Configuration pour IPv6, decommentez si vous utilisez
# ipv6 on bloque
#/sbin/ip6tables -t filter -P INPUT DROP
#/sbin/ip6tables -t filter -P FORWARD DROP
#/sbin/ip6tables -t filter -P OUTPUT DROP

# Autorise les connexions deja etablies et localhost
#/sbin/ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#/sbin/ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#/sbin/ip6tables -t filter -A INPUT -i lo -j ACCEPT
#/sbin/ip6tables -t filter -A OUTPUT -o lo -j ACCEPT

# ping ipv6
#/sbin/ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
#/sbin/ip6tables -A OUTPUT -p ipv6-icmp -j ACCEPT

# port 80 en sortie IPv6 ( apt-get entre autre )
#/sbin/ip6tables -A OUTPUT -p tcp --destination-port 80 -j ACCEPT

# NTP ipv6 (horloge du serveur) sortie uniquement
/sbin/ip6tables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# DNS en sortie IPv6
#/sbin/ip6tables -A OUTPUT -p tcp --dport domain -j ACCEPT
#/sbin/ip6tables -A OUTPUT -p udp --dport domain -j ACCEPT

exit 0
;;

stop)
/sbin/iptables -F
/sbin/iptables -X

exit 0
;;
*)
echo "Usage: /etc/init.d/firewall {start|stop}"
exit 1
;;
esac

Qualcuno ha qualche consiglio su come prevenirlo nel futur?

Sarebbe molto apprezzato.

Grazie!

attacks attack-prevention iptables udp

posta jchatard 20.12.2014 - 09:37

fonte

1 risposta

Leggi altre domande sui tag attacks attack-prevention iptables udp

Modifica password dell'account e-mail tramite e-mail allo script L'intero web * veramente * dovrebbe essere crittografato? Il testo in chiaro non è talvolta più veloce / migliore? [duplicare]

score 3 · Answer 1

Le tue regole del firewall mi sembrano buone. In particolare, il "default deny" per i pacchetti in uscita significa che dovrebbe bloccare i pacchetti nel report dal proprio ISP.

Sei sicuro che il tuo server sia la fonte dei pacchetti? È facile falsificare l'indirizzo sorgente per i pacchetti UDP.