ich hab ein Problem das meine iptables einstellungen nicht wirklich ziehen .... aber ich find einfach nichts wo ich was verdreht habe ....
Code: Alles auswählen
#!/bin/bash
#
#
# LOGNDROP log to seperate file
#joe /etc/syslog.conf
#kern.debug -/var/log/DoS.log
#/etc/init.d/sysklogd restart
#/etc/init.d/klogd restart
IPT="/sbin/iptables"
EXT_1="yy.yyy.yyy.yyy" # IP meines Servers
CLEAR(){
# clear iptables
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F LOGNDROP
$IPT -F # will delete all rules from filter table
$IPT -F -t nat # will delete all rules from nat table
$IPT -F -t mangle # will delete all rules from mangle table
}
LOCALHOST(){
# allow all lo
#$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
}
FILTER(){
# some filtering
$IPT -A INPUT -p icmp --icmp-type 8 -j DROP
$IPT -A OUTPUT -p icmp --icmp-type 8 -j DROP
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
while read GESPERRT DATUM; do
$IPT -A INPUT -s $GESPERRT -j REJECT
done </var/lib/iptables/gesperrt
$IPT -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT # Anti-SYN
$IPT -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT # Anti Portscan
$IPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/sec -j ACCEPT # Anti Ping-of-Death
# broken packets
$IPT -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
#new Chain for logging
$IPT -N LOGNDROP
$IPT -A LOGNDROP -j LOG -m limit --limit 1/min --log-prefix "[DoS]: " --log-level 7
$IPT -A LOGNDROP -j DROP
#limit connections per minute from single ip to 10 (HTTP)
$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set --name http
$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name http -j LOGNDROP
#limit connections per minute from single ip to 10 (POP)
$IPT -A INPUT -p tcp --dport 110 -m state --state NEW -m recent --name pop --rsource --update --seconds 60 --hitcount 5 -j DROP
$IPT -A INPUT -p tcp --dport 110 -m state --state NEW -m recent --name pop --rsource --set -j ACCEPT
#teamspeak udp
#$IPT -A INPUT -p udp -d $EXT_1 --dport 9987 -j ACCEPT
}
EXT_INPUT_ACCEPT(){
# allow related connections
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
WHITELIST="yy.yyy.yyy.yyy"
for x in $WHITELIST; do
$IPT -A INPUT -s $x -d $EXT_1 -j ACCEPT
done;
#TCPPORTS="21 25 53 80 110 143 465 995 5050 7370 8000 25565"
TCPPORTS="5050"
for x in $TCPPORTS; do
$IPT -A INPUT -p tcp -d $EXT_1 --dport $x -j ACCEPT
done;
# limit PPS
#$IPT -A INPUT -p tcp -d $EXT_1 --dport 50001 -m limit --limit 15/s --limit-burst 25 -j ACCEPT
#$IPT -A INPUT -p tcp -d $EXT_1 --dport 50005 -m limit --limit 10/s --limit-burst 15 -j ACCEPT
#$IPT -A INPUT -p tcp -d $EXT_1 --dport 50004 -m limit --limit 5/s --limit-burst 10 -j ACCEPT
}
DEF_DROP(){
# DEFAULT DROP ALL OTHER
$IPT -A INPUT -j DROP
#$IPT -A FORWARD -j DROP
}
if [ ! -z "$1" ]; then
if [ "$1" = "start" ]; then
sh $0 stop
LOCALHOST;
FILTER;
EXT_INPUT_ACCEPT;
DEF_DROP;
echo "rules loaded";
exit
fi
if [ "$1" = "stop" ]; then
CLEAR;
if [ $? = 0 ]; then echo "Rules cleared"; else echo "error in CLEARing rules!"; fi
fi
if [ "$1" = "restart" ]; then
sh $0 start
fi
if [ "$1" = "status" ]; then
$IPT -L -vnx
$IPT -vxn -L POSTROUTING -t nat
$IPT -vnx -L PREROUTING -t nat
fi
else
echo "usage $0 start | stop | status | restart"
fi
Code: Alles auswählen
while read GESPERRT DATUM; do
$IPT -A INPUT -s $GESPERRT -j REJECT
done </var/lib/iptables/gesperrt
Problem habe ich aber mit dem Teil der mit meine Mail-attacken abalten sollte.
Das sollte ja der Teil machen....
Code: Alles auswählen
#limit connections per minute from single ip to 10 (POP)
$IPT -A INPUT -p tcp --dport 110 -m state --state NEW -m recent --name pop --rsource --update --seconds 60 --hitcount 5 -j DROP
$IPT -A INPUT -p tcp --dport 110 -m state --state NEW -m recent --name pop --rsource --set -j ACCEPT
und ja ich weis es gibt fail2ban, ich mir wären halt iptables lieber weil ich sie ja auch verstehen will.Jan 12 18:17:02 admin pop3d: LOGIN FAILED, user=helen, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:04 admin pop3d: LOGIN FAILED, user=project, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:05 admin pop3d: LOGIN FAILED, user=admin, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:06 admin pop3d: LOGIN FAILED, user=master, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:09 admin pop3d: LOGIN FAILED, user=director, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:11 admin pop3d: LOGIN FAILED, user=company, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:12 admin pop3d: LOGIN FAILED, user=security, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:13 admin pop3d: LOGIN FAILED, user=Alfredo, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:16 admin pop3d: LOGIN FAILED, user=helen, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:17 admin pop3d: LOGIN FAILED, user=cv, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:19 admin pop3d: LOGIN FAILED, user=manager, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:20 admin pop3d: LOGIN FAILED, user=webmaster, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:22 admin pop3d: LOGIN FAILED, user=www, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:23 admin pop3d: LOGIN FAILED, user=order, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:26 admin pop3d: LOGIN FAILED, user=emperor, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:27 admin pop3d: LOGIN FAILED, user=marketing, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:30 admin pop3d: LOGIN FAILED, user=test, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:32 admin pop3d: LOGIN FAILED, user=backup, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:32 admin pop3d: LOGIN FAILED, user=helen, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:33 admin pop3d: LOGIN FAILED, user=inquiry, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:38 admin pop3d: LOGIN FAILED, user=cs, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:39 admin pop3d: LOGIN FAILED, user=info, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:40 admin pop3d: LOGIN FAILED, user=hellen, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:40 admin pop3d: LOGIN FAILED, user=mark, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:45 admin pop3d: LOGIN FAILED, user=Carmelo, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:46 admin pop3d: LOGIN FAILED, user=clark, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:47 admin pop3d: LOGIN FAILED, user=webmaster, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:48 admin pop3d: LOGIN FAILED, user=mary, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:52 admin pop3d: LOGIN FAILED, user=server, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:53 admin pop3d: LOGIN FAILED, user=support, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:54 admin pop3d: LOGIN FAILED, user=data, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:56 admin pop3d: LOGIN FAILED, user=postmaster, ip=[::ffff:xxx.xxx.xxx.xxx]
Jan 12 18:17:59 admin pop3d: LOGIN FAILED, user=angel, ip=[::ffff:xxx.xxx.xxx.xxx]
Eventuell kann mir ja we helfen bzw. sagen warum das so nicht funktioniert.
Oder auch wenn ich totalen stuss drinnen stehen habe.
Habe ich mir auch nur als verschiedenen Beispielen zusammengestoppelt.
Danke scon mal, Zamorra
