1 Temat przez sloan

  • sloan
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2012-03-07
  • Posty: 31

Temat: Bezpieczeństwo Próba włamania?

Witajcie.
Dziś rano odpaliłem "logread" na routerze (1043nd z OpenWrt by Obsy r35003) i zobaczyłem coś takiego

Feb 25 02:24:30 OpenWrt authpriv.info dropbear[31013]: Child connection from 218.202.76.4:54671
Feb 25 02:24:33 OpenWrt authpriv.warn dropbear[31013]: Bad password attempt for 'root' from 218.202.76.4:54671
Feb 25 02:24:34 OpenWrt authpriv.info dropbear[31013]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:24:36 OpenWrt authpriv.info dropbear[31014]: Child connection from 218.202.76.4:54921
Feb 25 02:24:40 OpenWrt authpriv.warn dropbear[31014]: Bad password attempt for 'root' from 218.202.76.4:54921
Feb 25 02:24:41 OpenWrt authpriv.info dropbear[31014]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:24:42 OpenWrt authpriv.info dropbear[31015]: Child connection from 218.202.76.4:55311
Feb 25 02:24:47 OpenWrt authpriv.warn dropbear[31015]: Bad password attempt for 'root' from 218.202.76.4:55311
Feb 25 02:24:47 OpenWrt authpriv.info dropbear[31015]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:24:48 OpenWrt authpriv.info dropbear[31016]: Child connection from 218.202.76.4:55702
Feb 25 02:24:54 OpenWrt authpriv.warn dropbear[31016]: Bad password attempt for 'root' from 218.202.76.4:55702
Feb 25 02:24:55 OpenWrt authpriv.info dropbear[31016]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:24:56 OpenWrt authpriv.info dropbear[31017]: Child connection from 218.202.76.4:56101
Feb 25 02:24:59 OpenWrt authpriv.warn dropbear[31017]: Bad password attempt for 'root' from 218.202.76.4:56101
Feb 25 02:25:00 OpenWrt authpriv.info dropbear[31017]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:00 OpenWrt authpriv.info dropbear[31018]: Child connection from 218.202.76.4:56336
Feb 25 02:25:05 OpenWrt authpriv.warn dropbear[31018]: Bad password attempt for 'root' from 218.202.76.4:56336
Feb 25 02:25:06 OpenWrt authpriv.info dropbear[31018]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:09 OpenWrt authpriv.info dropbear[31021]: Child connection from 218.202.76.4:56645
Feb 25 02:25:13 OpenWrt authpriv.warn dropbear[31021]: Bad password attempt for 'root' from 218.202.76.4:56645
Feb 25 02:25:13 OpenWrt authpriv.info dropbear[31021]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:14 OpenWrt authpriv.info dropbear[31022]: Child connection from 218.202.76.4:57015
Feb 25 02:25:17 OpenWrt authpriv.warn dropbear[31022]: Bad password attempt for 'root' from 218.202.76.4:57015
Feb 25 02:25:18 OpenWrt authpriv.info dropbear[31022]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:18 OpenWrt authpriv.info dropbear[31023]: Child connection from 218.202.76.4:57231
Feb 25 02:25:22 OpenWrt authpriv.warn dropbear[31023]: Bad password attempt for 'root' from 218.202.76.4:57231
Feb 25 02:25:23 OpenWrt authpriv.info dropbear[31023]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:23 OpenWrt authpriv.info dropbear[31024]: Child connection from 218.202.76.4:57456
Feb 25 02:25:26 OpenWrt authpriv.warn dropbear[31024]: Bad password attempt for 'root' from 218.202.76.4:57456
Feb 25 02:25:27 OpenWrt authpriv.info dropbear[31024]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:28 OpenWrt authpriv.info dropbear[31025]: Child connection from 218.202.76.4:57675
Feb 25 02:25:31 OpenWrt authpriv.warn dropbear[31025]: Bad password attempt for 'root' from 218.202.76.4:57675
Feb 25 02:25:32 OpenWrt authpriv.info dropbear[31025]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:32 OpenWrt authpriv.info dropbear[31026]: Child connection from 218.202.76.4:57905
Feb 25 02:25:35 OpenWrt authpriv.warn dropbear[31026]: Bad password attempt for 'root' from 218.202.76.4:57905
Feb 25 02:25:36 OpenWrt authpriv.info dropbear[31026]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:37 OpenWrt authpriv.info dropbear[31027]: Child connection from 218.202.76.4:58124
Feb 25 02:25:42 OpenWrt authpriv.warn dropbear[31027]: Bad password attempt for 'root' from 218.202.76.4:58124
Feb 25 02:25:42 OpenWrt authpriv.info dropbear[31027]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:43 OpenWrt authpriv.info dropbear[31028]: Child connection from 218.202.76.4:58440
Feb 25 02:25:46 OpenWrt authpriv.warn dropbear[31028]: Bad password attempt for 'root' from 218.202.76.4:58440
Feb 25 02:25:47 OpenWrt authpriv.info dropbear[31028]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:47 OpenWrt authpriv.info dropbear[31029]: Child connection from 218.202.76.4:58653
Feb 25 02:25:50 OpenWrt authpriv.warn dropbear[31029]: Bad password attempt for 'root' from 218.202.76.4:58653
Feb 25 02:25:51 OpenWrt authpriv.info dropbear[31029]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:52 OpenWrt authpriv.info dropbear[31030]: Child connection from 218.202.76.4:58869
Feb 25 02:25:55 OpenWrt authpriv.warn dropbear[31030]: Bad password attempt for 'root' from 218.202.76.4:58869
Feb 25 02:25:55 OpenWrt authpriv.info dropbear[31030]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:25:56 OpenWrt authpriv.info dropbear[31031]: Child connection from 218.202.76.4:59086
Feb 25 02:25:59 OpenWrt authpriv.warn dropbear[31031]: Bad password attempt for 'root' from 218.202.76.4:59086
Feb 25 02:26:00 OpenWrt authpriv.info dropbear[31031]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:00 OpenWrt authpriv.info dropbear[31032]: Child connection from 218.202.76.4:59304
Feb 25 02:26:05 OpenWrt authpriv.warn dropbear[31032]: Bad password attempt for 'root' from 218.202.76.4:59304
Feb 25 02:26:05 OpenWrt authpriv.info dropbear[31032]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:06 OpenWrt authpriv.info dropbear[31033]: Child connection from 218.202.76.4:59594
Feb 25 02:26:09 OpenWrt authpriv.warn dropbear[31033]: Bad password attempt for 'root' from 218.202.76.4:59594
Feb 25 02:26:10 OpenWrt authpriv.info dropbear[31033]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:10 OpenWrt authpriv.info dropbear[31034]: Child connection from 218.202.76.4:59817
Feb 25 02:26:13 OpenWrt authpriv.warn dropbear[31034]: Bad password attempt for 'root' from 218.202.76.4:59817
Feb 25 02:26:14 OpenWrt authpriv.info dropbear[31034]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:14 OpenWrt authpriv.info dropbear[31035]: Child connection from 218.202.76.4:60051
Feb 25 02:26:17 OpenWrt authpriv.warn dropbear[31035]: Bad password attempt for 'root' from 218.202.76.4:60051
Feb 25 02:26:18 OpenWrt authpriv.info dropbear[31035]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:19 OpenWrt authpriv.info dropbear[31036]: Child connection from 218.202.76.4:38580
Feb 25 02:26:22 OpenWrt authpriv.warn dropbear[31036]: Bad password attempt for 'root' from 218.202.76.4:38580
Feb 25 02:26:22 OpenWrt authpriv.info dropbear[31036]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:23 OpenWrt authpriv.info dropbear[31037]: Child connection from 218.202.76.4:38796
Feb 25 02:26:26 OpenWrt authpriv.warn dropbear[31037]: Bad password attempt for 'root' from 218.202.76.4:38796
Feb 25 02:26:27 OpenWrt authpriv.info dropbear[31037]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:27 OpenWrt authpriv.info dropbear[31038]: Child connection from 218.202.76.4:39030
Feb 25 02:26:30 OpenWrt authpriv.warn dropbear[31038]: Bad password attempt for 'root' from 218.202.76.4:39030
Feb 25 02:26:31 OpenWrt authpriv.info dropbear[31038]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:32 OpenWrt authpriv.info dropbear[31039]: Child connection from 218.202.76.4:39255
Feb 25 02:26:35 OpenWrt authpriv.warn dropbear[31039]: Bad password attempt for 'root' from 218.202.76.4:39255
Feb 25 02:26:35 OpenWrt authpriv.info dropbear[31039]: Exit before auth (user 'root', 1 fails): Disconnect received
Feb 25 02:26:37 OpenWrt authpriv.info dropbear[31040]: Child connection from 218.202.76.4:39496
Feb 25 02:26:45 OpenWrt authpriv.warn dropbear[31040]: Bad password attempt for 'root' from 218.202.76.4:39496
Feb 25 02:26:46 OpenWrt authpriv.info dropbear[31040]: Exit before auth (user 'root', 1 fails): Exited normally

Sprawdziłem IP, pochodzi z Chin. Sądząc po częstotliwości prób zalogowania, pewnie było to robione jakimś automatem. I teraz mam pytanie. Czy można się jakoś dodatkowo zabezpieczyć przed takimi rzeczami, czy pozostaje nam tylko mocne, często zmieniane hasło?

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,883

Odp: Bezpieczeństwo Próba włamania?

Przenieś ssh na inny port niż 22.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez sloan

  • sloan
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2012-03-07
  • Posty: 31

Odp: Bezpieczeństwo Próba włamania?

To zrobię z pewnością. Czy jeszcze coś można zrobić?

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,883

Odp: Bezpieczeństwo Próba włamania?

Poza wyłączeniem ssh na  wan - zbytnio nie ma co  smile

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

5 Odpowiedź przez sloan

  • sloan
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2012-03-07
  • Posty: 31

Odp: Bezpieczeństwo Próba włamania?

Ssh na wanie jest mi potrzebny. Cóż pozostaje zmiana portu i hasła. Cezary, dziękuję za szybki odzew.

6 Odpowiedź przez hanti

  • hanti
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2013-01-24
  • Posty: 120

Odp: Bezpieczeństwo Próba włamania?

wystarczylby fail2ban tylko nie wiem czy jest na openwrt

7 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,883

Odp: Bezpieczeństwo Próba włamania?

I 2/3 chin wyblokować w ten sposób? Ma sens?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

8 Odpowiedź przez endi

  • endi
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2011-12-17
  • Posty: 30

Odp: Bezpieczeństwo Próba włamania?

Może to się przyda smile
http://blog.zioup.org/2008/iptables_recent/

9 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,883

Odp: Bezpieczeństwo Próba włamania?

Taki mechanizm jest w gargoyle, który blokuje po iluś tam nieudanych próbach logowania przez ssh.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona