Otu esi egbochi mwakpo SSH Brute Force Iji SSHGUARD

SSHGuard bụ daemon mepere emepe nke na-echebe ndị ọbịa pụọ na mwakpo ike ọjọọ. Ọ na-emezu nke a site na nlekota na nchịkọta nke ndekọ usoro, ịchọpụta ọgụ na igbochi ndị na-awakpo site na iji otu n'ime Linux firewall backend: iptables, FirewallD, pf, na ipfw.

N'ịbụ nke e mere iji nye nchebe ọzọ maka ọrụ OpenSSH, SSHGuard na-echekwa ọtụtụ ọrụ dịka Vsftpd na Postfix. Ọ na-amata ọtụtụ usoro ndekọ gụnyere Syslog, Syslog-ng, na faịlụ ndekọ ndekọ.

[Ị nwekwara ike ịmasị: Otu esi echekwa ma sie ike OpenSSH Server]

SSHGuard yiri Fail2ban naanị na edere ya na C (Edere Fail2ban na Python), dị mfe ma na-enye atụmatụ ole na ole.

N'ime ntuziaka a, anyị ga-egosi otu ị ga-esi wụnye na hazie SSHGuard iji gbochie mwakpo SSH brute Force na sava Linux gị.

Kwụpụ 1: Wụnye SSHGuard na Linux

Anyị na-amalite na ntinye nke SSHGuard na Linux.

Nke mbụ, melite ndepụta ngwugwu wee wụnye SSHGuard site na ebe nchekwa ndabara site na iji njikwa ngwugwu dabara adaba.

$ sudo apt update
$ sudo apt install sshguard

Ozugbo arụnyere, ọrụ SSHGuard na-amalite na-akpaghị aka, ma ị nwere ike nyochaa nke a site na iji iwu:

$ sudo systemctl status sshguard

Maka nkesa dabere na RHEL dị ka CentOS, Rocky, na AlmaLinux, malite site na ịwụnye ebe nchekwa EPEL dị ka enyere n'iwu dị n'okpuru.

$ sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
OR
$ sudo dnf install epel-release

Ebe EPEL nọ, gaa n'ihu ma wụnye SSHGuard site na iji njikwa ngwugwu dnf.

$ sudo dnf install sshguard

Ozugbo arụnyere, malite ma tọọ SSHGuard ka ịmalite na mmalite sistemụ ma ọ bụ malitegharịa.

$ sudo systemctl start sshguard
$ sudo systemctl enable sshguard

Jide n'aka na ị nyochaa na SSHGuard na-agba ọsọ dịka a tụrụ anya ya.

$ sudo systemctl status sshguard

Kwụpụ 2: Nhazi SSHGuard na Linux

SSHGuard na-enyocha nke ọma /var/log/auth.log, /var/log/secure systemd journal, yana faịlụ ndekọ syslog-ng maka mbọ nbanye dara ada.

Maka mbọ ọ bụla nbanye na-enweghi nke ọma, amachibidoro onye ọbịa nke dịpụrụ adịpụ maka obere oge, nke edobere na ndabara na 120 sekọnd. Mgbe nke ahụ gasịrị, oge mmachibido iwu na-arị elu site na 1.5 site na mbọ nbanye ọ bụla dara ada.

Oge amachibidoro ndị ọbịa na-emejọ, na mgbakwunye na paramita ndị ọzọ ka akọwapụtara na faịlụ sshguard.conf. Ị nwere ike ịnweta faịlụ nhazi site na iji vim editọ dị ka egosiri.

$ sudo vim /etc/sshguard/sshguard.conf

Na nkesa dabere na RHEL, faịlụ nhazi dị n'ụzọ a.

$ sudo vim /etc/sshguard.conf

Nke a bụ ihe atụ nke faịlụ nhazi mgbe a na-elele ya na Ubuntu/Debian.

Ka anyị lekwasị anya na isi nhọrọ.

Ntuziaka azụ azụ na-atụ aka na ụzọ zuru oke nke backend executable. N'ọmụmaatụ a, anyị na-ahụ na edobere IPtables ka ndabere firewall ndabere.
Ntuziaka THRESHOLD na-egbochi ndị na-awakpo mgbe akara mwakpo ha karịrị uru akọwapụtara.
Nhọrọ BLOCK_TIME bụ ọnụọgụ sekọnd nke egbochiri onye mwakpo mgbe mbọ ọ bụla nbanye dara ada. Site na ndabara, atọrọ nke a ka ọ bụrụ 120 ka mbọ nke mbụ gachara. Nke a na-abawanye na mbọ nbanye ọ bụla dara ada.
Nhọrọ DETECTION_TIME na-ezo aka na oge n'ime sekọnd nke sistemụ debara aha ma ọ bụ cheta onye mwakpo ahụ tupu emegharịa akara ha.
Nhọrọ WHITELIST_file na-arụtụ aka n'ụzọ zuru oke nke faịlụ whitelist nwere ndị ọbịa nke na-ekwesịghị ka edepụta aha ojii./li>

Kwụpụ 3: Hazie SSHGuard ka ọ gbochie mwakpo ndị agha SSH Brute

Iji gbochie mbuso agha ike brute, ịkwesịrị ịhazi na firewalls ndị a ka ị na-arụ ọrụ na sshguard.

Ọ bụrụ na ị tinyela UFW ma rụọ ọrụ na sistemụ Ubuntu/Debian gị, gbanwee faịlụ /etc/ufw/before.rules.

$ sudo vim etc/ufw/before.rules

Tinye ahịrị ndị a obere oge ka mpaghara kwe ka ihe niile naghachi azụ.

# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT

# hand off control for sshd to sshguard
:sshguard - [0:0]
-A ufw-before-input -p tcp --dport 22 -j sshguard

Chekwaa faịlụ ma malitegharịa UFW.

$ sudo systemctl restart ufw

Ugbu a gbalịa ịbanye n'ime ihe nkesa site na sistemụ dị iche site na iji nzere na-ezighi ezi wee chọpụta na a ga-akpọchi gị maka 120 sekọnd mgbe mbọ nbanye mbụ dara.

Ị nwere ike ịchọpụta nke a site na ịlele faịlụ log auth.log.

$ sudo tail -f  /var/log/auth.log

Mgbe mbọ ndekọ na-esote dara ada, oge mgbochi na-abawanye na 240 sekọnd, wee 480 sekọnd, wee 960 sekọnd, na na.

Ọ bụrụ na ị na-agba ọsọ firewalld, hụ na edobere ya ma gbanye ya. Wee mee iwu na-esonụ iji mee ka sshguard dị na mpaghara masịrị gị.

$ sudo firewall-cmd --permanent --zone=public --add-rich-rule="rule source ipset=sshguard4 drop"

Ka itinye mgbanwe ndị a, bugharịa Firewalld na sshguard.

$ sudo firewall-cmd --reload
$ sudo systemctl restart sshguard

Wee nyochaa iwu dị ka ndị a:

$ sudo firewall-cmd —-info-ipset=sshguard4

Ọ bụrụ na ị ka na-eji Iptables, nke mbụ, mepụta iwu ọhụrụ maka sshguard na Iptables ka ịmalite igbochi ndị ọjọọ.

# iptables -N sshguard

Na-esote, melite yinye INPUT iji duzie okporo ụzọ gaa sshguard wee gbochie okporo ụzọ niile sitere na nnọkọ ọjọọ.

# iptables -A INPUT -j sshguard

Iji gbochie ụfọdụ ọdụ ụgbọ mmiri dị ka SSH, POP, na IMAP n'aka ndị mmegbu na-eme iwu:

# iptables -A INPUT -m multiport -p tcp --destination-ports 22,110,143 -j sshguard

Na n'ikpeazụ, chekwaa iwu ka mgbanwe ndị ahụ malite.

# iptables-save > /etc/iptables/iptables.rules

Kwụpụ 4: Otu esi ede ndị ọbịa egbochiri SSH

Iji mee ka onye nnabata akpọchiri edepụta, naanị ezipụta aha nnabata ma ọ bụ adreesị IP ya na faịlụ whitelist nke dị na:

/etc/sshguard/whitelist - Ubuntu/Debian 
/etc/sshguard.whitelist - RHEL-based distros

Mgbe nke ahụ gasịrị, jide n'aka na ịmalitegharịa sshguard daemon na firewall backend maka mgbanwe itinye.

N'ime ntuziaka a, anyị egosila otu ị nwere ike isi gbochie mwakpo SSH Bruteforce site na iji SSHGuard daemon na sava Linux. A nabatara nzaghachi gị.