{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"Jednoduch\u00fd zp\u016fsob, jak chr\u00e1nit sv\u016fj Mikrotik p\u0159ed \u00fatoky","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00e1d bych se s komunitou pod\u011blil o jednoduch\u00fd a efektivn\u00ed zp\u016fsob, jak pomoc\u00ed Mikrotiku chr\u00e1nit svou s\u00ed\u0165 a slu\u017eby, kter\u00e9 z n\u00ed vy\u010dn\u00edvaj\u00ed, p\u0159ed extern\u00edmi \u00fatoky. A to pomoc\u00ed pouh\u00fdch t\u0159\u00ed pravidel za\u0159\u00eddit na Mikrotiku honeypot. <\/p>\n

P\u0159edstavme si, \u017ee m\u00e1me malou kancel\u00e1\u0159, extern\u00ed IP, za kterou stoj\u00ed RDP server pro pr\u00e1ci zam\u011bstnanc\u016f na d\u00e1lku. Prvn\u00ed pravidlo je samoz\u0159ejm\u011b zm\u011bnit port 3389 na extern\u00edm rozhran\u00ed na jin\u00fd. Ale to nen\u00ed na dlouho, po n\u011bkolika dnech za\u010dnou aud\u00edtorsk\u00e9 z\u00e1znamy termin\u00e1lov\u00e9ho serveru vykazovat n\u011bkolik ne\u00fasp\u011b\u0161n\u00fdch autoriza\u010dn\u00edch pokus\u016f za sekundu od nezn\u00e1m\u00fdch klient\u016f. <\/p>\n

V jin\u00e9 situaci m\u00e1te za Mikrotikem skryt\u00e9 asterisk, samoz\u0159ejm\u011b ne na portu 5060 UDP, a po p\u00e1r dnech tak\u00e9 za\u010d\u00edn\u00e1 prolomen\u00ed hesel\u2026 ano, v\u00edm, \u017ee fail2ban je na\u0161e v\u0161echno, ale s n\u00edm se je\u0161t\u011b budeme muset poprat\u2026 nap\u0159\u00edklad jsem ho ned\u00e1vno zprovoznil na ubuntu 18.04 a s \u00fa\u017easem zjistil, \u017ee out-of-the-box fail2ban neobsahuje aktu\u00e1ln\u00ed nastaven\u00ed pro asterisk z t\u00e9\u017ee krabice toho sam\u00e9ho ubuntu distribuce\u2026 a rychl\u00e9 nastaven\u00ed hotov\u00fdch \u201erecept\u016f\u201c u\u017e nelze vygooglit, \u010d\u00edsla verz\u00ed s l\u00e9ty rostou, ale \u010dl\u00e1nky s \u201erecepty\u201c pro star\u0161\u00ed verze u\u017e nefunguj\u00ed a nov\u00e9 se t\u00e9m\u011b\u0159 neobjevuj\u00ed\u2026 Ale n\u011bjak jsem se odch\u00fdlil od t\u00e9matu\u2026
\n<\/a><\/noindex>
\nTak co je honeypot ve zkratce \u2014 to je n\u00e1vnada, v na\u0161em p\u0159\u00edpad\u011b n\u011bjak\u00fd popul\u00e1rn\u00ed port na extern\u00edm IP, ka\u017ed\u00fd po\u017eadavek na tento port od extern\u00edho klienta ode\u0161le IP adresu do \u010dern\u00e9 listiny. To je v\u0161e.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nPrvn\u00ed pravidlo na popul\u00e1rn\u00edch TCP portech 22, 3389, 8291 extern\u00edho rozhran\u00ed ether4-wan pos\u00edl\u00e1 IP \u201en\u00e1v\u0161t\u011bvn\u00edka\u201c do seznamu \u201eHoneypot Hacker\u201c (porty pro ssh, rdp a winbox jsou p\u0159edem vypnut\u00e9 nebo zm\u011bn\u011bn\u00e9 na jin\u00e9). Druh\u00e9 d\u011bl\u00e1 tot\u00e9\u017e na popul\u00e1rn\u00edm UDP 5060.<\/p>\n
T\u0159et\u00ed pravidlo na f\u00e1zi preroutov\u00e1n\u00ed blokuje pakety \u201en\u00e1v\u0161t\u011bvn\u00edk\u016f\u201c, jejich\u017e srs-adresa se dostala do \u201eHoneypot Hacker\u201c.<\/p>\n
Po dvou t\u00fddnech provozu m\u00e9ho dom\u00e1c\u00edho Mikrotiku zahrnul seznam \u201eHoneypot Hacker\u201c p\u0159ibli\u017en\u011b patn\u00e1ct set IP adres milovn\u00edk\u016f \u201edr\u017een\u00ed za ucho\u201c m\u00fdch s\u00ed\u0165ov\u00fdch zdroj\u016f (doma m\u00e1m vlastn\u00ed telefonii, mail, nextcloud, rdp). Brute-force \u00fatoky ustaly, p\u0159i\u0161lo bla\u017eenstv\u00ed. <\/p>\n
Na pracovi\u0161ti to v\u0161ak nebylo tak jednoduch\u00e9, tam rdp server i nad\u00e1le l\u00e1mou pomoc\u00ed prolomen\u00ed hesel.<\/p>\n
Zd\u00e1 se, \u017ee port byl skenerem ur\u010den d\u00e1vno p\u0159ed zapnut\u00edm honeypotu, a b\u011bhem karant\u00e9ny nen\u00ed snadn\u00e9 p\u0159eorientovat v\u00edce ne\u017e 100 u\u017eivatel\u016f, z nich\u017e 20 % je star\u0161\u00edch 65 let. Pokud nen\u00ed mo\u017en\u00e9 zm\u011bnit port, existuje mal\u00fd pracovn\u00ed recept. To jsem na\u0161el na internetu, ale zde je to dopln\u011bn\u00e9 a jemn\u011b nastaven\u00e9: <\/p>\n
                        Pravidla pro nastaven\u00ed Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nZa 4 minuty je vzd\u00e1len\u00e9mu klientovi dovoleno prov\u00e9st pouze 12 nov\u00fdch \u201edotaz\u016f\u201c na RDP serveru<\/a>. Jeden pokus o p\u0159ihl\u00e1\u0161en\u00ed p\u0159edstavuje 1 a\u017e 4 \u201edotazy\u201c. P\u0159i 12. \u201edotazu\u201c \u2013 blokace na 15 minut. V m\u00e9m p\u0159\u00edpad\u011b \u00fato\u010dn\u00edci nep\u0159estali server hackovat, ale p\u0159izp\u016fsobili se \u010das\u016fm a nyn\u00ed to d\u011blaj\u00ed velmi pomalu, takov\u00e1 rychlost pokus\u016f efektivitu \u00fatoku sni\u017euje na nulu. Zam\u011bstnanci podniku z p\u0159ijat\u00fdch opat\u0159en\u00ed t\u00e9m\u011b\u0159 \u017e\u00e1dn\u00e9 nepohodl\u00ed v pr\u00e1ci nepoci\u0165uj\u00ed. <\/p>\n
                        Je\u0161t\u011b jeden mal\u00fd trik<\/b>
\n                         Toto pravidlo se aktivuje podle pl\u00e1nu ve 2 hodiny r\u00e1no a vyp\u00edn\u00e1 se v 5 hodin, kdy ur\u010dit\u011b sp\u00ed \u017eiv\u00ed lid\u00e9, zat\u00edmco automatizovan\u00ed skenovac\u00ed n\u00e1stroje z\u016fst\u00e1vaj\u00ed bd\u011bl\u00ed.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nJi\u017e p\u0159i 8. spojen\u00ed je IP adresa \u00fato\u010dn\u00edka um\u00edst\u011bna na \u010dernou listinu na t\u00fdden. Kr\u00e1sa!<\/p>\n
A jako dopln\u011bk k v\u00fd\u0161e uveden\u00e9mu p\u0159id\u00e1m odkaz na \u010dl\u00e1nek na Wiki, s funk\u010dn\u00edm nastaven\u00edm ochrany Mikrotiku proti s\u00ed\u0165ov\u00fdm skener\u016fm. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
Na m\u00fdch za\u0159\u00edzen\u00edch toto nastaven\u00ed funguje spolu s v\u00fd\u0161e uveden\u00fdmi pravidly honeypotu, dob\u0159e je dopl\u0148uje.<\/p>\n
UPD: Jak bylo nazna\u010deno v koment\u00e1\u0159\u00edch, pravidlo pro odhoz paket\u016f bylo p\u0159esunuto do RAW, aby se sn\u00ed\u017eila z\u00e1t\u011b\u017e na router.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jednoduch\u00fd zp\u016fsob, jak chr\u00e1nit sv\u016fj Mikrotik p\u0159ed \u00fatoky | ProHoster","description":"Chci se s komunitou pod\u011blit o jednoduch\u00fd a funk\u010dn\u00ed zp\u016fsob, jak pomoc\u00ed Mikrotiku chr\u00e1nit svou s\u00ed\u0165 a \u201evyhl\u00ed\u017eej\u00edc\u00ed\u201c slu\u017eby za n\u00edm p\u0159ed vn\u011bj\u0161\u00edmi \u00fatoky.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}