{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"Lihtne viis kaitsta oma Mikrotik'i r\u00fcnnakute eest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Soovin jagada kogukonnaga lihtsat ja toimivat viisi, kuidas Mikrotiki abil kaitsta oma v\u00f5rku ja selle kaudu k\u00e4tketeenuseid v\u00e4liste r\u00fcnnakute eest. Nimelt kolmel reeglil organiseerida Mikrotikis honeypot. <\/p>\n

Kujutame n\u00fc\u00fcd ette, et meil on v\u00e4ike kontor, mille v\u00e4lise IP taga asub RDP-server, millega t\u00f6\u00f6tajad saavad kaugjuurdep\u00e4\u00e4su. Esimene reegel on muidugi muuta pordiks 3389, et v\u00e4lisel liidesel kasutada teist porti. Kuid see ei kesta kaua, paar p\u00e4eva p\u00e4rast hakkab terminserveri auditilogi n\u00e4itama mitmeid eba\u00f5nnestunud autentimise katseid sekundis tundmatelt klientidelt. <\/p>\n

Teine olukord on see, et teil on Mikrotiki taga asterisk, loomulikult mitte 5060 udp pordil, ja paar p\u00e4eva p\u00e4rast algab ka paroolide proovimine\u2026 jah, jah, ma tean, fail2ban on meie k\u00f5ik, kuid sellega tuleb veel vaeva n\u00e4ha\u2026 n\u00e4iteks t\u00f5stsin hiljuti selle ubuntu 18.04-sse ja h\u00e4mmastuseks avastasin, et fail2ban ei sisalda kastist v\u00e4lja v\u00f5etuna asteriski jaoks ajakohaseid seadeid sama versiooniga ubuntu distributsioonis\u2026 ja kiirete \u201eretseptide\u201c seadistamise leidmine Google\u2019ist ei \u00f5nnestu, kuna numbrid versioonides kasvavad iga aastaga, kuid vanemate versioonide jaoks pole enam artikleid ja uusi on v\u00e4ga v\u00e4he\u2026 Kuid ma kaldusin teemast k\u00f5rvale\u2026
\n<\/a><\/noindex>
\nNii et, mis on honeypot kahe s\u00f5naga \u2014 see on l\u00f5ks, meie juhul m\u00f5ni populaarne port v\u00e4lisel IP-l, iga p\u00e4ring sellele pordile v\u00e4liselt kliendilt saadab src-aadressi musta nimekirja. K\u00f5ik.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nEsimene reegel populaarsetel TCP pordidel 22, 3389, 8291 v\u00e4lisel liidesel ether4-wan saadab IP \u201ek\u00fclalist\u201c nimekirja \u201eHoneypot Hacker\u201c (pordid ssh, rdp ja winbox on eelnevalt v\u00e4lja l\u00fclitatud v\u00f5i muudetud teistsugustele). Teine teeb sama populaarse UDP 5060 puhul.<\/p>\n
Kolmas reegel rippib preroottimise staadiumis pakette \u201ek\u00fclalistelt\u201c, kelle srs-aadress on sattunud \u201eHoneypot Hacker\u201c nimekirja.<\/p>\n
P\u00e4rast kahte n\u00e4dalat minu koduse Mikrotiki t\u00f6\u00f6tamist sisaldas \u201eHoneypot Hacker\u201c nimekiri umbes tuhandet viit sada IP-aadressi, kes armastavad mu v\u00f5rguressursse \u201ekatsuda\u201c (kodune telefoniv\u00f5rk, e-post, nextcloud, rdp). Brute-force r\u00fcnnakud lakkasid, k\u00f5ik muutus mugavaks. <\/p>\n
T\u00f6\u00f6l ei olnud k\u00f5ik nii lihtne, seal \u00fcritatakse RDP-serverit j\u00e4tkuvalt paroolide proovimisega murda.<\/p>\n
Tundub, et porti number m\u00e4\u00e4rati skanneriga kaua enne honeypoti sissel\u00fclitamist ja karantiini ajal ei ole \u00fcle 100 kasutaja, kellest 20% on \u00fcle 65 aasta vanad, \u00fcmber seadistamine kuigi lihtne. Kui porti ei saa muuta, on olemas v\u00e4ike t\u00f6\u00f6tav retsept. Sarnast olen internetis kohanud, kuid siin on tegemist v\u00e4ikse kohandamise ja peene seadistusega: <\/p>\n
                        Port Knocking seadistamise reeglid<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nKauklient saab 4 minuti jooksul teha ainult 12 uut \"taotlust\" RDP-le serveri<\/a>. \u00dcks sisenemiskatse on 1 kuni 4 \"taotlust\". 12. \"taotluse\" puhul - blokeeritakse 15 minutiks. Minu puhul ei lakanud r\u00fcndajad serveri h\u00e4kkimisest, vaid kohandusid ajastuseni ja n\u00fc\u00fcd teevad seda v\u00e4ga aeglaselt, see kiirus v\u00e4hendab r\u00fcnnaku efektiivsuse nulli. Ettev\u00f5tte t\u00f6\u00f6tajad ei tunne padr\u00f5esed ebamugavusi. <\/p>\n
                        Veel \u00fcks v\u00e4ike nipp<\/b>
\n                         See reegel aktiveeritakse kell 1 \u00f6\u00f6sel ja deaktiveeritakse kell 5, kui elavad inimesed magavad, samal ajal kui automatiseeritud skannerid j\u00e4tkavad tegevust.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nJuba 8. \u00fchenduse korral l\u00e4heb r\u00fcndaja IP musta nimekirja n\u00e4dalaks. Ilus!<\/p>\n
Ja lisaks eel\u00f6eldule jagan linki Wiki artiklile, kus on t\u00f6\u00f6kas Mikrotiki kaitse seadistus v\u00f5rgu skannerite eest. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
Minu seadmetes t\u00f6\u00f6tab see seadistus koos \u00fclaltoodud honeypoti reeglitega, t\u00e4iustades neid.<\/p>\n
UPD: Nagu kommentaarides \u00f6eldi, on pakettide \u00e4raviskamise reegel viidud RAW-i, et v\u00e4hendada ruuteri koormust.
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lihtne viis kaitsta oma Mikrotiki r\u00fcnnakute eest | ProHoster","description":"Soovin jagada kogukonnaga lihtsat ja t\u00f6\u00f6tavat viisi, kuidas Mikrotiki abil kaitsta oma v\u00f5rku ja selle kaudu n\u00e4htavaid teenuseid v\u00e4liste r\u00fcnnakute eest.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}