{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"\u0141atwy spos\u00f3b na zabezpieczenie swojego Mikrotika przed atakami","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Chc\u0119 podzieli\u0107 si\u0119 z spo\u0142eczno\u015bci\u0105 prostym i dzia\u0142aj\u0105cym sposobem, jak za pomoc\u0105 Mikrotika ochroni\u0107 swoj\u0105 sie\u0107 oraz us\u0142ugi, kt\u00f3re si\u0119 przez niego \"wygl\u0105daj\u0105\", przed zewn\u0119trznymi atakami. A mianowicie, jak za pomoc\u0105 trzech zasad zorganizowa\u0107 na Mikrotiku honeypot. <\/p>\n

Wyobra\u017amy sobie, \u017ce mamy ma\u0142e biuro, a zewn\u0119trzny IP chroni serwer RDP dla pracy pracownik\u00f3w zdalnych. Pierwsz\u0105 zasad\u0105 jest oczywi\u015bcie zmiana portu 3389 na zewn\u0119trznym interfejsie na inny. Jednak to nie wystarczy, po kilku dniach dziennik audytu serwera terminalowego zacznie pokazywa\u0107 kilka nieudanych pr\u00f3b autoryzacji na sekund\u0119 od nieznanych klient\u00f3w. <\/p>\n

Inna sytuacja, gdy za Mikrotikiem ukryty jest asterisk, oczywi\u015bcie nie na porcie udp 5060, i po kilku dniach r\u00f3wnie\u017c zaczyna si\u0119 atak si\u0142owy na has\u0142a... tak, tak, wiem, \u017ce fail2ban to nasze wszystko, ale b\u0119dziemy musieli jeszcze troch\u0119 nad nim popracowa\u0107... niedawno na przyk\u0142ad zainstalowa\u0142em go na ubuntu 18.04 i z zaskoczeniem odkry\u0142em, \u017ce w standardowej konfiguracji fail2ban nie zawiera aktualnych ustawie\u0144 dla asteriska w tej samej wersji dystrybucji ubuntu... a szybkie wyszukiwanie gotowych \u201eprzepis\u00f3w\u201d ju\u017c nie dzia\u0142a, liczby wersji z latami rosn\u0105, a artyku\u0142y z \u201eprzepisami\u201d dla starych wersji ju\u017c nie dzia\u0142aj\u0105, a nowych pojawia si\u0119 prawie wcale... Ale wracaj\u0105c do sedna...
\n<\/a><\/noindex>
\nCo to jest honeypot w dw\u00f3ch s\u0142owach \u2014 to pu\u0142apka, w naszym przypadku jaki\u015b popularny port na zewn\u0119trznym IP, ka\u017cdy \u017c\u0105danie do tego portu od zewn\u0119trznego klienta wysy\u0142a adres \u017ar\u00f3d\u0142owy do czarnej listy. I to wszystko.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nPierwsza zasada dla popularnych port\u00f3w TCP 22, 3389, 8291 na zewn\u0119trznym interfejsie ether4-wan wysy\u0142a IP \u201ego\u015bcia\u201d do listy \u201eHoneypot Hacker\u201d (porty dla ssh, rdp i winbox zosta\u0142y wcze\u015bniej wy\u0142\u0105czone lub zmienione na inne). Druga zasada dzia\u0142a tak samo na popularnym UDP 5060.<\/p>\n
Trzecia zasada na etapie przetwarzania przed routowaniem blokuje pakiety \u201ego\u015bci\u201d, kt\u00f3rych adres \u017ar\u00f3d\u0142owy znalaz\u0142 si\u0119 na li\u015bcie \u201eHoneypot Hacker\u201d.<\/p>\n
Po dw\u00f3ch tygodniach pracy mojego domowego Mikrotika lista \u201eHoneypot Hacker\u201d obejmowa\u0142a oko\u0142o p\u00f3\u0142tora tysi\u0105ca adres\u00f3w IP mi\u0142o\u015bnik\u00f3w \u201etrzymania za udko\u201d moich zasob\u00f3w sieciowych (w domu mam w\u0142asn\u0105 telefonie, e-mail, nextcloud, rdp). Ataki typu brute-force usta\u0142y, nasta\u0142 b\u0142ogostan. <\/p>\n
W pracy nie jest tak \u0142atwo, tam serwer rdp nadal jest \u0142amany metod\u0105 ataku si\u0142owego.<\/p>\n
Wygl\u0105da na to, \u017ce numer portu zosta\u0142 okre\u015blony przez skaner d\u0142ugo przed w\u0142\u0105czeniem honeypota, a w czasie kwarantanny nie jest \u0142atwo przestawi\u0107 ponad 100 u\u017cytkownik\u00f3w, z kt\u00f3rych 20% ma ponad 65 lat. W przypadku, gdy port nie mo\u017ce by\u0107 zmieniony, istnieje ma\u0142y sprawdzony przepis. Spotka\u0142em co\u015b podobnego w Internecie, ale tutaj pojawia si\u0119 dodatkowe poprawki i drobne dostrojenia: <\/p>\n
                        Zasady konfiguracji Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nZdalny klient ma tylko 4 minuty na z\u0142o\u017cenie 12 nowych '\u017c\u0105da\u0144' do RDP serwera<\/a>. Jedna pr\u00f3ba logowania to od 1 do 4 '\u017c\u0105da\u0144'. Po 12-tym '\u017c\u0105daniu' - blokada na 15 minut. W moim przypadku napastnicy nie przestali atakowa\u0107 serwera, dostosowali si\u0119 do timer\u00f3w i teraz robi\u0105 to bardzo powoli, taka pr\u0119dko\u015b\u0107 pr\u00f3bki obni\u017ca skuteczno\u015b\u0107 ataku do zera. Pracownicy firmy nie odczuwaj\u0105 praktycznie \u017cadnych niedogodno\u015bci zwi\u0105zanych z podj\u0119tymi dzia\u0142aniami. <\/p>\n
                        Jeszcze jedna ma\u0142a sztuczka<\/b>
\n                         Ta zasada jest w\u0142\u0105czana zgodnie z harmonogramem o godzinie 1 w nocy i wy\u0142\u0105czana o 5, kiedy \u017cywi ludzie z pewno\u015bci\u0105 \u015bpi\u0105, a zautomatyzowane pr\u00f3bki wci\u0105\u017c s\u0105 aktywne.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nJu\u017c przy 8-ym po\u0142\u0105czeniu IP napastnika jest dodawane do czarnej listy na tydzie\u0144. Pi\u0119kne!<\/p>\n
No i dla uzupe\u0142nienia dodam link do artyku\u0142u Wiki, z dzia\u0142aj\u0105c\u0105 konfiguracj\u0105 ochrony Mikrotika przed skanowaniami sieciowymi. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
Na moich urz\u0105dzeniach ta konfiguracja dzia\u0142a razem z powy\u017cej opisanymi zasadami honeypot, dobrze je uzupe\u0142niaj\u0105c.<\/p>\n
UPD: Jak zasugerowano w komentarzach, zasada dropowania pakiet\u00f3w zosta\u0142a przeniesiona do RAW, aby zmniejszy\u0107 obci\u0105\u017cenie routera.
\n
\u0179r\u00f3d\u0142o: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0141atwy spos\u00f3b na zabezpieczenie swojego Mikrotika przed atakami | ProHoster","description":"Chc\u0119 podzieli\u0107 si\u0119 ze spo\u0142eczno\u015bci\u0105 prostym i skutecznym sposobem, jak za pomoc\u0105 Mikrotika zabezpieczy\u0107 swoj\u0105 sie\u0107 i us\u0142ugi, kt\u00f3re 'wygl\u0105daj\u0105' z powodu niego, przed zewn\u0119trznymi atakami.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}