{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"O metod\u0103 simpl\u0103 de a-\u021bi proteja Mikrotik-ul de atacuri","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vreau s\u0103 \u00eemp\u0103rt\u0103\u0219esc cu comunitatea o metod\u0103 simpl\u0103 \u0219i func\u021bional\u0103 de a proteja re\u021beaua mea \u0219i serviciile \u201ecare scap\u0103\u201d din cauza ei, folosind Mikrotik, de atacurile externe. Adic\u0103, organizarea unui honeypot pe Mikrotik cu doar trei reguli. <\/p>\n

A\u0219adar, s\u0103 ne imagin\u0103m c\u0103 avem un birou mic, cu un IP extern, \u00een spatele c\u0103ruia se afl\u0103 un server RDP, pentru a permite angaja\u021bilor s\u0103 lucreze de acas\u0103. Prima regul\u0103 este, desigur, s\u0103 schimb\u0103m portul 3389 pe interfa\u021ba extern\u0103 cu altul. Dar aceasta nu va dura mult, deoarece, dup\u0103 c\u00e2teva zile, jurnalul de audit al serverului terminal va \u00eencepe s\u0103 arate c\u00e2teva \u00eencerc\u0103ri nereu\u0219ite de autentificare pe secund\u0103 din partea clien\u021bilor necunoscu\u021bi. <\/p>\n

O alt\u0103 situa\u021bie este c\u0103, \u00een spatele Mikrotik-ului, ave\u021bi un asterisk, evident, nu pe portul udp 5060, \u0219i dup\u0103 c\u00e2teva zile \u00eencepe \u0219i acolo for\u021barea parolelor... Da, \u0219tiu, fail2ban este tot ce avem, dar va trebui s\u0103 ne str\u0103duim din nou... de exemplu, eu am configurat recent fail2ban pe ubuntu 18.04 \u0219i cu surprindere am descoperit c\u0103, din cutie, fail2ban nu con\u021bine set\u0103rile actuale pentru asterisk din aceea\u0219i cutie a acelei distribu\u021bii Ubuntu... iar c\u0103utarea rapid\u0103 a set\u0103rilor \u201ere\u021betelor\u201d gata preg\u0103tite nu d\u0103 rezultate nici acum, numerele versiunilor cresc pe parcursul anilor, iar articolele cu \u201ere\u021bete\u201d pentru versiunile vechi nu mai func\u021bioneaz\u0103, iar cele noi apar foarte rar... Dar cred c\u0103 m-am ab\u0103tut de la subiect...
\n<\/a><\/noindex>
\nA\u0219adar, ce este un honeypot \u00een dou\u0103 cuvinte \u2014 este un momeal\u0103, \u00een cazul nostru, un port popular pe IP-ul extern, orice solicitare pe acest port din partea unui client extern trimite adresa surs\u0103 \u00een lista neagr\u0103. At\u00e2t.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nPrima regul\u0103 pe porturile TCP populare 22, 3389, 8291 ale interfe\u021bei externe ether4-wan trimite IP-ul \u201evizitatorului\u201d \u00een lista \u201eHoneypot Hacker\u201d (porturile pentru ssh, rdp \u0219i winbox sunt deja dezactivate sau schimbate). A doua regul\u0103 face acela\u0219i lucru pe portul UDP popular 5060.<\/p>\n
A treia regul\u0103, \u00een etapa de preroating, blocheaz\u0103 pachetele \u201evizitatorilor\u201d a c\u0103ror adres\u0103 surs\u0103 a fost inclus\u0103 \u00een lista \u201eHoneypot Hacker\u201d.<\/p>\n
Dup\u0103 dou\u0103 s\u0103pt\u0103m\u00e2ni de func\u021bionare a Mikrotik-ului meu de acas\u0103, lista \u201eHoneypot Hacker\u201d a inclus aproximativ o mie \u0219i cinci sute de adrese IP ale celor care \u201e\u00ee\u0219i iau libert\u0103\u021bi\u201d cu resursele mele de re\u021bea (acas\u0103 am telefonie proprie, email, nextcloud, rdp). Atacurile de tip brute-force au \u00eencetat, a venit fericirea. <\/p>\n
La lucru, nu a fost totul at\u00e2t de simplu, acolo serverul rdp continu\u0103 s\u0103 fie atacat prin for\u021barea parolelor.<\/p>\n
Se pare c\u0103 num\u0103rul portului a fost determinat de scanner \u00eenainte de activarea honeypot-ului, iar \u00een timpul carantinei nu este tocmai u\u0219or s\u0103 reconfigurezi peste 100 de utilizatori, dintre care 20% au v\u00e2rsta de peste 65 de ani. \u00cen cazul \u00een care portul nu poate fi schimbat, exist\u0103 o mic\u0103 re\u021bet\u0103 func\u021bional\u0103. Am \u00eent\u00e2lnit ceva similar pe internet, dar aici este o ajustare suplimentar\u0103 \u0219i o reglare fin\u0103: <\/p>\n
                        Reguli pentru configurarea Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\n\u00cen 4 minute, clientului de la distan\u021b\u0103 i se permite s\u0103 fac\u0103 doar 12 noi \u201esolicit\u0103ri\u201d la RDP. server<\/a>. O \u00eencercare de conectare \u00eenseamn\u0103 \u00eentre 1 \u0219i 4 \u201esolicit\u0103ri\u201d. Dup\u0103 a 12-a \u201esolicitare\u201d \u2013 blocare timp de 15 minute. \u00cen cazul meu, atacatorii nu au \u00eencetat s\u0103 mai \u00eencerce s\u0103 compromit\u0103 serverul, s-au adaptat la temporizatoare \u0219i acum o fac foarte \u00eencet; aceast\u0103 vitez\u0103 de testare reduce eficien\u021ba atacului la zero. Angaja\u021bii companiei nu \u00eent\u00e2mpin\u0103 practic nicio nepl\u0103cere din cauza m\u0103surilor adoptate. <\/p>\n
                        \u00cenc\u0103 o mic\u0103 \u0219mecherie<\/b>
\n                         Aceast\u0103 regul\u0103 se activeaz\u0103 conform unui program la ora 1 noaptea \u0219i se dezactiveaz\u0103 la 5, c\u00e2nd oamenii reali dorm cu siguran\u021b\u0103, iar instrumentele automate de testare r\u0103m\u00e2n active.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nDeja la a 8-a conexiune, IP-ul atacatorului este trimis pe lista neagr\u0103 pentru o s\u0103pt\u0103m\u00e2n\u0103. Frumos!<\/p>\n
Ei bine, \u0219i ca un plus la cele spuse anterior, voi ad\u0103uga un link c\u0103tre articolul Wiki, cu o configurare func\u021bional\u0103 a protec\u021biei Mikrotik \u00eempotriva scanerelor de re\u021bea. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
Pe dispozitivele mele, aceast\u0103 configurare func\u021bioneaz\u0103 \u00eempreun\u0103 cu regulile honeypot descrise mai sus, complet\u00e2ndu-le destul de bine.<\/p>\n
UPD: A\u0219a cum au sugerat \u00een comentarii, regula de blocare a pachetelor a fost mutat\u0103 \u00een RAW, pentru a reduce \u00eenc\u0103rc\u0103tura pe router.
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 O metod\u0103 u\u0219oar\u0103 de a-\u021bi proteja Mikrotik-ul de atacuri | ProHoster","description":"Vreau s\u0103 \u00eemp\u0103rt\u0103\u0219esc cu comunitatea o metod\u0103 simpl\u0103 \u0219i func\u021bional\u0103 de a proteja re\u021beaua mea \u0219i serviciile \u201ecare se observ\u0103\u201d din spatele acesteia de atacuri externe cu ajutorul Mikrotik.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}