{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"Jednoduch\u00fd sp\u00f4sob, ako ochr\u00e1ni\u0165 svoj Mikrotik pred \u00fatokmi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Chcem sa podeli\u0165 s komunitou o jednoduch\u00fd a funk\u010dn\u00fd sp\u00f4sob, ako pomocou Mikrotiku chr\u00e1ni\u0165 svoju sie\u0165 a \"vyzeraj\u00face\" slu\u017eby od extern\u00fdch \u00fatokov. A to konkr\u00e9tne organizova\u0165 na Mikrotiku honeypot pomocou troch jednoduch\u00fdch pravidiel. <\/p>\n

Predstavme si, \u017ee m\u00e1me mal\u00fa kancel\u00e1riu, extern\u00e1 IP adresa za ktorou je RDP server pre pr\u00e1cu zamestnancov na dia\u013eku. Prv\u00e9 pravidlo je samozrejme zmeni\u0165 port 3389 na externom rozhran\u00ed na in\u00fd. Ale to netrv\u00e1 dlho, po nieko\u013ek\u00fdch d\u0148och auditn\u00fd \u017eurn\u00e1l termin\u00e1lov\u00e9ho servera za\u010dne vykazova\u0165 nieko\u013eko ne\u00faspe\u0161n\u00fdch autoriz\u00e1ci\u00ed za sekundu od nezn\u00e1mych klientov. <\/p>\n

In\u00e1 situ\u00e1cia, m\u00e1te za Mikrotikom skryt\u00fd asterisk, samozrejme nie na porte 5060 UDP, a po p\u00e1r d\u0148och sa za\u010d\u00edna prelomi\u0165 hesl\u00e1... \u00e1no, viem, fail2ban je na\u0161e v\u0161etko, ale nad n\u00edm sa e\u0161te budeme musie\u0165 popracova\u0165... ja som napr\u00edklad ned\u00e1vno nain\u0161taloval fail2ban na ubuntu 18.04 a s prekvapen\u00edm som zistil, \u017ee z krabi\u010dky fail2ban neobsahuje aktu\u00e1lne nastavenia pre asterisk z tej istej verzie ubuntu... a r\u00fdchle nastavenia u\u017e n\u00e1js\u0165 nemo\u017eno, \u010d\u00edsla v vydaniach s \u010dasom rast\u00fa a \u010dl\u00e1nky s \"receptami\" pre star\u0161ie verzie u\u017e nefunguj\u00fa, pri\u010dom nov\u00e9 sa objavuj\u00fa len zriedkavo... Ale nejako som sa odklonil...
\n<\/a><\/noindex>
\n\u010co je honeypot v dvoch slov\u00e1ch \u2014 je to pasca, v na\u0161om pr\u00edpade nejak\u00fd popul\u00e1rny port na externej IP adrese, ka\u017ed\u00fd dotaz na tento port od extern\u00e9ho klienta prid\u00e1 zdrojov\u00fa adresu do \u010diernej listiny. A to je cel\u00e9.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nPrv\u00e9 pravidlo na popul\u00e1rnych TCP portoch 22, 3389, 8291 extern\u00e9ho rozhrania ether4-wan posiela IP \"n\u00e1v\u0161tevn\u00edka\" do zoznamu \"Honeypot Hacker\" (porty pre ssh, rdp a winbox s\u00fa vopred vypnut\u00e9 alebo zmenen\u00e9 na in\u00e9). Druh\u00e9 rob\u00ed to ist\u00e9 na popul\u00e1rnom UDP 5060.<\/p>\n
Tretie pravidlo v \u0161t\u00e1diu prerozde\u013eovania zhadzuje pakety \"n\u00e1v\u0161tevn\u00edkov\", ktor\u00fdch zdrojov\u00e1 adresa sa dostala do \"Honeypot Hacker\".<\/p>\n
Po dvoch t\u00fd\u017ed\u0148och pr\u00e1ce m\u00f4jho dom\u00e1ceho Mikrotiku sa zoznam \"Honeypot Hacker\" rozr\u00e1stol o pribli\u017ene tis\u00edc p\u00e4\u0165sto IP adries milovn\u00edkov \"dr\u017ea\u0165 moje sie\u0165ov\u00e9 zdroje za krkom\" (doma m\u00e1me vlastn\u00fa telef\u00f3niu, po\u0161tu, nextcloud, rdp) Brute-force \u00fatoky ustali, nastala bla\u017eenos\u0165. <\/p>\n
V pr\u00e1ci to v\u0161ak nebolo tak\u00e9 jednoduch\u00e9, tam rdp server na\u010falej l\u00e1mu prelomen\u00edm hesiel.<\/p>\n
Zd\u00e1 sa, \u017ee portov\u00fd skener ur\u010dil \u010d\u00edslo portu d\u00e1vno pred aktiv\u00e1ciou honeypotu, a po\u010das karant\u00e9ny nie je jednoduch\u00e9 znovu nastavi\u0165 viac ako 100 pou\u017e\u00edvate\u013eov, z ktor\u00fdch 20 % je star\u0161\u00edch ako 65 rokov. V pr\u00edpade, \u017ee nie je mo\u017en\u00e9 zmeni\u0165 port, existuje mal\u00fd funk\u010dn\u00fd recept. Podobn\u00e9 som videl na internete, ale tu je potrebn\u00e1 drobn\u00e1 \u00faprava a jemn\u00e9 nastavenie: <\/p>\n
                        Pravidl\u00e1 pre konfigur\u00e1ciu Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nNa vzdialen\u00e9ho klienta je povolen\u00e9 za 4 min\u00faty uskuto\u010dni\u0165 iba 12 nov\u00fdch \"po\u017eiadaviek\" na RDP serveru<\/a>. Jeden pokus o prihl\u00e1senie predstavuje od 1 do 4 \"po\u017eiadaviek\". Po 12. \"po\u017eiadavke\" \u2013 zablokovanie na 15 min\u00fat. V mojom pr\u00edpade \u00fato\u010dn\u00edci na server neprestali \u00fato\u010di\u0165, prisp\u00f4sobili sa \u010dasova\u010dom a teraz to robia ve\u013emi pomaly, t\u00e1to r\u00fdchlos\u0165 sk\u00fa\u0161ania zni\u017euje \u00fa\u010dinnos\u0165 \u00fatoku na nulu. Zamestnanci podniku sa kv\u00f4li prijat\u00fdm opatreniam prakticky nec\u00edtia v pr\u00e1ci nijako nepr\u00edjemne. <\/p>\n
                        E\u0161te jeden mal\u00fd trik<\/b>
\n                         Toto pravidlo sa aktivuje pod\u013ea rozvrhu o polnoci a vypne sa o 5, ke\u010f \u017eiv\u00ed \u013eudia ur\u010dite spia, a automatizovan\u00e9 n\u00e1stroje na vylu\u010dovanie zost\u00e1vaj\u00fa na\u017eive.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nU\u017e na 8. spojen\u00ed sa IP \u00fato\u010dn\u00edka dost\u00e1va na \u010diernu listinu na t\u00fd\u017ede\u0148. Kr\u00e1sa!<\/p>\n
A k tomu, \u010do som spomenul, prid\u00e1m odkaz na \u010dl\u00e1nok Wiki, s funk\u010dn\u00fdm nastaven\u00edm ochrany Mikrotiku proti sie\u0165ov\u00fdm skenerom. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
Na mojich zariadeniach toto nastavenie funguje spolu s vy\u0161\u0161ie op\u00edsan\u00fdmi pravidlami honeypotu a pekne ich dopl\u0148uje.<\/p>\n
UPD: Ako nazna\u010dili v koment\u00e1roch, pravidlo na zadr\u017eiavanie paketov bolo presunut\u00e9 do RAW, aby sa zn\u00ed\u017eila z\u00e1\u0165a\u017e na router.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jednoduch\u00fd sp\u00f4sob, ako chr\u00e1ni\u0165 svoj Mikrotik pred \u00fatokmi | ProHoster","description":"Chcem sa podeli\u0165 s komunitou o jednoduch\u00fd a funk\u010dn\u00fd sp\u00f4sob, ako pomocou Mikrotiku chr\u00e1ni\u0165 svoju sie\u0165 a \"vy\u010dnievaj\u00face\" slu\u017eby pred vonkaj\u0161\u00edmi \u00fatokmi.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}