{"id":41229,"date":"2020-02-06T20:43:00","date_gmt":"2020-02-06T17:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/opasno-li-derzhat-otkrytym-rdp-v-internete"},"modified":"2020-02-06T20:43:00","modified_gmt":"2020-02-06T17:43:00","slug":"opasno-li-derzhat-otkrytym-rdp-v-internete","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/opasno-li-derzhat-otkrytym-rdp-v-internete","title":{"rendered":"A \u00ebsht\u00eb e rrezikshme t\u00eb mbash RDP hapur n\u00eb Internet?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

shpesh kam lexuar mendime se mbajtja e portit RDP (Protocoli i Desktopit t\u00eb Larg\u00ebt) t\u00eb hapur n\u00eb Internet \u00ebsht\u00eb shum\u00eb e pasigurt dhe nuk duhet b\u00ebr\u00eb. \u00cbsht\u00eb m\u00eb mir\u00eb q\u00eb qasja n\u00eb RDP t\u00eb jepet vet\u00ebm p\u00ebrmes VPN, ose vet\u00ebm nga adresa IP \"t\u00eb bardha\" specifike.<\/p>\n

<\/p>\n

Un\u00eb administroj disa Windows Server p\u00ebr firma t\u00eb vogla, n\u00eb t\u00eb cilat m\u00eb \u00ebsht\u00eb caktuar detyra p\u00ebr t\u00eb siguruar akses t\u00eb larg\u00ebt n\u00eb Windows Server p\u00ebr kontabilist\u00ebt. \u00cbsht\u00eb nj\u00eb trend modern \u2014 puna nga sht\u00ebpia. Shpejt e kuptova se t\u2019i ushtroj kontabilist\u00ebt me VPN \u00ebsht\u00eb nj\u00eb pun\u00eb e falimentuar, dhe nuk do t\u00eb arrija t\u00eb grumbulloja t\u00eb gjitha IP p\u00ebr list\u00ebn e bardh\u00eb, sepse adresat IP t\u00eb njer\u00ebzve jan\u00eb dinamike.<\/p>\n

<\/p>\n

Prandaj ndjeva q\u00eb rruga m\u00eb e thjesht\u00eb ishte t\u00eb hapja portin RDP p\u00ebr t\u00eb jashtmen. Tani, p\u00ebr aksesin, kontabilist\u00ebt duhet t\u00eb nisin RDP dhe t\u00eb futin emrin e hostit (p\u00ebrfshir\u00eb portin), emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin.<\/p>\n

<\/p>\n

N\u00eb k\u00ebt\u00eb artikull, do t\u00eb ndaja p\u00ebrvoj\u00ebn time (pozitive dhe jo aq pozitive) dhe rekomandimet.<\/p>\n

<\/a><\/noindex><\/p>\n

Rreziqet<\/h3>\n

<\/p>\n

\u00c7far\u00eb rrezikoni duke hapur portin RDP?<\/p>\n

<\/p>\n

1) Qasje t\u00eb paautorizuar n\u00eb t\u00eb dh\u00ebna t\u00eb ndjeshme<\/b>
\nN\u00ebse ndokush arrin t\u00eb gjej\u00eb fjal\u00ebkalimin p\u00ebr RDP, at\u00ebher\u00eb ai do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb ket\u00eb qasje n\u00eb t\u00eb dh\u00ebnat q\u00eb d\u00ebshironi t'i mbani private: gjendjet e llogarive, bilancet, t\u00eb dh\u00ebnat e klient\u00ebve, \u2026<\/p>\n

<\/p>\n

2) Humbje t\u00eb dh\u00ebnash<\/b>
\nP\u00ebr shembull, si rezultat i veprimtaris\u00eb s\u00eb nj\u00eb virusi-kriptues.
\nOse veprim i drejtp\u00ebrdrejt\u00eb i nj\u00eb sulmuesi.<\/p>\n

<\/p>\n

3) Humbja e stacionit t\u00eb pun\u00ebs<\/b>
\nPunonj\u00ebsit duhet t\u00eb punojn\u00eb, nd\u00ebrsa sistemi \u00ebsht\u00eb kompromentuar, duhet t\u00eb rinstalohet \/ rikuperohet \/ konfigurohet.<\/p>\n

<\/p>\n

4) Komprometimi i rrjetit lokal<\/b>
\nN\u00ebse sulmuesi ka fituar akses n\u00eb nj\u00eb kompjuter Windows, ai do t\u00eb ket\u00eb akses n\u00eb sistemet q\u00eb nuk jan\u00eb t\u00eb disponueshme nga jasht\u00eb, nga Interneti. P\u00ebr shembull, n\u00eb ndarjet e skedar\u00ebve, n\u00eb printerat rrjet\u00eb etj.<\/p>\n

\nKam pasur nj\u00eb rast kur Windows Server mori nj\u00eb virus-kriptues<\/b><\/p>\n

dhe ky virus s\u00eb pari kriptoi shumic\u00ebn e skedar\u00ebve n\u00eb diskut C:, pastaj filloi t\u00eb kriptoj\u00eb skedar\u00ebt n\u00eb NAS p\u00ebrmes rrjetit. Duke qen\u00eb q\u00eb NAS ishte Synology, me snapshots t\u00eb konfiguruara, e rikuperova NAS-in brenda 5 minutash, nd\u00ebrsa Windows Server e rinstalova nga e para.<\/p>\n

<\/p>\n

V\u00ebzhgimet dhe Rekomandimet<\/h3>\n

<\/p>\n

Un\u00eb monitoroj Windows Servers duke p\u00ebrdorur Winlogbeat<\/a><\/noindex>, t\u00eb cilat d\u00ebrgojn\u00eb log-et n\u00eb ElasticSearch. N\u00eb Kibana ka disa vizualizime, dhe un\u00eb kam konfiguruar nj\u00eb panel t\u00eb personalizuar.
\nMonitorimi vet\u00eb nuk mbron, por ndihmon p\u00ebr t\u00eb p\u00ebrcaktuar masat e nevojshme.<\/p>\n

<\/p>\n

Ja disa v\u00ebzhgime:
\na) RDP do t\u00eb goditet me brute-force.<\/b>
\nN\u00eb nj\u00eb nga server\u00ebt e mi kam vendosur RDP-n\u00eb, jo n\u00eb portin standard 3389, por n\u00eb 443 \u2014 q\u00eb t\u00eb maskohem si HTTPS. Ka sens t\u00eb ndryshoj portin nga ai standard, por do t\u00eb thot\u00eb pak. K\u00ebtu \u00ebsht\u00eb statistika nga ky server:<\/p>\n

\n\"A<\/p>\n

Evidentojm\u00eb se gjat\u00eb jav\u00ebs kishte pothuajse 400,000 p\u00ebrpjekje t\u00eb d\u00ebshtuara p\u00ebr t'u lidhur p\u00ebrmes RDP.
\nEvidentojm\u00eb se p\u00ebrpjekjet p\u00ebr t'u lidhur u b\u00ebn\u00eb nga 55,001 adresa IP (disa adresa IP tashm\u00eb ishin bllokuar prej meje).<\/p>\n

<\/p>\n

K\u00ebtu mund t\u00eb nxirret konkluzioni se nevojitet t\u00eb instalohet fail2ban, por <\/p>\n

\np\u00ebr Windows nuk ka nj\u00eb mjet t\u00eb till\u00eb.<\/b><\/p>\n

Ka disa projekte t\u00eb braktisura n\u00eb GitHub q\u00eb duket se e b\u00ebjn\u00eb k\u00ebt\u00eb, por madje nuk kam provuar t'i instaloj:
\nhttps:\/\/github.com\/glasnt\/wail2ban<\/a><\/noindex>
\nhttps:\/\/github.com\/EvanAnderson\/ts_block<\/a><\/noindex><\/p>\n

<\/p>\n

Po ashtu ka utilitar\u00eb me pages\u00eb, por nuk i kam shqyrtuar.<\/p>\n

<\/p>\n

N\u00ebse dini nj\u00eb utilitar t\u00eb hapur p\u00ebr k\u00ebt\u00eb q\u00ebllim \u2014 ndani n\u00eb komente.<\/p>\n

<\/p>\n

Update<\/strong>: N\u00eb komentet u sugjerua se porta 443 \u00ebsht\u00eb nj\u00eb zgjedhje e keqe, dhe \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb zgjidhen porte t\u00eb larta (32000+), sepse 443 skanohet m\u00eb shpesh, dhe t\u00eb identifikosh RDP n\u00eb k\u00ebt\u00eb port \u2014 nuk \u00ebsht\u00eb problem.<\/p>\n

<\/p>\n

P\u00ebrdit\u00ebsim:<\/strong> N\u00eb komentet u sugjerua se ekziston nj\u00eb utilitar i till\u00eb:
\nhttps:\/\/github.com\/digitalruby\/ipban<\/a><\/noindex><\/p>\n

<\/p>\n

b) Ka disa username t\u00eb caktuara q\u00eb sulmuesit i preferojn\u00eb.<\/b>
\nEvidentojm\u00eb se bruteforce po b\u00ebhet p\u00ebrmes nj\u00eb fjalori me emra t\u00eb ndrysh\u00ebm.
\nPor kjo kam v\u00ebn\u00eb re: nj\u00eb num\u00ebr i konsideruesh\u00ebm p\u00ebrpjekjesh \u00ebsht\u00eb p\u00ebrdorimi i emrit t\u00eb serverit si emri i p\u00ebrdoruesit. Rekomandimi: mos p\u00ebrdorni t\u00eb nj\u00ebjtin em\u00ebr p\u00ebr kompjuterin dhe p\u00ebr p\u00ebrdoruesin. Kjo ndodh nganj\u00ebher\u00eb kur emri i serverit p\u00ebrpiqet t\u00eb analizohet; p\u00ebr shembull, p\u00ebr nj\u00eb sistem me emrin DESKTOP-DFTHD7C, m\u00eb shum\u00eb p\u00ebrpjekje jan\u00eb b\u00ebr\u00eb me emrin DFTHD7C:<\/p>\n

\n\"A<\/p>\n

P\u00ebr rrjedhoj\u00eb, n\u00ebse keni nj\u00eb kompjuter DESKTOP-MARIA, ndoshta do t\u00eb ket\u00eb p\u00ebrpjekje p\u00ebr t\u00eb hyr\u00eb me emrin e p\u00ebrdoruesit MARIA.<\/p>\n

<\/p>\n

Gjithashtu, \u00e7far\u00eb kam v\u00ebn\u00eb re nga log\u00ebt: n\u00eb shumic\u00ebn e sistemeve, shumica e p\u00ebrpjekjeve p\u00ebr t\u00eb hyr\u00eb b\u00ebhen me emrin \"administrator\". Dhe kjo nuk \u00ebsht\u00eb rast\u00ebsi, sepse n\u00eb shum\u00eb versione t\u00eb Windows, ky p\u00ebrdorues ekziston. M\u00eb tep\u00ebr \u2014 nuk mund t\u00eb fshihet. Kjo ia leht\u00ebson pun\u00ebn sulmuesve: n\u00eb vend t\u00eb gjetjes s\u00eb emrit dhe fjal\u00ebkalimit, duhet vet\u00ebm t\u00eb gjejn\u00eb fjal\u00ebkalimin.
\nP\u00ebr fat t\u00eb mir\u00eb, sistemi q\u00eb kap\u00ebrceu kriptuesin kishte p\u00ebrdoruesin Administrator dhe fjal\u00ebkalimin Murmansk#9. Nuk jam ende i sigurt se si e kan\u00eb hackuar at\u00eb sistem, sepse kam filluar ta monitoroj pik\u00ebrisht pas atij rasti, por mendoj se \u00ebsht\u00eb e mundur q\u00eb t\u00eb ket\u00eb qen\u00eb nj\u00eb p\u00ebrpjekje brute.
\nN\u00ebse p\u00ebrdoruesi Administrator nuk mund t\u00eb eliminohet, \u00e7far\u00eb mund t\u00eb b\u00ebjm\u00eb? Ai mund t\u00eb rib\u00ebhet!<\/p>\n

<\/p>\n

Rekomandimet nga ky seksion: <\/p>\n

<\/p>\n