- Mitglied seit
- 10 Jun 2007
- Beiträge
- 2,999
- Punkte für Reaktionen
- 7
- Punkte
- 38
Das:
Code:
iptables -N sip-flood
iptables -A INPUT -p udp --dport 5060 -j sip-flood
iptables -A sip-flood -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl -j LOG --log-prefix "SIP bruteforce attempt: "
iptables -A sip-flood -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 4 --rttl -j DROP
iptables -A sip-flood -m state --state NEW -m recent --set -j ACCEPTDamit testen:
sipsak -F -o 100 -v -s sip:xxx@sipserver
warning: redirects are not expected in flood. disableing
flooding message number 1
...
flooding message number 27
flooding message number 28
^C
Und so wirkts:
Code:
:~# iptables -v -L
Chain sip-flood (1 references)
pkts bytes target prot opt in out source destination
23 7711 LOG all -- any any anywhere anywhere state NEW recent: CHECK seconds: 60 hit_count: 4 TTL-Match name: DEFAULT side: source LOG level warning
23 7711 DROP all -- any any anywhere anywhere state NEW recent: CHECK seconds: 60 hit_count: 4 TTL-Match name: DEFAULT side: source
4 1337 ACCEPT all -- any any anywhere anywhere state NEW recent: SET name: DEFAULT side: sourceDie Parameter oben aber willkürlich ändern, sonst wirds berechenbar für den Angreifer.
Die verbreitetere trivialere Methode mit -m limit ist nicht geeignet, weil matcht auch die Pakete von den eigenen autorisierten Peers/Users und nicht nach src-IP und führt damit zu DOS durch cracker scans.
Wenn man keine user von ausserhalb anmelden will, kann man die Firewall auch zulassen und stattdessen den conntrack-timeout über das Wiederregistrierungsintervall erhöhen, dann bleiben eingehende Verbindungen von den registrierten Providern zugelassen:
Code:
iptables -P INPUT DROP
#iptables -A INPUT -p udp -m udp --dport 5060 -i $WAN_IF -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
echo 3600 > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo 3600 > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_streamWorks for me zur Zeit, bitte berichten ob bei Euch auch
UPDATE:
Von wegen, gleich durchbrochen obwohl vom LAN getestet:
Code:
Apr 6 15:19:01 NOTICE[3050744720] chan_sip.c: Registration from '"9997"<sip:9997@xxxxxx>' failed for '97.74.113.231' -
Username/auth name mismatch
Apr 6 15:19:01 NOTICE[3050744720] chan_sip.c: Registration from '"9998"<sip:9998@xxxxxxxx>' failed for '97.74.113.231' -
Username/auth name mismatch
Apr 6 15:19:01 NOTICE[3050744720] chan_sip.c: Registration from '"9999"<sip:9999@xxxxxxx>' failed for '97.74.113.231' -
Username/auth name mismatch
Code:
56399 14M sip-flood udp -- wlan0 any anywhere anywhere udp dpt:sip
56385 14M ACCEPT udp -- wlan0 any anywhere anywhere udp dpt:sip
Code:
Chain sip-flood (1 references)
pkts bytes target prot opt in out source destination
10 4197 LOG all -- any any anywhere anywhere state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: DEFAULT side: source LOG level warning prefix `SIP bruteforce attempt: '
10 4197 DROP all -- any any anywhere anywhere state NEW recent: CHECK seconds: 60 hit_count: 4 TTL-Match name: DEFAULT side: source
4 1736 ACCEPT all -- any any anywhere anywhere state NEW recent: SET name: DEFAULT side: sourceIch versuchs jetzt so:
Code:
iptables -N sip-flood
iptables -A INPUT -p udp --dport 5060 -j sip-flood
iptables -A sip-flood -m recent --update --seconds 60 --hitcount 4 --rttl -j LOG --log-prefix "SIP bruteforce attempt: "
iptables -A sip-flood -m recent --rcheck --seconds 60 --hitcount 4 --rttl -j DROP
iptables -A sip-flood -m state --state NEW -m recent --set -j ACCEPTGeht nicht bei ESTABLISHED UDP, --state NEW muss raus
Code:
iptables -N sip-flood
iptables -A INPUT -p udp --dport 5060 -j sip-flood
iptables -A sip-flood -m recent --update --seconds 60 --hitcount 4 --rttl -j LOG --log-prefix "SIP bruteforce attempt: "
iptables -A sip-flood -m recent --rcheck --seconds 60 --hitcount 4 --rttl -j DROP
iptables -A sip-flood -m recent --set -j ACCEPTOK
:~# sipsak -F -o 10 -s sip:xxxxx@xxxx
Code:
Chain sip-flood (1 references)
pkts bytes target prot opt in out source destination
8537 2879K LOG all -- any any anywhere anywhere recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: DEFAULT side: source LOG level warning prefix `SIP bruteforce attempt: '
8537 2879K DROP all -- any any anywhere anywhere recent: CHECK seconds: 60 hit_count: 4 TTL-Match name: DEFAULT side: source
11 4084 ACCEPT all -- any any anywhere anywhere recent: SET name: DEFAULT side: sourceLeider blockiert mir das auch die Antworten der Peers mit der Zeit, muss --hitcount erhöhen:
Code:
iptables -A sip-flood -m recent --update --seconds 60 --hitcount 20 --rttl -j LOG --log-prefix "SIP bruteforce attempt: "
iptables -A sip-flood -m recent --rcheck --seconds 60 --hitcount 20 --rttl -j DROP
Code:
Chain sip-flood (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere recent: UPDATE seconds: 60 hit_count: 20 TTL-Match name: DEFAULT side: source LOG level warning prefix `SIP bruteforce attempt: '
0 0 DROP all -- any any anywhere anywhere recent: CHECK seconds: 60 hit_count: 20 TTL-Match name: DEFAULT side: source
57 11354 ACCEPT all -- any any anywhere anywhere recent: SET name: DEFAULT side: sourceDie alte Standardfreigabe kann dann raus, wird nicht verwendet:
Code:
#iptables -A INPUT -p udp -m udp --dport 5060 -i wlan0 -j ACCEPT
[B]0 0[/B] ACCEPT udp -- wlan0 any anywhere anywhere udp dpt:sipAktuell:
Code:
iptables -N sip-flood
iptables -A INPUT -p udp -m udp --dport 5060 -j sip-flood
iptables -A INPUT -p tcp -m tcp --dport 5060:5061 --syn -j sip-flood
iptables -A sip-flood -m recent --update --seconds 60 --hitcount 20 --rttl -j LOG --log-prefix "SIP bruteforce attempt: "
iptables -A sip-flood -m recent --rcheck --seconds 60 --hitcount 20 --rttl -j DROP
iptables -A sip-flood -m recent --set -j ACCEPThttp://netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.html#toc3.16
UPDATE:
3 geblockt bisher aber 1 kam trotzdem durch:
Code:
Apr 10 22:04:07 NOTICE[3050744720] chan_sip.c: Registration from '"3467803423"<sip:3467803423@xxxxxxxxxxx>' failed for '67.202.0.232' - Username/auth name mismatch
...
Apr 10 22:05:21 NOTICE[3050744720] chan_sip.c: Registration from '"mcdatase"<sip:mcdatase@xxxxxxxx>' failed for '67.202.0.232' - Username/auth name mismatch
Code:
Chain sip-flood (2 references)
pkts bytes target prot opt in out source destination
7998 2244K DROP all -- any any anywhere anywhere recent: UPDATE seconds: 60 hit_count: 20 TTL-Match name: DEFAULT side: source
[B]37577 11M ACCEPT [/B] all -- any any anywhere anywhere recent: SET name: DEFAULT side: sourceKann nur über TTL-Match passiert sein, -rttl muss raus.
Zuletzt bearbeitet:
