Hi everyone,
I am running FreeBSD under Windows 7 using VirtualBox. Some days ago I got hacked and I could not connect any more to SSH and MySql.
Here is what I have done to prevent hackers:
Root's password is at least 16 characters mixed with numbers and letters;
Anti DDoS script running every minute:
Anti Brute-Force script running every 10 minutes:
My ipfw.rules:
I would like if someone could give me more tips to make my system secure.
Thank you.
I am running FreeBSD under Windows 7 using VirtualBox. Some days ago I got hacked and I could not connect any more to SSH and MySql.
Here is what I have done to prevent hackers:
Root's password is at least 16 characters mixed with numbers and letters;
Anti DDoS script running every minute:
Code:
#!/bin/sh
MAX_CONN=200
mkdir /tmp/itcforce
TMP_PREFISSO='/tmp/itcforce'
TMP_FILE='ip-abusi'
netstat -ntu -f inet| awk '{if(NR>2 && NF=6) print $5}' | cut -d. -f1-4 | grep '^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$' | sort | uniq -c | sort -nr > $TMP_FILE
while read line; do
COR_LINEA_CONN=$(echo $line | cut -d" " -f1)
COR_LINEA_IP=$(echo $line | cut -d" " -f2)
if [ $COR_LINEA_CONN -lt $MAX_CONN ]; then
break
fi
echo $COR_LINEA_IP > $TMP_PREFISSO/abusi
awk '{$1="/sbin/route add -net "$0}1{$2=" 127.0.0.1 -blackhole"}2' $TMP_PREFISSO/abusi > $TMP_PREFISSO/nullr.sh ; sh $TMP_PREFISSO/nullr.sh
done < $TMP_FILE
rm -rf $TMP_PREFISSOAnti Brute-Force script running every 10 minutes:
Code:
#!/bin/sh
if ipfw show | awk '{print $1}' | grep -q 20000 ; then
ipfw delete 20000
fi
# This catches repeated attempts for both legal and illegal users
# No check for duplicate entries is performed, since the rule
# has been deleted.
awk '/sshd/ && (/Invalid user/ || /authentication error/) {try[$(NF)]++}
END {for (h in try) if (try[h] > 5) print h}' /var/log/auth.log |
while read ip
do
ipfw -q add 20000 deny tcp from $ip to any in
doneMy ipfw.rules:
Code:
IPF="ipfw -q add"
ipfw -q -f flush
#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag
# statefull
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any
$IPF 130 allow tcp from 192.168.1.80 to 192.168.1.69 SSHPort
$IPF 131 deny tcp from any to any SSHPort
#$IPF 150 allow udp from any to any 80 in
#$IPF 155 allow tcp from any to any 80 in
#$IPF 160 allow udp from any to any 80 out
#$IPF 165 allow tcp from any to any 80 out
$IPF 170 allow tcp from 192.168.1.80 to 192.168.1.69 3306
$IPF 171 deny tcp from any to any 3306
# metin2
$IPF 220 allow tcp from 192.168.1.80 to 192.168.1.69 11002 in
$IPF 230 allow tcp from any to any 11002 out
$IPF 240 allow tcp from any to any 13000 in
$IPF 250 allow tcp from any to any 13000 out
$IPF 260 allow tcp from any to any 13001 in
$IPF 270 allow tcp from any to any 13001 out
$IPF 280 allow tcp from any to any 13099 in
$IPF 290 allow tcp from any to any 13099 outI would like if someone could give me more tips to make my system secure.
Thank you.
