nmapなどのポートスキャンにより開放ポートを調査されて脆弱性攻撃されないようにする方法は無いものかと調べてみました｡
検証サーバ
CentOS Linux release 7.2.1511 (Core)
3.10.0-327.36.1.el7.x86_64
参考サイト
フルポートスキャンから開放ポートを隠す方法
http://d.hatena.ne.jp/yasulib/20150302/1425282464
ダイレクトルールを使ったFirewallの強化
http://www.yam-web.net/centos7/direct-rule/index.html
CentOS 7では標準のFirewallはiptables, ip6tablesからfirewalldに変更になっています｡
今回は参考サイトのようにダイレクトルール(firewall-cmd --direct)で設定してみました｡
- ルールの確認
- nmapによるポートスキャン
- ポートスキャン対策ルール追加
- ルールの再読込
- ルールの確認
- nmapでポートスキャン
デフォルトの状態です｡
|
1 2 3 4 5 6 7 8 9 10 11 12 |
# firewall-cmd --list-all public (default, active) interfaces: eno16777736 sources: services: dhcpv6-client ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules: # firewall-cmd --direct --get-all-rules |
ssh(22)ポートが開放されています｡
|
1 2 3 4 5 6 7 8 9 |
# nmap -v 192.168.1.2 Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2016-10-11 17:18 JST Initiating ARP Ping Scan against 192.168.1.2 [1 port] at 17:18 The ARP Ping Scan took 0.00s to scan 1 total hosts. DNS resolution of 1 IPs took 0.00s. Initiating SYN Stealth Scan against 192.168.1.2 [1680 ports] at 17:18 Discovered open port 22/tcp on 192.168.1.2 Increasing send delay for 192.168.1.2 from 0 to 5 due to max_successful_tryno increase to 4 |
limitモジュールを使用して1秒間にSYNパケットが5以上連続するとログに書き出して以降はSYNパケットをドロップします｡
|
1 2 3 4 5 |
# firewall-cmd --permanent --direct --add-chain ipv4 filter port-scan # firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 400 -i eno16777736 -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j port-scan # firewall-cmd --permanent --direct --add-rule ipv4 filter port-scan 450 -m limit --limit 1/s --limit-burst 4 -j RETURN # firewall-cmd --permanent --direct --add-rule ipv4 filter port-scan 451 -j LOG --log-prefix "IPTABLES PORT-SCAN:" # firewall-cmd --permanent --direct --add-rule ipv4 filter port-scan 452 -j DROP |
|
1 2 |
# firewall-cmd --reload success |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
# firewall-cmd --list-all public (default, active) interfaces: eno16777736 sources: services: dhcpv6-client ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules: # firewall-cmd --direct --get-all-chains ipv4 filter port-scan # firewall-cmd --direct --get-all-rules ipv4 filter INPUT 400 -i eno16777736 -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j port-scan ipv4 filter port-scan 450 -m limit --limit 1/s --limit-burst 4 -j RETURN ipv4 filter port-scan 451 -j LOG --log-prefix 'IPTABLES PORT-SCAN:' ipv4 filter port-scan 452 -j DROP # iptables -L -v (snip) Chain INPUT_direct (1 references) pkts bytes target prot opt in out source destination 0 0 port-scan tcp -- eno16777736 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN (snip) Chain port-scan (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN all -- any any anywhere anywhere limit: avg 1/sec burst 4 0 0 LOG all -- any any anywhere anywhere LOG level warning prefix "IPTABLES PORT-SCAN:" 0 0 DROP all -- any any anywhere anywhere |
ssh(22)ポート見えなくなっています｡
|
1 2 3 4 5 6 7 8 |
# nmap -v 192.168.1.2 Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2016-10-11 17:26 JST Initiating ARP Ping Scan against 192.168.1.2 [1 port] at 17:26 The ARP Ping Scan took 0.01s to scan 1 total hosts. DNS resolution of 1 IPs took 0.00s. Initiating SYN Stealth Scan against 192.168.1.2 [1680 ports] at 17:26 Increasing send delay for 192.168.1.2 from 0 to 5 due to max_successful_tryno increase to 4 |
ログ(/var/log/message)にドロップログが記録されます｡
|
1 |
Oct 11 17:27:44 host01 kernel: IPTABLES PORT-SCAN:IN=eno16777736 OUT= MAC=00:0c:29:1d:bf:ff:00:0b:29:6f:b1:4b:07:00 SRC=192.168.1.1 DST=192.168.1.2 LEN=44 TOS=0x00 PREC=0x00 TTL=41 ID=11127 PROTO=TCP SPT=51406 DPT=34 WINDOW=2048 RES=0x00 SYN URGP=0 |
ただ実際はポートを直接指定されると発見されてしまいました｡バージョンも確認できます｡
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# nmap -v -sV -p 22 192.168.1.2 Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2016-10-11 21:29 JST Initiating ARP Ping Scan against 192.168.1.2 [1 port] at 21:29 The ARP Ping Scan took 0.01s to scan 1 total hosts. DNS resolution of 1 IPs took 0.00s. Initiating SYN Stealth Scan against 192.168.1.2 [1 port] at 21:29 Discovered open port 22/tcp on 192.168.1.2 The SYN Stealth Scan took 0.01s to scan 1 total ports. Initiating service scan against 1 service on 192.168.1.2 at 21:29 The service scan took 6.00s to scan 1 service on 1 host. Host 192.168.1.2 appears to be up ... good. Interesting ports on 192.168.1.2: PORT STATE SERVICE VERSION 22/tcp open ssh (protocol 2.0) 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi : SF-Port22-TCP:V=4.11%I=7%D=10/11%Time=57FCDB1E%P=i686-redhat-linux-gnu%r(N SF:ULL,17,"SSH-2\.0-OpenSSH_6\.6\.1\r\n"); MAC Address: 00:0C:29:1D:BF:FF (VMware) Nmap finished: 1 IP address (1 host up) scanned in 6.105 seconds Raw packets sent: 2 (86B) | Rcvd: 2 (88B) |
さらにsshdのデフォルトポート22を他のポートで起動することでかなり有効かもしれません｡