Secure Raspberry Pi with iptables, PSAD, Fail2ban and OSSEC
Disable ping
|
1 |
$ echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all |
Install iptables and iptables-persistent
|
1 2 |
$ sudo apt-get install iptables iptables-persistent $ sudo service iptables-persistent start |
Create shell script
|
1 |
$ nano reset_iptables.sh |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
#!/usr/bin/env bash iptables -F iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP iptables -A INPUT -f -j DROP iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP iptables -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP # # PACKETS chain # iptables -N PACKET iptables -A PACKET -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT iptables -A PACKET -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j ACCEPT #limit ping to 1 per second #iptables -A INPUT -p icmp -j DROP #iptables -A PACKET -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT # # STATE_TRACK chain (connection tracking) # iptables -N STATE_TRACK iptables -A STATE_TRACK -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A STATE_TRACK -m state --state INVALID -j DROP # # PORTSCAN chain (drop common attacks) # iptables -N PORTSCAN iptables -A PORTSCAN -p tcp --tcp-flags ACK,FIN FIN -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ACK,PSH PSH -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ACK,URG URG -j DROP iptables -A PORTSCAN -p tcp --tcp-flags FIN,RST FIN,RST -j DROP iptables -A PORTSCAN -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP iptables -A PORTSCAN -p tcp --tcp-flags SYN,RST SYN,RST -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ALL ALL -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ALL NONE -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP iptables -A PORTSCAN -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP # Disable ping response iptables -A OUTPUT -p icmp -o eth0 -j ACCEPT iptables -A INPUT -p icmp -j DROP #allow all outgoing access iptables -A OUTPUT -o eth0 -j ACCEPT iptables -I INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
1 2 |
$ sudo chmod a+x reset_iptables.sh $ sudo ./reset_iptables.sh |
Install PSAD (Port Scan Attack Detection) References: http://cipherdyne.org/psad/download/ https://www.digitalocean.com/community/tutorials/how-to-use-psad-to-detect-network-intrusion-attempts-on-an-ubuntu-vps
|
1 2 3 4 |
$ wget http://cipherdyne.org/psad/download/psad-2.4.3.tar.gz $ tar xvfz psad-2.4.3.tar.gz $ cd psad-2.4.3 $ sudo ./install.pl |
Set configurations
|
1 |
$ sudo nano /etc/psad/psad.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 |
EMAIL_ADDRESSES psad@loopback; # Don't want to receive any email HOSTNAME raspberrypi; # Set to hostname HOME_NET 192.168.1.0/24; # Set to internal IP HTTP_PORTS 8080; # Set custom HTTP port SHELLCODE_PORTS !8080; # Set custom HTTP port ENABLE_AUTO_IDS Y; # Set to automatically configure iptables AUTO_IDS_DANGER_LEVEL 1; # Set to 1 for strict AUTO_BLOCK_TIMEOUT 999999999; # Make permanent ENABLE_AUTO_IDS_EMAILS N; IPT_AUTO_CHAIN1 DROP, src, filter, INPUT, 1, PSAD_BLOCK_INPUT, 1; #IPT_AUTO_CHAIN2 DROP, dst, filter, OUTPUT, 1, PSAD_BLOCK_OUTPUT, 1; #IPT_AUTO_CHAIN3 DROP, both, filter, FORWARD, 1, PSAD_BLOCK_FORWARD, 1; |
Set IP address that to be ignored
|
1 |
$ nano /etc/psad/auto_dl |
|
1 2 |
192.168.1.0/24 0; #ignore interal ip 221.229.1.0/24 5; # permanent ban |
|
1 2 3 |
$ sudo psad --sig-update $ sudo service psad restart $ sudo service psad status |
Install Fail2ban References: http://www.fail2ban.org/wiki/index.php/Main_Page https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-7
|
1 |
$ sudo apt-get install fail2ban postfix |
Set configurations
|
1 |
$ sudo nano /etc/fail2ban/jail.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 |
# Fail2Ban configuration file. # # This file was composed for Debian systems from the original one # provided now under /usr/share/doc/fail2ban/examples/jail.conf # for additional examples. # # To avoid merges during upgrades DO NOT MODIFY THIS FILE # and rather provide your changes in /etc/fail2ban/jail.local # # Author: Yaroslav O. Halchenko <debian@onerussian.com> # # $Revision$ # # The DEFAULT allows a global definition of the options. They can be overridden # in each jail afterwards. [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.0/24 192.168.1.0/24 bantime = -1 maxretry = 3 # "backend" specifies the backend used to get files modification. Available # options are "gamin", "polling" and "auto". backend = auto # # Destination email address used solely for the interpolations in # jail.{conf,local} configuration files. destemail = fail2ban@loopback # # ACTIONS # # Default banning action (e.g. iptables, iptables-new, # iptables-multiport, shorewall, etc) It is used to define # action_* variables. Can be overridden globally or per # section within jail.local file banaction = iptables-multiport # email action. Since 0.8.1 upstream fail2ban uses sendmail # MTA for the mailing. Change mta configuration parameter to mail # if you want to revert to conventional 'mail'. mta = sendmail # Default protocol protocol = tcp # Specify chain where jumps would need to be added in iptables-* actions chain = INPUT # # Action shortcuts. To be used to define action parameter # The simplest action to take: ban only action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report to the destemail. action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report and relevant log lines # to the destemail. action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] # Choose default action. To change, just override value of 'action' with the # interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local # globally (section [DEFAULT]) or per specific section action = %(action_)s # # JAILS # # Next jails corresponds to the standard configuration in Fail2ban 0.6 which # was shipped in Debian. Enable any defined here jail by including # # [SECTION_NAME] # enabled = true # # in /etc/fail2ban/jail.local. # # Optionally you may override any other parameter (e.g. banaction, # action, port, logpath, etc) in that section within jail.local [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 [ssh-ddos] enabled = true port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 3 # # HTTP servers # [apache] enabled = true port = http,https filter = apache-auth logpath = /var/log/apache*/*error.log maxretry = 3 # default action is now multiport, so apache-multiport jail was left # for compatibility with previous (<0.7.6-2) releases [apache-multiport] enabled = true port = http,https filter = apache-auth logpath = /var/log/apache*/*error.log maxretry = 3 [apache-noscript] enabled = true port = http,https filter = apache-noscript logpath = /var/log/apache*/*error.log maxretry = 3 [apache-overflows] enabled = true port = http,https filter = apache-overflows logpath = /var/log/apache*/*error.log maxretry = 2 [invalidmethod] enabled = true port = http,https filter = invalidmethod logpath = /var/log/apache*/*access.log findtime = 10800 maxretry = 3 # # FTP servers # [vsftpd] enabled = true port = ftp,ftp-data,ftps,ftps-data filter = vsftpd logpath = /var/log/vsftpd.log # or overwrite it in jails.local to be # logpath = /var/log/auth.log # if you want to rely on PAM failed login attempts # vsftpd's failregex should match both of those formats maxretry = 3 # # Mail servers # [postfix] enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log |
Update iptables-multiport.conf […]