0

I have a vps, which host some service only I used. Today, I found someone scaning my vps by

netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n

And found some result(I have removed my ip from below)

1 xxxxxxxxxxx:59564
1 xxxxxxxxxxx:59569
1 xxxxxxxxxxx:59570
1 xxxxxxxxxxx:59576
1 120.236.148.199:2226
1 127.0.0.1:41108
1 127.0.0.1:41148
1 127.0.0.1:41156
1 127.0.0.1:41158
1 127.0.0.1:41178
1 127.0.0.1:41180
1 183.61.236.54:3128
1 213.13.37.231:3128
1 218.244.149.184:8888
1 46.164.141.173:8080
1 58.96.172.205:8888
1 Address
1 servers)
2 ::1:9988
2 219.156.157.186:80
10 127.0.0.1:3306
11 127.0.0.1:3999

I have some webservice only for myself, I want to ban all ip once they access other ports, but there are some problems.

  1. I setup a socks5 proxy on 8699, but it seems open some other port to serve my connection:

    tcp6       0      0 default.hostname:8699   my_vps_ip_here.bro:59570 ESTABLISHED
    tcp6       0      0 default.hostname:8699   my_vps_ip_here.bro:59576 ESTABLISHED
    tcp6       0      0 default.hostname:8699   my_vps_ip_here.bro:59564 ESTABLISHED
    tcp6       0      0 default.hostname:8699   my_vps_ip_here.bro:59569 ESTABLISHED
    

    netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n doesn't shows I am connecting 8699, only shows 59570, 59576, 59564, 59569. What is the correct rule for this case ?

  2. What is the recommended way to automatically ban IP? I only come up with: keep check the result of netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n every second, and add bad ip to iptables.

  3. I know iptables and ufw can ban ip, ufw looks more like a manager, but is there any better choice ?

1
  • You are mistaken, you still connect via 8699 you just get forked to another port because if it wouldn't do that there could always be only 1 user connecting to a port.
    – Ziazis
    Jul 25, 2017 at 7:11

2 Answers 2

1

**

What is the recommended way to automatically ban IP?

**

iptables and ufw can do better with a little automation. fail2ban does that and I would recommend that as a good choice. Do preliminary checks,

  • check for established connections sudo lsof -i -n | egrep '<sshd>' | grep ESTABLISHED sudo lsof -i -n | egrep '<ssh>' | grep ESTABLISHED

  • check for weird users & sudo-ers

    getent group sudo | cut -d: -f4
    grep -Po '^sudo.+:\K.*$' /etc/group
    

Persistent Bans

With a little tweak, you can ban repeated attempts and restore the ban in effect.

install fail2ban,

apt install fail2ban

now edit the multiport.conf file in fail2ban vim or nano,

nano /etc/fail2ban/action.d/iptables-multiport.conf

append these lines to 'actionstart' (from 4th line i guess )

cat /etc/fail2ban/persistent.bans | awk '/^fail2ban-<name>/ {print $2}' \
          | while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j <blocktype>; done

such that it looks something like this

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = <iptables> -N f2b-<name>
              <iptables> -A f2b-<name> -j <returntype>
              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
        cat /etc/fail2ban/persistent.bans | awk '/^fail2ban-<name>/ {print $2}' \
          | while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j <blocktype>; done

append this line to 'actionban' right after the line actionban = ... for a persistent ban on the ips

echo "fail2ban-<name> <ip>" >> /etc/fail2ban/persistent.bans

now restart fail2ban,

sudo service fail2ban restart

and give some 'ban'

   sudo fail2ban-client set sshd banip  112.0.0.0/8  
   sudo fail2ban-client set sshd banip  222.186.0.0/16

now check for effective persistent bans,

tail /var/log/fail2ban.log

you should see something like,

NOTICE  [sshd] Restore Ban 112.0.0.0/8

this way repeated attacks can be avoided and now you can use iptables to allow just for your ip

PS: as fail2ban works on banning persistently the attackers, you can just relax and make sure no ESTABLISHED connections to the services using,

sudo lsof -i -n | egrep '\<ssh\>'   
sudo lsof -i -n | egrep '\<sshd\>'   

(note that you need specific 'jail' for specific service ) and see the persistent bans

cat /etc/fail2ban/persistent.bans

Output:

fail2ban-sshd 112.0.0.0/8
fail2ban-sshd 218.92.0.0/16
fail2ban-sshd 218.92.0.138

Explanation

  1. actionstart: we can add some action commands that will execute only during fail2ban start. so, we added /etc/fail2ban/persistent.bans during start

  2. actionban: whenever a ban is imposed on an ip, the ip is added to persistent.bans file which will be in effect during the fail2ban run. You can relaxed-edit this file later if you feel an ip is not involved in malicious attacks.

  3. you can manually ban ip's in question using

    sudo fail2ban-client set sshd banip  112.0.0.0/8  
    sudo fail2ban-client set sshd banip  222.186.0.0/16
    
0

psad checks for portscans and can react accordingly, check this link for a short description on how to configure it. I just googled it, there are numerous other tutorials as well. It is available in the ubuntu repositories, see here.

Also Fail2ban could be something for you, see their wiki for more info. It essentially checks log-files for you and can block IP-addresses automatically. It is available in the ubuntu repositories, see here.

1
  • These tools are great to use. May you briefly describe how to install/use these tools rather than including external links?
    – Gordster
    Nov 2, 2020 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .