Hallo zusammen,
habe einen Server auf 22.04.4 und habe vor vielen Jahren die iptables mit UFW eingerichtet.
Im Grunde waren nur Port 80, 443, und 1111 (für SSH) von außen geöffnet.
Das hat jahrelang perfekt funktioniert. Bis zum 19. Februar dieses Jahres.
Die UFW-Logfiles sind seit dem 19. Februar leer.
Und in der auth.log sehe ich seit dem 19. Februar SSH-Verbindungsversuche auf allen möglichen Ports.
UFW-Status scheint normal zu sein:
1 2 3 4 5 6 7 8 9 10 11 | lukas@ubuntu-2gb-nbg1-1:~$ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] 1111 ALLOW IN Anywhere [ 2] 80 ALLOW IN Anywhere [ 3] 443 ALLOW IN Anywhere [ 4] 1111 (v6) ALLOW IN Anywhere (v6) [ 5] 80 (v6) ALLOW IN Anywhere (v6) [ 6] 443 (v6) ALLOW IN Anywhere (v6) |
Aber in der iptables wüted das Chaos:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 | lukas@ubuntu-2gb-nbg1-1:~$ sudo iptables --list Chain INPUT (policy DROP) target prot opt source destination f2b-sshd tcp -- anywhere anywhere multiport dports 1111 ufw-before-logging-input all -- anywhere anywhere ufw-before-input all -- anywhere anywhere ufw-after-input all -- anywhere anywhere ufw-after-logging-input all -- anywhere anywhere ufw-reject-input all -- anywhere anywhere ufw-track-input all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination ufw-before-logging-forward all -- anywhere anywhere ufw-before-forward all -- anywhere anywhere ufw-after-forward all -- anywhere anywhere ufw-after-logging-forward all -- anywhere anywhere ufw-reject-forward all -- anywhere anywhere ufw-track-forward all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ufw-before-logging-output all -- anywhere anywhere ufw-before-output all -- anywhere anywhere ufw-after-output all -- anywhere anywhere ufw-after-logging-output all -- anywhere anywhere ufw-reject-output all -- anywhere anywhere ufw-track-output all -- anywhere anywhere Chain f2b-sshd (1 references) target prot opt source destination REJECT all -- 36.149.142.237 anywhere reject-with icmp-port-unreachable REJECT all -- 119.187.165.126 anywhere reject-with icmp-port-unreachable REJECT all -- 111.75.151.77 anywhere reject-with icmp-port-unreachable REJECT all -- 91.92.255.200 anywhere reject-with icmp-port-unreachable REJECT all -- static.vnpt.vn anywhere reject-with icmp-port-unreachable REJECT all -- 92.118.39.83 anywhere reject-with icmp-port-unreachable REJECT all -- 92.118.39.81 anywhere reject-with icmp-port-unreachable REJECT all -- 92.118.39.152 anywhere reject-with icmp-port-unreachable REJECT all -- 92.118.39.115 anywhere reject-with icmp-port-unreachable RETURN all -- anywhere anywhere Chain ufw-after-forward (1 references) target prot opt source destination Chain ufw-after-input (1 references) target prot opt source destination ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST Chain ufw-after-logging-forward (1 references) target prot opt source destination Chain ufw-after-logging-input (1 references) target prot opt source destination Chain ufw-after-logging-output (1 references) target prot opt source destination Chain ufw-after-output (1 references) target prot opt source destination Chain ufw-before-forward (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ufw-user-forward all -- anywhere anywhere Chain ufw-before-input (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-logging-deny all -- anywhere anywhere ctstate INVALID DROP all -- anywhere anywhere ctstate INVALID ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc ufw-not-local all -- anywhere anywhere ACCEPT udp -- anywhere mdns.mcast.net udp dpt:mdns ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900 ufw-user-input all -- anywhere anywhere Chain ufw-before-logging-forward (1 references) target prot opt source destination Chain ufw-before-logging-input (1 references) target prot opt source destination Chain ufw-before-logging-output (1 references) target prot opt source destination Chain ufw-before-output (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-user-output all -- anywhere anywhere Chain ufw-logging-allow (0 references) target prot opt source destination Chain ufw-logging-deny (2 references) target prot opt source destination Chain ufw-not-local (1 references) target prot opt source destination RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10 DROP all -- anywhere anywhere Chain ufw-reject-forward (1 references) target prot opt source destination Chain ufw-reject-input (1 references) target prot opt source destination Chain ufw-reject-output (1 references) target prot opt source destination Chain ufw-skip-to-policy-forward (0 references) target prot opt source destination DROP all -- anywhere anywhere Chain ufw-skip-to-policy-input (7 references) target prot opt source destination DROP all -- anywhere anywhere Chain ufw-skip-to-policy-output (0 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain ufw-track-forward (1 references) target prot opt source destination Chain ufw-track-input (1 references) target prot opt source destination Chain ufw-track-output (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere ctstate NEW ACCEPT udp -- anywhere anywhere ctstate NEW Chain ufw-user-forward (1 references) target prot opt source destination Chain ufw-user-input (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:1111 ACCEPT udp -- anywhere anywhere udp dpt:1111 ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT udp -- anywhere anywhere udp dpt:80 ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT udp -- anywhere anywhere udp dpt:https Chain ufw-user-limit (0 references) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain ufw-user-limit-accept (0 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain ufw-user-logging-forward (0 references) target prot opt source destination RETURN all -- anywhere anywhere Chain ufw-user-logging-input (0 references) target prot opt source destination RETURN all -- anywhere anywhere Chain ufw-user-logging-output (0 references) target prot opt source destination RETURN all -- anywhere anywhere Chain ufw-user-output (1 references) target prot opt source destination |
Kann mir hier jemand helfen, zu verstehen, was da in der iptables vor sich geht?
Und kann man daraus dann vielleicht ableiten, weshalb mit diesen Einträgen SSH-Verbindungsversuche auf allen Ports durchgehen?
Danke & viele Grüße, Lukas
PS: Hier noch ein kurzer Auszug aus der auth.log
1 2 3 4 5 6 7 8 9 10 | Jun 3 23:09:22 ubuntu-2gb-nbg1-1 sshd[4159]: Invalid user budawei from 92.118.39.34 port 36498 Jun 3 23:09:22 ubuntu-2gb-nbg1-1 sshd[4159]: pam_unix(sshd:auth): check pass; user unknown Jun 3 23:09:22 ubuntu-2gb-nbg1-1 sshd[4159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34 Jun 3 23:09:24 ubuntu-2gb-nbg1-1 sshd[4159]: Failed password for invalid user budawei from 92.118.39.34 port 36498 ssh2 Jun 3 23:09:25 ubuntu-2gb-nbg1-1 sshd[4161]: Invalid user denglonghui from 92.118.39.37 port 35860 Jun 3 23:09:25 ubuntu-2gb-nbg1-1 sshd[4161]: pam_unix(sshd:auth): check pass; user unknown Jun 3 23:09:25 ubuntu-2gb-nbg1-1 sshd[4161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37 Jun 3 23:09:25 ubuntu-2gb-nbg1-1 sshd[4159]: Connection closed by invalid user budawei 92.118.39.34 port 36498 [preauth] Jun 3 23:09:27 ubuntu-2gb-nbg1-1 sshd[4161]: Failed password for invalid user denglonghui from 92.118.39.37 port 35860 ssh2 Jun 3 23:09:36 ubuntu-2gb-nbg1-1 sshd[4092]: fatal: Timeout before authentication for 117.165.167.70 port 35056 |
