如何阻止 synattack？

Question

虽然最初iptables 脚本似乎足以满足您的应用程序的需要，但现在您的服务器却因攻击量的大幅增加而无法承受。建议的解决方案是recent通过将最严重的违规者添加到早期直接 DROP 列表中并严格限制剩余和新攻击者的日志条目速率来避免耗费 CPU 的内容（例如表操作和日志记录）。

#!/bin/sh
FWVER=0.05
#
# Vlark.Lopin rule set. Smythies 2017.01.13 Ver:0.05
#     Add a backup method for identiying bad guys
#     that never hit the connection limit.
#     Legitimate users would only connect
#     and disconnect a maximum of 20 times per day.
#     With lots of some margin, we need a bigger than default
#     number of packets to remember.
#     Extend rate limited logging to all logging.
#
# Vlark.Lopin rule set. Smythies 2017.01.10 Ver:0.04
#     Rate limit logging.
#     It seems a table size of 5000 is being used.
#     Change from a default of ICMP allowed to not.
#
# Vlark.Lopin rule set. Smythies 2017.01.09 Ver:0.03
#     In an attempt to reduce server load with time
#     spent manipulating the recent tables and logging,
#     direct DROP the worst offenders.
#     If the direct DROP list gets very long then
#     consider to use ipset instead as it is much faster.
#     If maintenance of the list is too labour intensive
#     then consider automation with fail2ban.
#
# Vlark.Lopin rule set. Smythies 2016.11.05 Ver:0.02
#     Interface name change from eth0 to ens3.
#
# Vlark.Lopin rule set. Smythies 2016.09.18 Ver:0.01
#     Attempt to manage severe DDOS attack.
#     Port 20000 should only ever have 2 open
#     connections at a time. If more, ban them.
#
#     If too many SSH attempts, ban them.
#     DROP all other unsolicited input.
#     If ssh port has been moved, adjust rules
#     accordingly.
#
#     Requires a larger (5000 X 64) than default (100 X 20)
#     Note: 64 was chosen, becuase it goes to 64 with lower numbers anyhow.
#     xt_recent table size.
#
#     See also:
#     https://askubuntu.com/questions/869205/i-dont-know-what-to-do-to-stop-the-synattack
#     https://askubuntu.com/questions/818524/correctly-limit-ip-connections
#     https://askubuntu.com/questions/808297/i-have-massive-attack-on-port-in-my-server
#     https://askubuntu.com/questions/817478/ip-tables-limit-connetion-per-ip-address-can-be-bypassed
#
#     run as sudo
#

echo "Loading Vlark.Lopin rule set version $FWVER..\n"

# The location of the iptables program
#
IPTABLES=/sbin/iptables

#Setting the EXTERNAL and INTERNAL interfaces and addresses for the network
#
# Vlark.Lopin
EXTIF="ens3"
# Smythies
# EXTIF="enp9s0"
UNIVERSE="0.0.0.0/0"

#Clearing any previous configuration
#
echo "  Clearing any existing rules and setting default policies.."
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
# Otherwise, I can not seem to delete it later on
$IPTABLES -F add-to-connlimit-list
# Delete user defined chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z

echo "...1..."
# We want to force load the xt_recent module, so that we override the
# default maximum table size. We want 5000 whereas the default is 100.
# Note: It is unlikely that it needs to be 5000 forever. Once the
# bad guys give up, the attempts will become much less frequent, and
# the table size can probably be reduced to default.
# i.e. this force load segment can be commented out, and then it will
# autoload as required.
# V0.04: It seems the bad guys actually increased their efforts.
# V0.05: We also need more remembered packets then the default.
# I do not know the extra CPU burden of such a large table.
# Note: The table length seems to go to 64 anyhow, so just use that.
#
modprobe xt_recent ip_list_tot=5000 ip_pkt_list_tot=64

echo "...2..."
#######################################################################
# USER DEFINED CHAIN SUBROUTINES:
#
# add-to-connlimit-list
# To many connections from an IP address has been detected.
# Add the IP address to the bad guy list, and DROP the packet.
# If desired, comment out the log rule.
# V0.04: Rate limit the logging.
$IPTABLES -N add-to-connlimit-list
#$IPTABLES -A add-to-connlimit-list -m recent --update --hitcount 1 --seconds 90000 --name BADGUY_CONN
$IPTABLES -A add-to-connlimit-list -m recent --set --name BADGUY_CONN
$IPTABLES -A add-to-connlimit-list -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix "CONNLIMIT_ADD:" --log-level info
$IPTABLES -A add-to-connlimit-list -j DROP
echo "...3..."

#######################################################################
# INPUT: Incoming traffic from various interfaces.  All rulesets are
#        already flushed and set to a default policy of DROP.
#

# loopback interfaces are valid.
#
$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

# A NEW TCP connection requires SYN bit set and FIN,RST,ACK reset.
# More importantly, this check might prevent lingering packets from
# a forgotten legitimite connection from getting a valid user on the
# bad guy list
#
$IPTABLES -A INPUT -m limit --limit 1/s --limit-burst 2 -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "NEW TCP no SYN:" --log-level info
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT

# Just DROP invalid packets.
#
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -p tcp -m state --state INVALID -j LOG --log-prefix "IINVALID:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -p tcp -m state --state INVALID -j DROP

# direct drops. I do not like you.
#
$IPTABLES -A INPUT -i $EXTIF -s 5.39.126.34 -j DROP
# ... Vlark manages this list ...
$IPTABLES -A INPUT -i $EXTIF -s 219.94.232.125 -j DROP

# Allow any related traffic coming back to the server in.
#
$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -m state --state ESTABLISHED,RELATED -j ACCEPT

# external interface, from any source, for any remaining ICMP traffic is valid
# Note: consider to not allow, as this is often how bad guys find you
# V0.04: Default to commented out.
#
# $IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -j ACCEPT

# Secure Shell on port 22 (Change to whatever port you moved SSH to).
#
# Sometimes I uncomment the next line to simply disable external SSH access.
# Particulalry useful when I am rebooting often, thereby losing my current BADGUY table.
#$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -p tcp -s $UNIVERSE --dport 22 -j DROP

# Dynamic Badguy List. Detect and DROP Bad IPs that do password attacks on SSH.
# Once they are on the BADGUY list then DROP all packets from them.
# Sometimes make the lock time very long. Typically to try to get rid of coordinated attacks from China.
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -m recent --update --hitcount 5 --seconds 90000 --name BADGUY_SSH -j LOG --log-prefix "SSH BAD:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 5 --seconds 90000 --name BADGUY_SSH -j DROP
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 -m recent --set --name BADGUY_SSH -j ACCEPT
echo "...5..."

# Port 20000 part 1 of 2: Limit to 3 simultanious connections per IP address.
# Otherwise ban them.
# Note: The logging is useful for debugging, but might overwhelm the log files. Comment out the logging rule as required.
# V0.04: Rate limit the logging.
#
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -m recent --update --hitcount 1 --seconds 90000 --name BADGUY_CONN -j LOG --log-prefix "CONNLIMIT:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 1 --seconds 90000 --name BADGUY_CONN -j DROP
$IPTABLES -A INPUT -p tcp --dport 20000 -m connlimit --connlimit-above 2 -j add-to-connlimit-list
# $IPTABLES -A INPUT -m limit --limit 1/s --limit-burst 2 -m state --state NEW -p tcp --dport 20000 -j LOG --log-prefix "CONNALLOW:" --log-level info

# Port 20000 part 2 of 2: Limit to 55 attempts to connect per IP address per day.
# Otherwise ban them.
#
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -m recent --update --hitcount 55 --seconds 86400 --name BADGUY_MANY -j LOG --log-prefix "MANY:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 55 --seconds 90000 --name BADGUY_MANY -j DROP
$IPTABLES -A INPUT -p tcp --dport 20000 -m recent --set --name BADGUY_MANY -j ACCEPT
echo "...6..."

# O.K. at this point, we will DROP the packet, however some will be dropped without logging just to make the log file
# less cluttered.
#
$IPTABLES -A INPUT -i $EXTIF -p udp -m multiport --dport 33434:33448 -j DROP
$IPTABLES -A INPUT -i $EXTIF -p tcp -m multiport --dport 23,2323 -j DROP

# If your log file is too cluttered, consider to comment out this log rule.
# It is useful for debugging, but might overwhelm your log files.
# V0.04: Rate limit the logging.
#
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix "ICATCH:" --log-level info
# With a default policy of DROP, the following rule isn't actually neeeded.
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j DROP

echo Vlark.Lopin rule set version $FWVER done.

观察 IP 地址的趋势，例如来自 178.162.???.??? 的坏人，如果您获得更多此类地址，则只需 DROP 整个段，即 178.162.0.0/16，或查找段分配（在本例中为德国）并根据分配掩码 DROP。

我假设这里的源 IP 地址不是假的，因为该规则仅在一次良好的连接后触发，但我可能是错的（在这种情况下这个答案是无用的）。

如果您继续遇到麻烦，那么可以尝试通用速率限制，但您的真正合法客户也会受到影响。

我还假设您不了解所有客户，因此白名单方法不是一个可行的选择。

Answer 1

虽然最初iptables 脚本似乎足以满足您的应用程序的需要，但现在您的服务器却因攻击量的大幅增加而无法承受。建议的解决方案是recent通过将最严重的违规者添加到早期直接 DROP 列表中并严格限制剩余和新攻击者的日志条目速率来避免耗费 CPU 的内容（例如表操作和日志记录）。

#!/bin/sh
FWVER=0.05
#
# Vlark.Lopin rule set. Smythies 2017.01.13 Ver:0.05
#     Add a backup method for identiying bad guys
#     that never hit the connection limit.
#     Legitimate users would only connect
#     and disconnect a maximum of 20 times per day.
#     With lots of some margin, we need a bigger than default
#     number of packets to remember.
#     Extend rate limited logging to all logging.
#
# Vlark.Lopin rule set. Smythies 2017.01.10 Ver:0.04
#     Rate limit logging.
#     It seems a table size of 5000 is being used.
#     Change from a default of ICMP allowed to not.
#
# Vlark.Lopin rule set. Smythies 2017.01.09 Ver:0.03
#     In an attempt to reduce server load with time
#     spent manipulating the recent tables and logging,
#     direct DROP the worst offenders.
#     If the direct DROP list gets very long then
#     consider to use ipset instead as it is much faster.
#     If maintenance of the list is too labour intensive
#     then consider automation with fail2ban.
#
# Vlark.Lopin rule set. Smythies 2016.11.05 Ver:0.02
#     Interface name change from eth0 to ens3.
#
# Vlark.Lopin rule set. Smythies 2016.09.18 Ver:0.01
#     Attempt to manage severe DDOS attack.
#     Port 20000 should only ever have 2 open
#     connections at a time. If more, ban them.
#
#     If too many SSH attempts, ban them.
#     DROP all other unsolicited input.
#     If ssh port has been moved, adjust rules
#     accordingly.
#
#     Requires a larger (5000 X 64) than default (100 X 20)
#     Note: 64 was chosen, becuase it goes to 64 with lower numbers anyhow.
#     xt_recent table size.
#
#     See also:
#     https://askubuntu.com/questions/869205/i-dont-know-what-to-do-to-stop-the-synattack
#     https://askubuntu.com/questions/818524/correctly-limit-ip-connections
#     https://askubuntu.com/questions/808297/i-have-massive-attack-on-port-in-my-server
#     https://askubuntu.com/questions/817478/ip-tables-limit-connetion-per-ip-address-can-be-bypassed
#
#     run as sudo
#

echo "Loading Vlark.Lopin rule set version $FWVER..\n"

# The location of the iptables program
#
IPTABLES=/sbin/iptables

#Setting the EXTERNAL and INTERNAL interfaces and addresses for the network
#
# Vlark.Lopin
EXTIF="ens3"
# Smythies
# EXTIF="enp9s0"
UNIVERSE="0.0.0.0/0"

#Clearing any previous configuration
#
echo "  Clearing any existing rules and setting default policies.."
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
# Otherwise, I can not seem to delete it later on
$IPTABLES -F add-to-connlimit-list
# Delete user defined chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z

echo "...1..."
# We want to force load the xt_recent module, so that we override the
# default maximum table size. We want 5000 whereas the default is 100.
# Note: It is unlikely that it needs to be 5000 forever. Once the
# bad guys give up, the attempts will become much less frequent, and
# the table size can probably be reduced to default.
# i.e. this force load segment can be commented out, and then it will
# autoload as required.
# V0.04: It seems the bad guys actually increased their efforts.
# V0.05: We also need more remembered packets then the default.
# I do not know the extra CPU burden of such a large table.
# Note: The table length seems to go to 64 anyhow, so just use that.
#
modprobe xt_recent ip_list_tot=5000 ip_pkt_list_tot=64

echo "...2..."
#######################################################################
# USER DEFINED CHAIN SUBROUTINES:
#
# add-to-connlimit-list
# To many connections from an IP address has been detected.
# Add the IP address to the bad guy list, and DROP the packet.
# If desired, comment out the log rule.
# V0.04: Rate limit the logging.
$IPTABLES -N add-to-connlimit-list
#$IPTABLES -A add-to-connlimit-list -m recent --update --hitcount 1 --seconds 90000 --name BADGUY_CONN
$IPTABLES -A add-to-connlimit-list -m recent --set --name BADGUY_CONN
$IPTABLES -A add-to-connlimit-list -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix "CONNLIMIT_ADD:" --log-level info
$IPTABLES -A add-to-connlimit-list -j DROP
echo "...3..."

#######################################################################
# INPUT: Incoming traffic from various interfaces.  All rulesets are
#        already flushed and set to a default policy of DROP.
#

# loopback interfaces are valid.
#
$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

# A NEW TCP connection requires SYN bit set and FIN,RST,ACK reset.
# More importantly, this check might prevent lingering packets from
# a forgotten legitimite connection from getting a valid user on the
# bad guy list
#
$IPTABLES -A INPUT -m limit --limit 1/s --limit-burst 2 -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "NEW TCP no SYN:" --log-level info
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j REJECT

# Just DROP invalid packets.
#
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -p tcp -m state --state INVALID -j LOG --log-prefix "IINVALID:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -p tcp -m state --state INVALID -j DROP

# direct drops. I do not like you.
#
$IPTABLES -A INPUT -i $EXTIF -s 5.39.126.34 -j DROP
# ... Vlark manages this list ...
$IPTABLES -A INPUT -i $EXTIF -s 219.94.232.125 -j DROP

# Allow any related traffic coming back to the server in.
#
$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -m state --state ESTABLISHED,RELATED -j ACCEPT

# external interface, from any source, for any remaining ICMP traffic is valid
# Note: consider to not allow, as this is often how bad guys find you
# V0.04: Default to commented out.
#
# $IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -j ACCEPT

# Secure Shell on port 22 (Change to whatever port you moved SSH to).
#
# Sometimes I uncomment the next line to simply disable external SSH access.
# Particulalry useful when I am rebooting often, thereby losing my current BADGUY table.
#$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -p tcp -s $UNIVERSE --dport 22 -j DROP

# Dynamic Badguy List. Detect and DROP Bad IPs that do password attacks on SSH.
# Once they are on the BADGUY list then DROP all packets from them.
# Sometimes make the lock time very long. Typically to try to get rid of coordinated attacks from China.
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -m recent --update --hitcount 5 --seconds 90000 --name BADGUY_SSH -j LOG --log-prefix "SSH BAD:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 5 --seconds 90000 --name BADGUY_SSH -j DROP
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 -m recent --set --name BADGUY_SSH -j ACCEPT
echo "...5..."

# Port 20000 part 1 of 2: Limit to 3 simultanious connections per IP address.
# Otherwise ban them.
# Note: The logging is useful for debugging, but might overwhelm the log files. Comment out the logging rule as required.
# V0.04: Rate limit the logging.
#
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -m recent --update --hitcount 1 --seconds 90000 --name BADGUY_CONN -j LOG --log-prefix "CONNLIMIT:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 1 --seconds 90000 --name BADGUY_CONN -j DROP
$IPTABLES -A INPUT -p tcp --dport 20000 -m connlimit --connlimit-above 2 -j add-to-connlimit-list
# $IPTABLES -A INPUT -m limit --limit 1/s --limit-burst 2 -m state --state NEW -p tcp --dport 20000 -j LOG --log-prefix "CONNALLOW:" --log-level info

# Port 20000 part 2 of 2: Limit to 55 attempts to connect per IP address per day.
# Otherwise ban them.
#
$IPTABLES -A INPUT -i $EXTIF -m limit --limit 1/s --limit-burst 2 -m recent --update --hitcount 55 --seconds 86400 --name BADGUY_MANY -j LOG --log-prefix "MANY:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 55 --seconds 90000 --name BADGUY_MANY -j DROP
$IPTABLES -A INPUT -p tcp --dport 20000 -m recent --set --name BADGUY_MANY -j ACCEPT
echo "...6..."

# O.K. at this point, we will DROP the packet, however some will be dropped without logging just to make the log file
# less cluttered.
#
$IPTABLES -A INPUT -i $EXTIF -p udp -m multiport --dport 33434:33448 -j DROP
$IPTABLES -A INPUT -i $EXTIF -p tcp -m multiport --dport 23,2323 -j DROP

# If your log file is too cluttered, consider to comment out this log rule.
# It is useful for debugging, but might overwhelm your log files.
# V0.04: Rate limit the logging.
#
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix "ICATCH:" --log-level info
# With a default policy of DROP, the following rule isn't actually neeeded.
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j DROP

echo Vlark.Lopin rule set version $FWVER done.

观察 IP 地址的趋势，例如来自 178.162.???.??? 的坏人，如果您获得更多此类地址，则只需 DROP 整个段，即 178.162.0.0/16，或查找段分配（在本例中为德国）并根据分配掩码 DROP。

我假设这里的源 IP 地址不是假的，因为该规则仅在一次良好的连接后触发，但我可能是错的（在这种情况下这个答案是无用的）。

如果您继续遇到麻烦，那么可以尝试通用速率限制，但您的真正合法客户也会受到影响。

我还假设您不了解所有客户，因此白名单方法不是一个可行的选择。

如何阻止 synattack？

答案1

相关内容