/u/33305/crop60893dfd18ede_cropped.png?f=community)
Ik heb hier een server draaien met daarop Debian Squeeze.
Het is een kale installatie met als extra's:
* bind9
* dhcp3-server
* openssh-server
* mc
* ddclient
Nu wordt regelmatig de verbinding verbroken. Als ik dan opnieuw een verbinding probeer te maken, krijg ik de volgende melding:
Nu zou je denken, verwijder de regel uit known_hosts en dan werkt het weer. Dat klopt, maar wat ik raar vind is dat als ik het ip verander, en er een nieuwe regel wordt toegevoegd, dat deze exact hetzelfde is:
Er draait ook een firewall/nat script wat in mijn ogen niet het probleem zal zijn:
Weet iemand waarom mijn ssh verbinding iedere keer eruit klapt? Het gebeurt niet elk minuut, maar toch zeker 5 a 6 keer per week.
Het is een kale installatie met als extra's:
* bind9
* dhcp3-server
* openssh-server
* mc
* ddclient
Nu wordt regelmatig de verbinding verbroken. Als ik dan opnieuw een verbinding probeer te maken, krijg ik de volgende melding:
OpenSSH_5.2p1, OpenSSL 0.9.8l 5 Nov 2009 debug1: Reading configuration data /etc/ssh_config debug1: Connecting to 192.168.2.1 [192.168.2.1] port 22. debug1: Connection established. debug1: identity file /Users/marcel/.ssh/identity type -1 debug1: identity file /Users/marcel/.ssh/id_rsa type -1 debug1: identity file /Users/marcel/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version dropbear_0.52 debug1: no match: dropbear_0.52 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.2 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEXDH_INIT debug1: expecting SSH2_MSG_KEXDH_REPLY @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 21:0e:54:f2:0c:d8:bc:a1:1c:72:e0:3b:e9:ae:f9:82. Please contact your system administrator. Add correct host key in /Users/marcel/.ssh/known_hosts to get rid of this message. Offending key in /Users/marcel/.ssh/known_hosts:3 RSA host key for 192.168.2.1 has changed and you have requested strict checking. Host key verification failed.
Nu zou je denken, verwijder de regel uit known_hosts en dan werkt het weer. Dat klopt, maar wat ik raar vind is dat als ik het ip verander, en er een nieuwe regel wordt toegevoegd, dat deze exact hetzelfde is:
192.168.2.x ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqF4DI59n80jG8QVhxMkLlYcbDeZC//nPAjgk/h+qKszeS8BGFztrUHE4a9i94ku4g/uP95oFo+fcNL+0v/ORe5Zd2WZ3w+kYN04OzzB5DT9p51jECPQ2jjG+cIQ4z8A9FqYaW43uQ7luyi3my1AUUBuogoggTX5GfUN6vmoDtl+9v4BeV5ZwNViMK0beEw63ZVp90ckVMzypdpVjknVdIl5AbXISTuxnM38Quh0At4kJ1x+IeXAKuk9m3WX8LWKqiKj5XYhc+FzMU7hcb6P9YtS5dHZg5w6DWyANzI/YiOyAuj6NqlyMwe3VnRFGOAuDbmojH6yQWBNJEacCueliP 192.168.2.1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqF4DI59n80jG8QVhxMkLlYcbDeZC//nPAjgk/h+qKszeS8BGFztrUHE4a9i94ku4g/uP95oFo+fcNL+0v/ORe5Zd2WZ3w+kYN04OzzB5DT9p51jECPQ2jjG+cIQ4z8A9FqYaW43uQ7luyi3my1AUUBuogoggTX5GfUN6vmoDtl+9v4BeV5ZwNViMK0beEw63ZVp90ckVMzypdpVjknVdIl5AbXISTuxnM38Quh0At4kJ1x+IeXAKuk9m3WX8LWKqiKj5XYhc+FzMU7hcb6P9YtS5dHZg5w6DWyANzI/YiOyAuj6NqlyMwe3VnRFGOAuDbmojH6yQWBNJEacCueliP
Er draait ook een firewall/nat script wat in mijn ogen niet het probleem zal zijn:
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
| #!/bin/sh # # this script requires iptables package to be # installed on your machine # Where to find iptables binary IPT="/sbin/iptables" # The network interface you will use # WAN is the one connected to the internet # LAN the one connected to your local network WAN="eth0" LAN="eth1" # First we need to clear up any existing firewall rules # and chain which might have been created $IPT -F $IPT -F INPUT $IPT -F OUTPUT $IPT -F FORWARD $IPT -F -t mangle $IPT -F -t nat $IPT -X # Default policies: Drop any incoming packets # accept the rest. $IPT -P INPUT DROP $IPT -P OUTPUT ACCEPT $IPT -P FORWARD ACCEPT # To be able to forward traffic from your LAN # to the Internet, we need to tell the kernel # to allow ip forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Masquerading will make machines from the LAN # look like if they were the router $IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE # If you want to allow traffic to specific port to be # forwarded to a machine from your LAN # here we forward traffic to an HTTP server to machine 192.168.0.2 #$IPT -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to 192.168.0.2:80 #$IPT -A FORWARD -i $WAN -p tcp --dport 80 -m state --state NEW -j ACCEPT # For a whole range of port, use: #$IPT -t nat -A PREROUTING -i $WAN -p tcp --dport 1200:1300 -j DNAT --to 192.168.0.2 #$IPT -A FORWARD -i $WAN -p tcp --dport 1200:1300 -m state --state NEW -j ACCEPT # Do not allow new or invalid connections to reach your internal network $IPT -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP # Accept any connections from the local machine $IPT -A INPUT -i lo -j ACCEPT # plus from your local network $IPT -A INPUT -i $LAN -j ACCEPT # Here we define a new chain which is going to handle # packets we don't want to respond to # limit the amount of logs to 10/min $IPT -N Firewall $IPT -A Firewall -m limit --limit 10/minute -j LOG --log-prefix "Firewall: " $IPT -A Firewall -j DROP # log those packets and inform the sender that the packet was rejected $IPT -N Rejectwall $IPT -A Rejectwall -m limit --limit 10/minute -j LOG --log-prefix "Rejectwall: " $IPT -A Rejectwall -j REJECT # use the following instead if you want to simulate that the host is not reachable # for fun though #$IPT -A Rejectwall -j REJECT --reject-with icmp-host-unreachable # here we create a chain to deal with unlegitimate packets # and limit the number of alerts to 10/min # packets will be drop without informing the sender $IPT -N Badflags $IPT -A Badflags -m limit --limit 10/minute -j LOG --log-prefix "Badflags: " $IPT -A Badflags -j DROP # A list of well known combination of Bad TCP flags # we redirect those to the Badflags chain # which is going to handle them (log and drop) $IPT -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j Badflags $IPT -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j Badflags $IPT -A INPUT -p tcp --tcp-flags ACK,URG URG -j Badflags $IPT -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j Badflags $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j Badflags $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j Badflags $IPT -A INPUT -p tcp --tcp-flags ALL ALL -j Badflags $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j Badflags $IPT -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j Badflags $IPT -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j Badflags $IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j Badflags # Accept certain icmp message, drop the others # and log them through the Firewall chain # 0 => echo reply $IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT # 3 => Destination Unreachable $IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT # 11 => Time Exceeded $IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT # 8 => Echo # avoid ping flood $IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT $IPT -A INPUT -p icmp -j Firewall # Accept ssh connections from the Internet $IPT -A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT # or only accept from a certain ip #$IPT -A INPUT -i $WAN -s 125.124.123.122 -p tcp --dport 22 -j ACCEPT # Accept related and established connections $IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # Drop netbios from the outside, no log, just drop $IPT -A INPUT -p udp --sport 137 --dport 137 -j DROP # Finally, anything which was not allowed yet # is going to go through our Rejectwall rule $IPT -A INPUT -j Rejectwall |
Weet iemand waarom mijn ssh verbinding iedere keer eruit klapt? Het gebeurt niet elk minuut, maar toch zeker 5 a 6 keer per week.
/u/26742/000000751.png?f=community)
:strip_icc():strip_exif()/u/79614/Family-Guy-Victory-is-Ours.jpg?f=community)
:strip_icc():strip_exif()/u/162143/crop5b6d888e9cc79_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/17313/_IGP1526kl2.jpg?f=community)
/u/34216/avatar-60x60.png?f=community){kind=avatar}
/u/397074/logo_orange.png?f=community){kind=logo}
