01 02

Brecha no Squid

13. Re: Brecha no Squid

yathal
(usa Debian)

Enviado em 24/10/2012 - 14:05h

perdão, é :



# Versao 01



EXTERNA="eth0"

INTERNA="eth1"



#ipt=$(which iptables)



# Carregar modulos

# -------------------------------------------------------

echo "Carregando Modulos"



# Fazer NAT, de forma geral compatilhada a internet com forward

# -------------------------------------------------------

/sbin/modprobe iptable_nat



# Ativa os modulos de FTP

# -------------------------------------------------------

/sbin/modprobe ip_conntrack

/sbin/modprobe ip_conntrack_ftp

/sbin/modprobe ip_nat_ftp



# Utilizado nas opcoes que geram log.

# -------------------------------------------------------

/sbin/modprobe ipt_LOG



/sbin/modprobe ipt_REJECT

/sbin/modprobe ipt_MASQUERADE



echo "Modulos Carregados [OK]"



# Zera as regras existentes

# -------------------------------------------------------

echo "Limpando regras existentes"

iptables -F

iptables -X

iptables -F -t nat

iptables -X -t nat

iptables -F -t mangle

iptables -X -t mangle



echo "Regras resetadas [OK]"



# Fechando regras padroes

# -------------------------------------------------------

echo "Fechando as regras padroes"



iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD ACCEPT



echo "Regras padroes fechadas [OK]"



# ACCEPT (libera) pacotes de retorno da internet

# -------------------------------------------------------

iptables -A FORWARD -d 65.49.14.0/24 -j LOG --log-prefix "=UltraSurf="

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT



# Faz O NAT compartilhando a conexao

# -------------------------------------------------------

iptables -A POSTROUTING -t nat -o $EXTERNA -j MASQUERADE

echo "1" > /proc/sys/net/ipv4/ip_forward



# Diminui o tamanho dos pacotes da rede

# -------------------------------------------------------

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu



# Protecao contra IP spoofing

# -------------------------------------------------------

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter



# Liberando a interface lo e o localhost

# -------------------------------------------------------

iptables -t filter -A INPUT -i lo -j ACCEPT

iptables -t filter -A INPUT -s 127.0.0.1 -j ACCEPT



# Aceita conexos externas do DNS

# -------------------------------------------------------

iptables -A INPUT -i $INTERNA -p tcp --dport 53 -j ACCEPT

iptables -A INPUT -i $INTERNA -p udp --dport 53 -j ACCEPT



# Libera acesso externo para servidor web

# -------------------------------------------------------

#iptables -A FORWARD -p tcp -m multiport --dports http,https -i $INTERNA -j ACCEPT



# Libera acesso ssh

# -------------------------------------------------------

iptables -A INPUT -p tcp --dport 22 -i $EXTERNA -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -i $INTERNA -j ACCEPT



# Liberando servico de ftp

# -------------------------------------------------------

iptables -A FORWARD -p tcp --dport 20 -j ACCEPT

iptables -A FORWARD -p tcp --dport 21 -j ACCEPT



# Liberar acesso ao msn

# -------------------------------------------------------

iptables -A FORWARD -p tcp --dport 1863 -j REJECT

iptables -A FORWARD -d loginnet.passport.com -j REJECT

iptables -A FORWARD -d 64.4.13.0/24 -j REJECT

iptables -A FORWARD -d login.live.com -j REJECT

iptables -A FORWARD -d login.passport.com -j REJECT

iptables -A FORWARD -d gateway.messenger.hotmail.com -j REJECT

iptables -A OUTPUT -p tcp --dport 1863 -j REJECT

iptables -A OUTPUT -d loginnet.passport.com -j REJECT

iptables -A OUTPUT -d 64.4.13.0/24 -j REJECT

iptables -A OUTPUT -d login.live.com -j REJECT

iptables -A OUTPUT -d login.passport.com -j REJECT

iptables -A OUTPUT -d gateway.messenger.hotmail.com -j REJECT



# Libera POP e SMTP

# -------------------------------------------------------

iptables -A FORWARD -p tcp -m multiport --dports smtp,pop3,submission -j ACCEPT



#Sistema sped Fiscal

# --------------------------------------------------------

iptables -t nat -A PREROUTING -i $INTERNA -p tcp -d 200.198.239.21 --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $EXTERNA -p tcp -d 200.198.239.21 --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $INTERNA -p tcp -d sped.fazenda.gov.br --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $EXTERNA -p tcp -d sped.fazenda.gov.br --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $INTERNA -p tcp --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $INTERNA -p udp --dport 3443 -j ACCEPT



# DNDigital

# --------------------------------------------------------

iptables -t nat -A PREROUTING -p tcp -d 201.24.80.42 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 201.24.80.43 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 201.24.80.46 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 200.180.119.41 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 189.42.17.116 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 187.5.132.219 -j ACCEPT

iptables -A INPUT -d 200.18.118.12 -j ACCEPT

iptables -A INPUT -d 189.42.17.115 -j ACCEPT

iptables -A INPUT -d 200.180.118.11 -j ACCEPT

iptables -A INPUT -d 200.180.118.64 -j ACCEPT

iptables -A INPUT -d 189.42.17.120 -j ACCEPT

iptables -A INPUT -d 200.180.118.65 -j ACCEPT

iptables -A INPUT -d 189.42.17.121 -j ACCEPT





#Bloqueia IMO.im

iptables -A FORWARD -d 64.13.161.61 -j REJECT

iptables -A OUTPUT -d 64.13.161.61 -j REJECT



# MSN

# -------------------------------------------------------

iptables -A OUTPUT -o $EXTERNA -p tcp -m multiport --dports 1863,7001 -j REJECT

iptables -A OUTPUT -o $EXTERNA -p udp --dport 7001 -j REJECT

iptables -A FORWARD -p tcp -m multiport --dports 1863,7001 -j REJECT

iptables -A FORWARD -p udp -m multiport --dports 7001 -j REJECT



# Libera porta 3128 do squid

#--------------------------------------------------------

iptables -A INPUT -p tcp --dport 3128 -i $INTERNA -j ACCEPT



# Libera porta 80 do squid

#--------------------------------------------------------

iptables -A INPUT -p tcp --dport 80 -i $INTERNA -j ACCEPT



# Redireciona trafego da porta 80 para a 3128

# -------------------------------------------------------

iptables -t nat -A PREROUTING -i $INTERNA -p tcp --dport 80 -j REDIRECT --to-port 3128



# Protecao contra ping da morte

# -------------------------------------------------------

iptables -t filter -A INPUT -p icmp -m icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 5 -j ACCEPT

0 0

Quote

14. Re: Brecha no Squid

saitam
(usa Slackware)

Enviado em 24/10/2012 - 14:11h

Para ninguém burlar o proxy autenticado deve ter a seguinte política abaixo.

* Iniciar tudo DROP
* Apenas liberar as portas dos serviços necessárias
* Jamais liberar as portas 80 e 443 na chain FORWARD, isso deve forçar passar no proxy squid

Desse forma, se alguém tentar retirar o IP:PORTA no navegador ficará sem acesso a internet, e também pode tentar https://facebook.com DENIED

Maiores informações:
http://mundodacomputacaointegral.blogspot.com.br/2011/12/configurando-servidor-proxy-autenticado.htm...

http://mundodacomputacaointegral.blogspot.com.br/2012/05/entendendo-o-funcionamento-de-um.html

0 0

Quote

15. Re: Brecha no Squid

yathal
(usa Debian)

Enviado em 24/10/2012 - 14:54h

Amigo, segundo as dicas, eu coloquei DROP nas regras padrões, continuo sem liberar as portas.
Ai adicionei o redirecionamento da 80 pra 3128.
Está correto?



# Versao 01

 

EXTERNA="eth0"

INTERNA="eth1"

 

#ipt=$(which iptables)

 

# Carregar modulos

# -------------------------------------------------------

echo "Carregando Modulos"

 

# Fazer NAT, de forma geral compatilhada a internet com forward

# -------------------------------------------------------

/sbin/modprobe iptable_nat

 

# Ativa os modulos de FTP

# -------------------------------------------------------

/sbin/modprobe ip_conntrack

/sbin/modprobe ip_conntrack_ftp

/sbin/modprobe ip_nat_ftp

 

# Utilizado nas opcoes que geram log.

# -------------------------------------------------------

/sbin/modprobe ipt_LOG

 

/sbin/modprobe ipt_REJECT

/sbin/modprobe ipt_MASQUERADE

 

echo "Modulos Carregados [OK]"

 

# Zera as regras existentes

# -------------------------------------------------------

echo "Limpando regras existentes"

iptables -F

iptables -X

iptables -F -t nat

iptables -X -t nat

iptables -F -t mangle

iptables -X -t mangle

 

echo "Regras resetadas [OK]"

 

# Fechando regras padroes

# -------------------------------------------------------

echo "Fechando as regras padroes"

 

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

 

echo "Regras padroes fechadas [OK]"



#Proxy(Squid) - Redirecionando tráfego porta 80 para porta 3128(Squid) 

iptables -t nat -A PREROUTING -p tcp -m multiport -s $LAN --dport 80,443 -j REDIRECT --to-ports 3128 

echo "Redirecionando tráfego porta 80 para porta 3128(Squid) " 

 

# ACCEPT (libera) pacotes de retorno da internet

# -------------------------------------------------------

iptables -A FORWARD -d 65.49.14.0/24 -j LOG --log-prefix "=UltraSurf="

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

 

# Faz O NAT compartilhando a conexao

# -------------------------------------------------------

iptables -A POSTROUTING -t nat -o $EXTERNA -j MASQUERADE

echo "1" > /proc/sys/net/ipv4/ip_forward

 

# Diminui o tamanho dos pacotes da rede

# -------------------------------------------------------

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu

 

# Protecao contra IP spoofing

# -------------------------------------------------------

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

 

# Liberando a interface lo e o localhost

# -------------------------------------------------------

iptables -t filter -A INPUT -i lo -j ACCEPT

iptables -t filter -A INPUT -s 127.0.0.1 -j ACCEPT

 

# Aceita conexos externas do DNS

# -------------------------------------------------------

iptables -A INPUT -i $INTERNA -p tcp --dport 53 -j ACCEPT

iptables -A INPUT -i $INTERNA -p udp --dport 53 -j ACCEPT

 

# Libera acesso externo para servidor web

# -------------------------------------------------------

#iptables -A FORWARD -p tcp -m multiport --dports http,https -i $INTERNA -j ACCEPT

 

# Libera acesso ssh

# -------------------------------------------------------

iptables -A INPUT -p tcp --dport 22 -i $EXTERNA -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -i $INTERNA -j ACCEPT

 

# Liberando servico de ftp

# -------------------------------------------------------

iptables -A FORWARD -p tcp --dport 20 -j ACCEPT

iptables -A FORWARD -p tcp --dport 21 -j ACCEPT

 

# Liberar acesso ao msn

# -------------------------------------------------------

iptables -A FORWARD -p tcp --dport 1863 -j REJECT

iptables -A FORWARD -d loginnet.passport.com -j REJECT

iptables -A FORWARD -d 64.4.13.0/24 -j REJECT

iptables -A FORWARD -d login.live.com -j REJECT

iptables -A FORWARD -d login.passport.com -j REJECT

iptables -A FORWARD -d gateway.messenger.hotmail.com -j REJECT

iptables -A OUTPUT -p tcp --dport 1863 -j REJECT

iptables -A OUTPUT -d loginnet.passport.com -j REJECT

iptables -A OUTPUT -d 64.4.13.0/24 -j REJECT

iptables -A OUTPUT -d login.live.com -j REJECT

iptables -A OUTPUT -d login.passport.com -j REJECT

iptables -A OUTPUT -d gateway.messenger.hotmail.com -j REJECT

 

# Libera POP e SMTP

# -------------------------------------------------------

iptables -A FORWARD -p tcp -m multiport --dports smtp,pop3,submission -j ACCEPT

 

#Sistema sped Fiscal

# --------------------------------------------------------

iptables -t nat -A PREROUTING -i $INTERNA -p tcp -d 200.198.239.21 --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $EXTERNA -p tcp -d 200.198.239.21 --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $INTERNA -p tcp -d sped.fazenda.gov.br --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $EXTERNA -p tcp -d sped.fazenda.gov.br --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $INTERNA -p tcp --dport 3443 -j ACCEPT

iptables -t nat -A PREROUTING -i $INTERNA -p udp --dport 3443 -j ACCEPT

 

# DNDigital

# --------------------------------------------------------

iptables -t nat -A PREROUTING -p tcp -d 201.24.80.42 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 201.24.80.43 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 201.24.80.46 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 200.180.119.41 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 189.42.17.116 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -d 187.5.132.219 -j ACCEPT

iptables -A INPUT -d 200.18.118.12 -j ACCEPT

iptables -A INPUT -d 189.42.17.115 -j ACCEPT

iptables -A INPUT -d 200.180.118.11 -j ACCEPT

iptables -A INPUT -d 200.180.118.64 -j ACCEPT

iptables -A INPUT -d 189.42.17.120 -j ACCEPT

iptables -A INPUT -d 200.180.118.65 -j ACCEPT

iptables -A INPUT -d 189.42.17.121 -j ACCEPT

 

 

#Bloqueia IMO.im

iptables -A FORWARD -d 64.13.161.61 -j REJECT

iptables -A OUTPUT -d 64.13.161.61 -j REJECT

 

# MSN

# -------------------------------------------------------

iptables -A OUTPUT -o $EXTERNA -p tcp -m multiport --dports 1863,7001 -j REJECT

iptables -A OUTPUT -o $EXTERNA -p udp --dport 7001 -j REJECT

iptables -A FORWARD -p tcp -m multiport --dports 1863,7001 -j REJECT

iptables -A FORWARD -p udp -m multiport --dports 7001 -j REJECT

 

# Libera porta 3128 do squid

#--------------------------------------------------------

iptables -A INPUT -p tcp --dport 3128 -i $INTERNA -j ACCEPT

 

# Libera porta 80 do squid

#--------------------------------------------------------

iptables -A INPUT -p tcp --dport 80 -i $INTERNA -j ACCEPT

 

# Redireciona trafego da porta 80 para a 3128

# -------------------------------------------------------

iptables -t nat -A PREROUTING -i $INTERNA -p tcp --dport 80 -j REDIRECT --to-port 3128

 

# Protecao contra ping da morte

# -------------------------------------------------------

iptables -t filter -A INPUT -p icmp -m icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 5 -j ACCEPT