Filtrar SSh por MAC

[Morenisco]

On Tue, October 7, 2008 2:21 pm, Aldrin Martoq wrote:

[...]

> Ahora, para que necesitas filtrar ssh? se supone que es bastante seguro,
> si sufres de paranoia, cambiarlo de puerto seria mas efectivo.

Naah, no es mas efectivo, por ejemplo, cambie el puerto de ssh al 222:

Nota: cambie la IP real por $IP

1) Escaneo basico:

growing:/etc/ssh# nmap $IP

Starting Nmap 4.62 ( http://nmap.org ) at 2008-10-07 17:03 CLT
Interesting ports on dhcp-santiago2-4fl-loc-10-153-250.cl.oracle.com
(10.157.153.250):
Not shown: 1708 closed ports
PORT     STATE SERVICE
80/tcp   open  http
111/tcp  open  rpcbind
113/tcp  open  auth
222/tcp  open  rsh-spx
902/tcp  open  iss-realsecure
3128/tcp open  squid-http
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 0.313 seconds

--> Algo con remote shell esta siendo indicado en el puerto 222.

2) Le hacemos un telnet al puerto 222:

growing:/etc/ssh# telnet $IP
Trying 10.157.153.250...
Connected to 10.157.153.250.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 Debian-2
^C^C^C^C^C^C^C
Connection closed by foreign host.

--> Sale al toke, es SSH...

3) Vamos a pedir mas info del puerto:

growing:/etc/ssh# nmap 10.157.153.250 -p 222 -v -sV

Starting Nmap 4.62 ( http://nmap.org ) at 2008-10-07 17:04 CLT
Initiating Parallel DNS resolution of 1 host. at 17:04
Completed Parallel DNS resolution of 1 host. at 17:04, 0.20s elapsed
Initiating SYN Stealth Scan at 17:04
Scanning XXX ($IP) [1 port]
Discovered open port 222/tcp on $IP
Completed SYN Stealth Scan at 17:04, 0.01s elapsed (1 total ports)
Initiating Service scan at 17:04
Scanning 1 service on XXX ($IP)
Completed Service scan at 17:04, 6.00s elapsed (1 service on 1 host)
SCRIPT ENGINE: Initiating script scanning.
Host XXX ($IP) appears to be up ... good.
Interesting ports on XXX ($IP):
PORT    STATE SERVICE VERSION
222/tcp open  ssh      (protocol 2.0)
1 service unrecognized despite returning data. If you know the
service/version, please submit the following fingerprint at
http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port222-TCP:V=4.62%I=7%D=10/7%Time=48EBCEDE%P=i686-pc-linux-gnu%r(NULL,
SF:20,"SSH-2\.0-OpenSSH_5\.1p1\x20Debian-2\r\n");

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at
http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.290 seconds
           Raw packets sent: 1 (44B) | Rcvd: 2 (88B)

Intentar proteger los servicios via esconderlos no sirve, y se le denomina
"seciruty by obscurity".

Saludos.


-- 
Morenisco.

Centro de Difusión del Software Libre.
http://www.cdsl.cl
Blog: http://morenisco.belvil.eu