SYN saldirilari icin alternatif IPTABLES komutlari

SYN saldirilari oldugunda sunucu yazilimlara ulasan asiri sayidaki paket nedeniyle apache gibi bi cok yazilim asiri yukten tikaniyor. Sistem calisamaz hale geliyor.

Bu tip durumlarda netstat -na |grep SYN ile saldiri yapan ipler tespit edilir.. ve iptraf ile bu asiri baglanti yapan iplerin bazi durumlari tespit edilir...

Ornek : TTL, saldirilan adres, saldiri esnasinda 1 baglantida olusan trafik ( genelde 40 byte ) gibi bilgiler filtrelebilir...

 

String :

iptables -I INPUT -j DROP -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 -m string –algo bm –string “index.php”

iptables -I INPUT -j DROP -p tcp -s 0.0.0.0/0 -m string –algo bm –string “//trade/?a=forgot_password”


TTL filtresi :

iptables -A INPUT -p tcp  -s 0.0.0.0/0 -d attackedip -m ttl –ttl 111 -j DROP

 

Baglantida olusan trafik filtresi :

iptables -A INPUT -p tcp -d attackedip -m length –length 40:48 -j DROP

 

Yorum (yok) Yorum yaz!

Linux konsol komutlari

alias    Create an alias
apropos Search Help manual pages (man -k)
awk Find and Replace text, database sort/validate/index
break Exit from a loop
builtin Run a shell builtin
bzip2 Compress or decompress named file(s)

cal Display a calendar
case Conditionally perform a command
cat Display the contents of a file
cd Change Directory
cfdisk Partition table manipulator for Linux
chgrp Change group ownership
chmod Change access permissions
chown Change file owner and group
chroot Run a command with a different root directory
cksum Print CRC checksum and byte counts
clear Clear terminal screen
cmp Compare two files
comm Compare two sorted files line by line
command Run a command - ignoring shell functions
continue Resume the next iteration of a loop
cp Copy one or more files to another location
cron Daemon to execute scheduled commands
crontab Schedule a command to run at a later time
csplit Split a file into context-determined pieces
cut Divide a file into several parts

date Display or change the date & time
dc Desk Calculator
dd Data Dump - Convert and copy a file
ddrescue Data recovery tool
declare Declare variables and give them attributes
df Display free disk space
diff Display the differences between two files
diff3 Show differences among three files
dig DNS lookup
dir Briefly list directory contents
dircolors Colour setup for `ls'
dirname Convert a full pathname to just a path
dirs Display list of remembered directories
du Estimate file space usage

echo Display message on screen
egrep Search file(s) for lines that match an extended expression
eject Eject removable media
enable Enable and disable builtin shell commands
env Environment variables
ethtool Ethernet card settings
eval Evaluate several commands/arguments
exec Execute a command
exit Exit the shell
expand Convert tabs to spaces
export Set an environment variable
expr Evaluate expressions

false Do nothing, unsuccessfully
fdformat Low-level format a floppy disk
fdisk Partition table manipulator for Linux
fgrep Search file(s) for lines that match a fixed string
file Determine file type
find Search for files that meet a desired criteria
fmt Reformat paragraph text
fold Wrap text to fit a specified width.
for Expand words, and execute commands
format Format disks or tapes
free Display memory usage
fsck File system consistency check and repair
ftp File Transfer Protocol
function Define Function Macros

gawk Find and Replace text within file(s)
getopts Parse positional parameters
grep Search file(s) for lines that match a given pattern
groups Print group names a user is in
gzip Compress or decompress named file(s)

hash Remember the full pathname of a name argument
head Output the first part of file(s)
history Command History
hostname Print or set system name

id Print user and group id's
if Conditionally perform a command
ifconfig Configure a network interface
import Capture an X server screen and save the image to file
install Copy files and set attributes

join Join lines on a common field

kill Stop a process from running

less Display output one screen at a time
let Perform arithmetic on shell variables
ln Make links between files
local Create variables
locate Find files
logname Print current login name
logout Exit a login shell
look Display lines beginning with a given string
lpc Line printer control program
lpr Off line print
lprint Print a file
lprintd Abort a print job
lprintq List the print queue
lprm Remove jobs from the print queue
ls List information about file(s)
lsof List open files

make Recompile a group of programs
man Help manual
mkdir Create new folder(s)
mkfifo Make FIFOs (named pipes)
mkisofs Create an hybrid ISO9660/JOLIET/HFS filesystem
mknod Make block or character special files
more Display output one screen at a time
mount Mount a file system
mtools Manipulate MS-DOS files
mv Move or rename files or directories

netstat Networking information
nice Set the priority of a command or job
nl Number lines and write files
nohup Run a command immune to hangups
nslookup Query Internet name servers interactively

passwd Modify a user password
paste Merge lines of files
pathchk Check file name portability
ping Test a network connection
popd Restore the previous value of the current directory
pr Prepare files for printing
printcap Printer capability database
printenv Print environment variables
printf Format and print data
ps Process status
pushd Save and then change the current directory
pwd Print Working Directory

quota Display disk usage and limits
quotacheck Scan a file system for disk usage
quotactl Set disk quotas

ram ram disk device
rcp Copy files between two machines.
read read a line from standard input
readonly Mark variables/functions as readonly
remsync Synchronize remote files via email
return Exit a shell function
rm Remove files
rmdir Remove folder(s)
rsync Remote file copy (Synchronize file trees)

screen Terminal window manager
scp Secure copy (remote file copy)
sdiff Merge two files interactively
sed Stream Editor
select Accept keyboard input
seq Print numeric sequences
set Manipulate shell variables and functions
sftp Secure File Transfer Program
shift Shift positional parameters
shopt Shell Options
shutdown Shutdown or restart linux
sleep Delay for a specified time
sort Sort text files
source Run commands from a file `.'
split Split a file into fixed-size pieces
ssh Secure Shell client (remote login program)
strace Trace system calls and signals
su Substitute user identity
sudo Execute a command as another user
sum Print a checksum for a file
symlink Make a new name for a file
sync Synchronize data on disk with memory

tail Output the last part of files
tar Tape ARchiver
tee Redirect output to multiple files
test Evaluate a conditional expression
time Measure Program running time
times User and system times
touch Change file timestamps
top List processes running on the system
traceroute Trace Route to Host
trap Run a command when a signal is set(bourne)
tr Translate, squeeze, and/or delete characters
true Do nothing, successfully
tsort Topological sort
tty Print filename of terminal on stdin
type Describe a command

ulimit Limit user resources
umask Users file creation mask
umount Unmount a device
unalias Remove an alias
uname Print system information
unexpand Convert spaces to tabs
uniq Uniquify files
units Convert units from one scale to another
unset Remove variable or function names
unshar Unpack shell archive scripts
until Execute commands (until error)
useradd Create new user account
usermod Modify user account
users List users currently logged in
uuencode Encode a binary file
uudecode Decode a file created by uuencode

v Verbosely list directory contents (`ls -l -b')
vdir Verbosely list directory contents (`ls -l -b')
vi Text Editor

watch Execute/display a program periodically
wc Print byte, word, and line counts
whereis Report all known instances of a command
which Locate a program file in the user's path.
while Execute commands
who Print all usernames currently logged in
whoami Print the current user id and name (`id -un')
Wget Retrieve web pages or files via HTTP, HTTPS or FTP

xargs Execute utility, passing constructed argument list(s)
yes Print a string until interrupted

. Run a command script in the current shell
### Comment / Remark

Yorum (yok) Yorum yaz!

iftop kurulumu

iftop, mevcut network kartinizin uzerinden akan verilerin akisini bar olarak size gosteren $ahane bir yazilimdir. Sunucunuzda kaynagini veya hedefini bulamadiginiz cok yuksek trafik akislari oluyorsa iftop yardiminiza kosacaktir.























eger dag reposu sisteminizde kuruluysa

yum install iftop

demeniz yeterlidir... ( DAG veya RPMFORGE Reposu kurmak icin http://hidonet.blogcu.com/20878041/ )

Eger RPM den kurmak isterseniz :

http://www.ex-parrot.com/~pdw/iftop/ adresindeki binaries kismindan veya
http://checksuite.sourceforge.net/dl/ adresinden rpm indirerek kurabilirsiniz...

Yorum (yok) Yorum yaz!

Alternatif YUM Repolari nasil kurulur

Standart kurulumlarda bulunmayan bir cok standart disi programi kurmak icin alternatif YUM repolari var. Bunlardan en onemlisi DAG grubundaki repolar. 7000 den fazla paket hazir olarak sizi bekliyor.

Mevcut kurulu repolari listelemek icin :


# ls -al /etc/yum.repos.d


demeniz yeterli. Bu komutun ciktisinda eger dag.repo dosyasini goremediyseniz bir sonraki adima geciniz ;)

DAG Repolarini tanitmak icin linux da root iken :

rpm -i http://dag.wieers.com/rpm/packages/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm


Not : Bu kurulum Redhat EL5 veya Centos 5 icin gecerlidir. Kendi linuxunuza uygun paketi bulmak icin http://dag.wieers.com/rpm/packages/rpmforge-release/ adresine bakiniz...

Diger Repolar :

RPMFORGE :
rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm


LIVNA REPO ( Ozellikle video sitesi icin gerekli video encoder paketleri bulunur, bu kurulum fedora icindir ) :


rpm --import http://livna-dl.reloumirrors.net/RPM-LIVNA-GPG-KEY
rpm -ivh http://rpm.livna.org/livna-release-8.rpm
perl -i -npe 's/enabled=1/enabled=0/' /etc/yum.repos.d/livna.repo


UTTERRAMBLINGS REPO ( PHP 5.2 kurmak icin kullanmistim. Standart depolarda olmayan ust php surumlerini kurmak icin kullanilabilir ) :

rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
yum utterramblings http://www.jasonlitka.com/media/EL5/$ARCH

daha sonra

nano -w /etc/yum.repos.d/utterramblings.repo


yapin ve nano ya asagidaki kodlari yapistirip ctrl + O ile nanodan cikin.

[utterramblings]
name=Jason's Utter Ramblings Repo
baseurl=http://www.jasonlitka.com/media/EL$releasever/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka

Yorum (yok) Yorum yaz!