Pingviini sisselogimine tõkestatud väljapool EL-i

[spott]

Kuna tundub, et meie väike portaal on sattunud ühe bot-i rünnaku alla, kes järjest kõikide kasutajate kontodele sisse üritab logida, siis on Pingviini Web-i login.php fail htaccess failiga tõkestatud väljapool Euroopa Liitu. See tähendab, et foorumit lugeda saab, kuid sisse logida ei saa.

Igaks juhuks panin samasuguse piirangu peale ka Vikile. Ehk ka seal saab lugeda, kuid Userlogin.php fail on tõkestatud.

Kui keegi vajab siiski ligipääsu mujalt, siis saatke mulle meilile oma IP.

[Metsavana]

Mul oli mõni aeg tagasi samalaadne probleem ühe bot-iga. Selle puhul aitas kui panin küsima .htaccessi väljaspoolt Eestit parooli ja parooli enda lisasin kommentaari välja. Vähemalt toohetk ei osanud bot lugeda htaccessi teatest seda salasõna välja.

AuthType Basic
AuthName "Kommentaari postitamiseks sisestage kasutajanimi karu ja salas6na rebane."
<LimitExcept GET>
Require valid-user
Order Deny,Allow
Deny from all
Allow from 193.40.0.0/24 (ja teised Eestis kasutatavad klassid)
Satisfy any
</LimitExcept>

[zeroconf]

Millised need teised Eestis kasutatavad klassid on? Kas need on kuskil kirjas ka? Võiks olla miski küberturvalisuse sektsioon foorumis kus sellistest asjadest räägitakse. Mul on üks teema veel kohe sinna pakkuda.

[imre]

http://tix.estpak.ee/networks.txt
Peaksid need olema...

[HoHo]

14:59 ehk suts vähem kui 20min tagasi potsatas postkasti kiri teatega, et mu account olevat 3x vale parooli pärast veerand tunniks blokeeritud. Tundub, et ainult EU välja filtreerimisest ei pruugi piisata.

X-AntiAbuse: User IP - 83.220.133.86

[imre]

83.220.133.86 on TOR nimekirjas olemas.
Spott sai ka PM kaudu teavitatud kus need TOR IP'd olemas on.

[Valdur55]

TOR-iga on selline lugu ,et osadel TOR hostijatel muutub IP ja see teeb võimalikuks, et uuesti rünnatakse. Aga sesine tegevus vähendab tublisti tor-ide hulka, mis saab sisselogimislehe ette. (tor ip-d + väljaspoolt EU-d blokeerimine).

[spott]

Kusjuures seda IP-d ei olnud minu täna hommikul võetud TOR-i listis, kus ca 1200 IP-d sai blokitud....
Samas ei saa aga minu meelest kahte reeglit korraga kokku panna htaccess faili. Et kõigepealt 1200 IP-d, mis denyd ja siis tohtul hulgal EU IP vahemike, mis avatud.

TO: zeroconf
http://www.countryipblocks.net/ sealt saad muiud genereerida htaccess faile mingi kindla riigi kohta - kas siis blokeerimine või lubamine. Näiteks saad genereerida, et lubatud ainult Eestist.

[imre]

Võibolla oleks lihtsam captcha abil teha nö esileht, et kui õige sõna sisse toksid, siis alles lastakse lehele ligi. Nii lugemiseks kui sisse logimiseks.
Vähemalt niikaua kuniks see bot oma töö lõpetab. Millalgi ta alla ju annab.

[spott]

Üritan praegu pihta saada, kuidas anna htaccessiga siis salasõna küsima. Kuid ei suuda seda kuidagi. Katseserveris olev htaccess:
AuthGroupFile /dev/null
AuthName "Kommentaari postitamiseks sisestage kasutajanimi karu ja salas6na rebane"
AuthType Basic
AuthUserFile /home/ekaubamaja/domains/ekaubamaja.com/.htpasswd/public_html/.htpasswd
<LimitExcept GET>
require valid-user
Order Deny,Allow
Deny from all
allow from 46.16.112.0/21
allow from 46.22.208.0/20
allow from 46.29.248.0/21
allow from 46.39.128.0/19
allow from 46.131.0.0/16
allow from 62.65.32.0/19
allow from 62.65.192.0/18
allow from 77.233.64.0/19
allow from 77.240.240.0/20
allow from 78.24.192.0/21
allow from 78.28.64.0/18
allow from 78.110.32.0/20
allow from 79.134.192.0/19
allow from 80.66.240.0/20
allow from 80.79.112.0/20
allow from 80.235.0.0/17
allow from 80.250.112.0/20
allow from 81.20.144.0/20
allow from 81.21.240.0/20
allow from 81.25.240.0/20
allow from 81.90.112.0/20
allow from 82.131.0.0/17
allow from 82.147.160.0/19
allow from 83.166.32.0/19
allow from 84.50.0.0/16
allow from 84.52.0.0/18
allow from 85.29.192.0/18
allow from 85.89.32.0/19
allow from 85.196.192.0/18
allow from 85.253.0.0/16
allow from 86.110.32.0/19
allow from 87.119.160.0/19
allow from 88.196.0.0/16
allow from 89.221.64.0/20
allow from 89.235.192.0/18
allow from 90.190.0.0/15
allow from 91.198.206.0/24
allow from 91.203.28.0/22
allow from 91.206.132.0/23
allow from 91.208.15.0/24
allow from 91.208.26.0/24
allow from 91.213.43.0/24
allow from 91.216.86.0/24
allow from 91.221.186.0/23
allow from 92.62.96.0/20
allow from 93.185.240.0/20
allow from 94.246.192.0/18
allow from 94.247.136.0/21
allow from 95.129.192.0/21
allow from 95.153.0.0/18
allow from 109.235.240.0/21
allow from 178.21.240.0/21
allow from 178.23.112.0/21
allow from 178.216.48.0/21
allow from 178.236.192.0/20
allow from 178.248.136.0/21
allow from 178.255.8.0/21
allow from 188.66.0.0/21
allow from 188.92.160.0/21
allow from 188.95.208.0/21
allow from 193.28.6.0/24
allow from 193.28.254.0/24
allow from 193.40.0.0/16
allow from 193.138.8.0/24
allow from 193.138.188.0/22
allow from 193.188.134.96/28
allow from 193.203.196.0/23
allow from 194.1.209.0/24
allow from 194.36.162.0/24
allow from 194.106.96.0/19
allow from 194.116.188.0/23
allow from 194.126.96.0/19
allow from 194.150.64.0/22
allow from 194.180.226.152/29
allow from 194.204.0.0/19
allow from 194.204.32.0/19
allow from 195.43.86.0/23
allow from 195.50.192.0/19
allow from 195.60.83.96/27
allow from 195.80.96.0/19
allow from 195.190.134.0/24
allow from 195.250.160.0/19
allow from 212.7.0.0/19
allow from 213.35.128.0/17
allow from 213.168.0.0/19
allow from 213.180.0.0/19
allow from 213.184.32.0/19
allow from 213.219.64.0/18
allow from 217.71.32.0/20
allow from 217.146.64.0/20
allow from 217.159.128.0/17
Satisfy any
</LimitExcept>


Kuid ikka laseb ka mujalt ligi....

[priit]

Nii peaks töötama küll:

Kood: Vali kõik

AuthName "blabla"
AuthType Basic
AuthUserFile /srv/http/htpasswd
require valid-user
<Limit GET>
Order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Limit>

[Metsavana]

TIX info ei pruugi olla kõige uuem ja pädevam. Ise olen võtnud vahemikud RIPEst ftp://ftp.ripe.net/pub/stats/ripencc/me ... oclist.txt

Mul töötab serveris täpsemalt järgmine konstruktsioon igasuguste kaugelt tehtavate postitamiste piiramiseks:

<Directory /srv/www>
AllowOverride All
AuthUserFile /srv/sala/.htpasswd
AuthType Basic
AuthName "Kommentaari postitamiseks sisestage kasutajanimi karu ja salas6na rebane."
<LimitExcept GET>
Require valid-user
Order Deny,Allow
Deny from all
Allow from 79.134.192.0/17 62.65.192.0/18 82.131.0.0/17 85.253.0.0/16 195.80.96.0/19 213.184.32.0/19 80.241.208.0/20 92.62.96.0/20 188.92.160.0/21 193.40.0.0/16 80.66.240.0/20 217.71.32.0/20 194.106.96.0/19 194.126.96.0/19 195.50.192.0/19 195.250.160.0/19 213.168.0.0/19 213.180.0.0/19 213.219.64.0/18 80.235.0.0/17 62.65.32.0/19 213.35.128.0/17 217.159.128.0/17 84.50.0.0/16 88.196.0.0/16 90.190.0.0/15 212.49.0.0/19 212.27.224.0/19 85.117.96.0/19 87.98.0.0/17 89.219.0.0/16 94.247.136.0/21 212.7.0.0/19 82.147.160.0/19 84.52.0.0/18 89.235.192.0/18 80.250.112.0/20 81.90.112.0/20 86.110.32.0/19 85.196.192.0/18 93.185.240.0/20 85.89.32.0/19 81.21.240.0/20 77.233.64.0/19 78.28.64.0/18 95.153.0.0/18 81.25.240.0/20 77.240.240.0/20 194.204.0.0/19 194.204.32.0/19 87.119.160.0/19 95.129.192.0/21 81.20.144.0/20 89.221.64.0/20 78.110.32.0/20 94.246.192.0/18 83.166.32.0/19 85.29.192.0/18 80.79.112.0/20 78.24.192.0/21
Satisfy any
</LimitExcept>
</Directory>

[atomic]

Leidsin järgmise maili oma kirja kastist:


Tervist "atomic"


Me salvestasime mitu ebaõnnestunud sisselogimis katset (6) Teie kontole.
Selleks, et tagada turvalisust, me blokeerisime Teie konto Pingviini Web 15 minutiks.

Teil on veel üks võimalus proovida sisse logida, kasutades õiget parooli peale P 02. jaan, 2011 04:11:37.

Mina see polnud kallis rahvas hoidke kõrvad kikkis! Head uut aastat kõigile!

[spott]

Nu praegu selline testserveris ja saan error 500

Kood: Vali kõik

<Directory /home/ekaubamaja/public_html> 
AuthGroupFile /dev/null
AllowOverride All 
AuthUserFile /home/ekaubamaja/domains/ekaubamaja.com/.htpasswd/public_html/.htpasswd
AuthType Basic
AuthName "Kommentaari postitamiseks sisestage kasutajanimi karu ja salas6na rebane"
<LimitExcept GET> 
Require valid-user
Order Deny,Allow
Deny from all 
allow from 46.16.112.0/21
allow from 46.22.208.0/20
allow from 46.29.248.0/21
allow from 46.39.128.0/19
allow from 46.131.0.0/16
allow from 62.65.32.0/19
allow from 62.65.192.0/18
allow from 77.233.64.0/19
allow from 77.240.240.0/20
allow from 78.24.192.0/21
allow from 78.28.64.0/18
allow from 78.110.32.0/20
allow from 79.134.192.0/19
allow from 80.66.240.0/20
allow from 80.79.112.0/20
allow from 80.235.0.0/17
allow from 80.250.112.0/20
allow from 81.20.144.0/20
allow from 81.21.240.0/20
allow from 81.25.240.0/20
allow from 81.90.112.0/20
allow from 82.131.0.0/17
allow from 82.147.160.0/19
allow from 83.166.32.0/19
allow from 84.50.0.0/16
allow from 84.52.0.0/18
allow from 85.29.192.0/18
allow from 85.89.32.0/19
allow from 85.196.192.0/18
allow from 85.253.0.0/16
allow from 86.110.32.0/19
allow from 87.119.160.0/19
allow from 88.196.0.0/16
allow from 89.221.64.0/20
allow from 89.235.192.0/18
allow from 90.190.0.0/15
allow from 91.198.206.0/24
allow from 91.203.28.0/22
allow from 91.206.132.0/23
allow from 91.208.15.0/24
allow from 91.208.26.0/24
allow from 91.213.43.0/24
allow from 91.216.86.0/24
allow from 91.221.186.0/23
allow from 92.62.96.0/20
allow from 93.185.240.0/20
allow from 94.246.192.0/18
allow from 94.247.136.0/21
allow from 95.129.192.0/21
allow from 95.153.0.0/18
allow from 109.235.240.0/21
allow from 178.21.240.0/21
allow from 178.23.112.0/21
allow from 178.216.48.0/21
allow from 178.236.192.0/20
allow from 178.248.136.0/21
allow from 178.255.8.0/21
allow from 188.66.0.0/21
allow from 188.92.160.0/21
allow from 188.95.208.0/21
allow from 193.28.6.0/24
allow from 193.28.254.0/24
allow from 193.40.0.0/16
allow from 193.138.8.0/24
allow from 193.138.188.0/22
allow from 193.188.134.96/28
allow from 193.203.196.0/23
allow from 194.1.209.0/24
allow from 194.36.162.0/24
allow from 194.106.96.0/19
allow from 194.116.188.0/23
allow from 194.126.96.0/19
allow from 194.150.64.0/22
allow from 194.180.226.152/29
allow from 194.204.0.0/19
allow from 194.204.32.0/19
allow from 195.43.86.0/23
allow from 195.50.192.0/19
allow from 195.60.83.96/27
allow from 195.80.96.0/19
allow from 195.190.134.0/24
allow from 195.250.160.0/19
allow from 212.7.0.0/19
allow from 213.35.128.0/17
allow from 213.168.0.0/19
allow from 213.180.0.0/19
allow from 213.184.32.0/19
allow from 213.219.64.0/18
allow from 217.71.32.0/20
allow from 217.146.64.0/20
allow from 217.159.128.0/17
Satisfy any
</LimitExcept>
</Directory>

[antik2]

Nu praegu selline testserveris ja saan error 500

Kood: Vali kõik

<Directory /home/ekaubamaja/public_html> 
AuthGroupFile /dev/null
AllowOverride All 
AuthUserFile /home/ekaubamaja/domains/ekaubamaja.com/.htpasswd/public_html/.htpasswd
AuthType Basic
AuthName "Kommentaari postitamiseks sisestage kasutajanimi karu ja salas6na rebane"
<LimitExcept GET> 
Require valid-user
Order Deny,Allow
Deny from all 
allow from 46.16.112.0/21
allow from 46.22.208.0/20
allow from 46.29.248.0/21
allow from 46.39.128.0/19
allow from 46.131.0.0/16
allow from 62.65.32.0/19
allow from 62.65.192.0/18
allow from 77.233.64.0/19
allow from 77.240.240.0/20
allow from 78.24.192.0/21
allow from 78.28.64.0/18
allow from 78.110.32.0/20
allow from 79.134.192.0/19
allow from 80.66.240.0/20
allow from 80.79.112.0/20
allow from 80.235.0.0/17
allow from 80.250.112.0/20
allow from 81.20.144.0/20
allow from 81.21.240.0/20
allow from 81.25.240.0/20
allow from 81.90.112.0/20
allow from 82.131.0.0/17
allow from 82.147.160.0/19
allow from 83.166.32.0/19
allow from 84.50.0.0/16
allow from 84.52.0.0/18
allow from 85.29.192.0/18
allow from 85.89.32.0/19
allow from 85.196.192.0/18
allow from 85.253.0.0/16
allow from 86.110.32.0/19
allow from 87.119.160.0/19
allow from 88.196.0.0/16
allow from 89.221.64.0/20
allow from 89.235.192.0/18
allow from 90.190.0.0/15
allow from 91.198.206.0/24
allow from 91.203.28.0/22
allow from 91.206.132.0/23
allow from 91.208.15.0/24
allow from 91.208.26.0/24
allow from 91.213.43.0/24
allow from 91.216.86.0/24
allow from 91.221.186.0/23
allow from 92.62.96.0/20
allow from 93.185.240.0/20
allow from 94.246.192.0/18
allow from 94.247.136.0/21
allow from 95.129.192.0/21
allow from 95.153.0.0/18
allow from 109.235.240.0/21
allow from 178.21.240.0/21
allow from 178.23.112.0/21
allow from 178.216.48.0/21
allow from 178.236.192.0/20
allow from 178.248.136.0/21
allow from 178.255.8.0/21
allow from 188.66.0.0/21
allow from 188.92.160.0/21
allow from 188.95.208.0/21
allow from 193.28.6.0/24
allow from 193.28.254.0/24
allow from 193.40.0.0/16
allow from 193.138.8.0/24
allow from 193.138.188.0/22
allow from 193.188.134.96/28
allow from 193.203.196.0/23
allow from 194.1.209.0/24
allow from 194.36.162.0/24
allow from 194.106.96.0/19
allow from 194.116.188.0/23
allow from 194.126.96.0/19
allow from 194.150.64.0/22
allow from 194.180.226.152/29
allow from 194.204.0.0/19
allow from 194.204.32.0/19
allow from 195.43.86.0/23
allow from 195.50.192.0/19
allow from 195.60.83.96/27
allow from 195.80.96.0/19
allow from 195.190.134.0/24
allow from 195.250.160.0/19
allow from 212.7.0.0/19
allow from 213.35.128.0/17
allow from 213.168.0.0/19
allow from 213.180.0.0/19
allow from 213.184.32.0/19
allow from 213.219.64.0/18
allow from 217.71.32.0/20
allow from 217.146.64.0/20
allow from 217.159.128.0/17
Satisfy any
</LimitExcept>
</Directory>

Arvatavasti on sul viga Apache konfis.

Vaata üle httpd.conf:

Kood: Vali kõik

<Directory ...>
AllowOverride AuthConfig Limit
</Directory>

Nüüd vaatame .htaccess:

Kood: Vali kõik

Order Deny,Allow
Deny from all
AuthUserFile /tmp/.htpasswd
AuthName "Private"
AuthType Basic
Require valid-user
Allow from 10
Satisfy Any

[spott]

Müttan siin Zone FTP liidese kaudu, et saada see audentimine zone serveris tööle. Ega see eriti lihtne ei ole. Sest nende htaccess faile muuta ei saa....

[sander85]

proovin korra ise natuke login.php'd äkki nokkida, ehk õnnestub mingi trikk vahele teha..

e: uurides logisid, jääb siiski mulje, et keeruline on seda elukat ära peletada nii, et mõni kasutaja pihta saama ei hakka..

[erku]

.., ehk õnnestub mingi trikk vahele teha..

..

Kus ta neid kasutajaid võtab, automaatselt või sisestatakse?
On kusagil näha, milliseid paroole, millise süsteemi järgi genereeritakse.

Kui on süsteem, tee selle järgi virtuaalne kasutaja, kasutaja järgi haagi mõni liides, liides sisaldagu korralikumat viirust; Tat's it.

[antik2]

Soovitaks üldse mingile muule tarkvarale kolida PHPbb asemel. See BB on ammuteatatuntud auklik php disaster. Tarkvarauuendusi sellele enam vist üldse ei tehtagi.

NB. Nüüd saadki tunda "shared hostingu" rõõmusid, et ei saa ise midagi reguleerida.

[sander85]

Soovitaks üldse mingile muule tarkvarale kolida PHPbb asemel. See BB on ammuteatatuntud auklik php disaster. Tarkvarauuendusi sellele enam vist üldse ei tehtagi.

NB. Nüüd saadki tunda "shared hostingu" rõõmusid, et ei saa ise midagi reguleerida.

phpBB2 on vana jah, aga teadaolevaid suuri auke selles ma _hetkel_ ei tea.. sama moodi võiks bot käia kollitamas misiganes muud logimise vormi, selle vastu naljalt tõkkeid ei sea..

uuendus sellele on phpBB3 ja see on tagaplaanil ka vormistamisel, aga ajapuuduse tõttu ei juhtu kahjuks üleöö ja vajab paremat läbimõtlemist..

@NB, antud juhul ei saanud ma täpselt aru, mida spott ei leidnud või mis valesti läks, aga olen enam-vähem siiski arvamusel, et mingi võimalus on olemas..

privaserverit sellise asja pärast veel rentima ei hakka..