From a2778009b560ef4511abce10c669b805c7dcac2e Mon Sep 17 00:00:00 2001 From: Thanwer Date: Sun, 3 Nov 2024 11:16:56 -0300 Subject: [PATCH] Fix minor markdown syntax errors. --- content/posts/fail2ban-basics.md | 12 ++++++------ content/posts/fail2ban-basics.pt.md | 8 +++++--- content/posts/first-post.md | 1 + content/posts/first-post.pt.md | 3 ++- content/posts/iptables-basics.md | 10 ++++++---- content/posts/iptables-basics.pt.md | 4 +++- content/posts/netcat.md | 18 ++++++++++++------ content/posts/netcat.pt.md | 17 ++++++++++++----- content/posts/ssh-hardening.md | 3 ++- content/posts/ssh-hardening.pt.md | 3 ++- 10 files changed, 51 insertions(+), 28 deletions(-) diff --git a/content/posts/fail2ban-basics.md b/content/posts/fail2ban-basics.md index bf191aa..9d8f9c8 100644 --- a/content/posts/fail2ban-basics.md +++ b/content/posts/fail2ban-basics.md @@ -10,7 +10,7 @@ tags = [ +++ [Fail2ban](https://github.com/fail2ban/fail2ban) is a software which scans log files like `/var/log/auth.log` and bans IP addresses which have done too many failed login attempts. - + This is just one layer of security and should be used together with other tools and techniques such as iptables and SSH hardening. I always configure a simple SSH jail using fail2ban on my GNU/Linux servers. @@ -42,9 +42,7 @@ Next, we have the `jail.conf` file, which is where we configure our "jails" as t Here we are going to make some changes, so first let's create a `jail.local` file with the following content: - - -``` +```text [DEFAULT] bantime.multipliers = 5 15 30 60 300 720 1440 2880 bantime = 86400 @@ -65,7 +63,8 @@ Take your time to fine tune those parameters. ## Enabling and testing Fail2ban -Enable and start the fail2ban service +Enable and start the fail2ban service + ```bash systemctl enable --now fail2ban ``` @@ -73,6 +72,7 @@ systemctl enable --now fail2ban For SSH jails the test is very simple, you can test by simply failing to log on a couple times. You can check the status with the command: + ```bash fail2ban-client status fail2ban-client status sshd @@ -82,7 +82,7 @@ fail2ban-client status sshd As you can see, the SSH service on a cloud VPS is constantly being attacked, my server has almost 400 currently banned IPs. -## More jails! +## More jails Today I showed how to protect your GNU/Linux SSH service, but is is not over, you can use fail2ban to protect any service that you run! diff --git a/content/posts/fail2ban-basics.pt.md b/content/posts/fail2ban-basics.pt.md index 53cfcae..d32d5be 100644 --- a/content/posts/fail2ban-basics.pt.md +++ b/content/posts/fail2ban-basics.pt.md @@ -11,7 +11,7 @@ canonical = "posts/fail2ban-basics" +++ [Fail2ban](https://github.com/fail2ban/fail2ban) é um software que escaneia arquivos de logs como o `/var/log/auth.log` e bane IPs com muitas falhas de login. - + Isso é apenas uma camada de segurança e deve ser utilizada em conjunto com outras ferramentas como o iptables e melhorias na configuração do SSH. Eu sempre configuro uma jail para SSH usando o fail2ban em meus servidoresGNU/Linux. @@ -43,7 +43,7 @@ Depois, temos o arquivo `jail.conf` , que é onde configuramos as nossas "jails" Aqui vamos fazer algumas alterações, primeiro vamos criar um arquivo `jail.local` com o seguinte conteúdo: -``` +```text [DEFAULT] bantime.multipliers = 5 15 30 60 300 720 1440 2880 bantime = 86400 @@ -65,6 +65,7 @@ Invista seu tempo para estudar e melhorar esses parâmetros. ## Ativando e testando o fail2ban Ative e inicie o serviço fail2ban: + ```bash systemctl enable --now fail2ban ``` @@ -72,6 +73,7 @@ systemctl enable --now fail2ban Para testar as jails SSH, basta tentar o login com a senha incorreta por algumas vezes. Voce pode ver o status com os seguintes comandos: + ```bash fail2ban-client status fail2ban-client status sshd @@ -81,7 +83,7 @@ fail2ban-client status sshd Como voce pode ver, o serviço SSH em uma VPS em cloud é constantemente atacada, meu servidor já tem mais de 400 IPs banidos. -## Mais jails! +## Mais jails Hoje eu mostrei como proteger o seu serviço SSH em uma maquina GNU/Linux, mas não acabou, voce pode usar o fail2ban para qualquer serviço! diff --git a/content/posts/first-post.md b/content/posts/first-post.md index e78702d..24f2101 100644 --- a/content/posts/first-post.md +++ b/content/posts/first-post.md @@ -31,6 +31,7 @@ You can also use [Github Pages](https://pages.github.com/) or [Cloudflare Pages] I followed Hugo guide to [deploy by rsync](https://gohugo.io/hosting-and-deployment/deployment-with-rsync/) and I worked very well for me. A simple bash script to generate the website and deploy, all in one line! + ```bash #!/usr/bin/env bash hugo && rsync -avz --delete public/ shinobi.thanwer.com:/srv/www/blog/ diff --git a/content/posts/first-post.pt.md b/content/posts/first-post.pt.md index cd80eab..ae21f9e 100644 --- a/content/posts/first-post.pt.md +++ b/content/posts/first-post.pt.md @@ -1,7 +1,7 @@ +++ date = '2024-10-19T23:00:41-03:00' title = 'First Post' -description = "A simple bolog post about using Hugo as a framework for Thanwer's Blog" +description = "A simple blog post about using Hugo as a framework for Thanwer's Blog" tags = [ "webserver", "Hugo", @@ -32,6 +32,7 @@ Você também pode usar o [Github Pages](https://pages.github.com/) ou o [Cloudf Eu segui o guia oficial do Hugo para fazer o [deploy via rsync](https://gohugo.io/hosting-and-deployment/deployment-with-rsync/) e ele funcionou bem para mim Um simples script em bash gera o site e faz o deploy, tudo em uma linha! + ```bash #!/usr/bin/env bash hugo && rsync -avz --delete public/ shinobi.thanwer.com:/srv/www/blog/ diff --git a/content/posts/iptables-basics.md b/content/posts/iptables-basics.md index 22dc9e7..b2ee61e 100644 --- a/content/posts/iptables-basics.md +++ b/content/posts/iptables-basics.md @@ -34,12 +34,14 @@ You can check those well made diagrams by [nerdalert on Github](https://gist.git Let’s start with a quick overview of essential iptables commands: -### Show current rules: +### Show current rules + ```bash iptables -L ``` -### Flush (delete) all existing rules: +### Flush (delete) all existing rules + ```bash iptables -F ``` @@ -87,6 +89,7 @@ iptables -P OUTPUT ACCEPT ``` This means any incoming connection will be dropped unless you explicitly allow it. Outgoing traffic, on the other hand, is allowed by default. + ### Step 3: Allow SSH Traffic (Port 22) You’ll need SSH access to manage your server, so we’ll allow traffic on port 22. It’s important to only allow connections from trusted IP addresses, but for simplicity, we’ll start by allowing all connections on SSH: @@ -151,8 +154,7 @@ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT This ensures your server can accept responses to any requests it makes. - -### Step 8: Don't forget IPv6 rules! +### Step 8: Don't forget IPv6 rules For IPv6, the syntax is the same, you mostly need to change the command from `iptables` to `ip6tables` diff --git a/content/posts/iptables-basics.pt.md b/content/posts/iptables-basics.pt.md index 9aa7ed0..13fe57d 100644 --- a/content/posts/iptables-basics.pt.md +++ b/content/posts/iptables-basics.pt.md @@ -36,11 +36,13 @@ Recomendo que voce inicie por esses diagramas muito bem feitos nesse gist do [ne Vamos começar com uma overview dos comandos essenciais do iptables: ### Mostrar regras atuais + ```bash iptables -L ``` ### Deletar regras atuais + ```bash iptables -F ``` @@ -153,7 +155,7 @@ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT Isso garante que o servidor aceite respostas para requisições que ele mesmo fez. -### Passo 8: Não esqueça o IPv6! +### Passo 8: Não esqueça o IPv6 Para IPv6, a sintaxe é a mesma, voce apenas precisa mudar o comando de `iptables` para `ip6tables` diff --git a/content/posts/netcat.md b/content/posts/netcat.md index f895e36..83fbef3 100644 --- a/content/posts/netcat.md +++ b/content/posts/netcat.md @@ -12,8 +12,8 @@ I heard too many times a work colleague, or a third-party vendor telling me "the You can use websites to try to test for open ports, a quick Google search should yield you a couple good results, but sometimes that is not enough. - ## The problem + Let's suppose you followed my other post about [restricting source address with iptables]({{< ref "/posts/iptables-basics" >}} "Iptables basics"), in this case those random web tools won't help you, so you use nmap! I will make a post about nmap in the future, for now let's use it in a very simple way to check for an open port: @@ -47,8 +47,9 @@ Netcat is a very simple, but very powerful tool for those cases. With that, you ### Installing The installation is very simple! On Debian systems you can do it with the command: + ```bash -$ sudo apt install netcat +sudo apt install netcat ``` ### Using the tool @@ -66,15 +67,18 @@ The main options we need to use are: #### Check for network communication Listen on port 2000: + ```bash -$ nc -l 2000 +nc -l 2000 ``` + This starts a server which listens on port 2000. Now let's open another terminal and connect a client to this port: + ```bash -$ nc localhost 2000 +nc localhost 2000 ``` @@ -91,12 +95,13 @@ Netcat can be used to send and receive files between two hosts over a network. T On the receiver’s end: ```bash -$ nc -l -p 1234 > received_file.txt +nc -l -p 1234 > received_file.txt ``` + On the sender’s end, assuming that 192.0.0.2 is the receiving server: ```bash -$ nc 192.0.0.2 -p 1234 < file_to_send.txt +nc 192.0.0.2 -p 1234 < file_to_send.txt ``` This can be useful for transferring a log file for example. @@ -104,6 +109,7 @@ This can be useful for transferring a log file for example. #### Port scan nc can be used as a simpler alternative to nmap: + ```bash $ nc -z host.example.com 20-30 Connection to host.example.com 22 port [tcp/ssh] succeeded! diff --git a/content/posts/netcat.pt.md b/content/posts/netcat.pt.md index 5d56b1f..9f6de97 100644 --- a/content/posts/netcat.pt.md +++ b/content/posts/netcat.pt.md @@ -14,6 +14,7 @@ Já ouvi muitas vezes de algum colega de trabalho, ou de algum prestador de serv Voce pode usar testes online para verificar as portas abertas, uma rápida pesquisa no Google vai te trazer resultados bons, porem nem sempre isso é o suficiente. ## O problema + Vamos supor que voce seguiu meu outro post sobre [restringir por endereço de origem no iptables]({{< ref "/posts/iptables-basics" >}} "Iptables basics"), nesse caso essas ferramentas aleatórias não vão lhe ajudar, então voce pode usar o nmap! Farei um post sobre o nmap no futuro, por enquanto vamos usa-lo de forma bem simples para verificar se uma porta está aberta: @@ -47,8 +48,9 @@ O netcat é uma ferramenta super simples, porem muito poderosa para esses casos. ### Instalação A instalação é muito simples! Em um sistema Debian basta executar o seguinte comando: + ```bash -$ sudo apt install netcat +sudo apt install netcat ``` ### Usando a ferramenta @@ -66,15 +68,18 @@ Os principais argumentos que precisamos são: #### Testar comunicação de rede Escutar na porta 2000: + ```bash -$ nc -l 2000 +nc -l 2000 ``` + Isso inicia um serviço na porta 2000. Agora vamos abrir outro terminal e conectar um cliente a essa porta: + ```bash -$ nc localhost 2000 +nc localhost 2000 ``` @@ -91,12 +96,13 @@ O netcat tambem pode ser usado para transferir arquivos entre dois hosts, isso No receptor: ```bash -$ nc -l -p 1234 > arquivo_recebido.txt +nc -l -p 1234 > arquivo_recebido.txt ``` + No transmissor, assumindo que o receptor seja o IP 192.0.0.2:: ```bash -$ nc 192.0.0.2 -p 1234 < arquivo_para_enviar.txt +nc 192.0.0.2 -p 1234 < arquivo_para_enviar.txt ``` Isso pode ser util para transferir um arquivo de log, por exemplo. @@ -104,6 +110,7 @@ Isso pode ser util para transferir um arquivo de log, por exemplo. #### Port scac nc pode ser usado como uma alternativa "mais barata" para o nmap: + ```bash $ nc -z host.example.com 20-30 Connection to host.example.com 22 port [tcp/ssh] succeeded! diff --git a/content/posts/ssh-hardening.md b/content/posts/ssh-hardening.md index 2866553..c5c2b91 100644 --- a/content/posts/ssh-hardening.md +++ b/content/posts/ssh-hardening.md @@ -55,6 +55,7 @@ When you finish those tunings, check with the [ssh-audit tool](https://github.co On top of iptables rules, the `/etc/ssh/sshd_config` file can apply restrictions based on users, groups and/or source IPs. For example, to whitelist by IP, you can add the following: + ```bash # Restrict to a specific IP address AllowUsers *@192.0.0.2 @@ -63,4 +64,4 @@ AllowUsers *@192.0.0.0/24 # Restrict a specific user to a specific IP address Match User alice AllowUsers alice@192.0.0.2 -``` \ No newline at end of file +``` diff --git a/content/posts/ssh-hardening.pt.md b/content/posts/ssh-hardening.pt.md index 6cb75f9..9d9f7b3 100644 --- a/content/posts/ssh-hardening.pt.md +++ b/content/posts/ssh-hardening.pt.md @@ -56,6 +56,7 @@ Quando voce terminar, verifique com a ferramenta [ssh-audit](https://github.com/ Além das regras do iptables, o arquivo `/etc/ssh/sshd_config` pode aplicar restrições baseadas em usuário, grupo e/ou IP de origem. Por exemplo, para permitir conexões por IP, voce pode adicionar conforme os seguintes exemplos: + ```bash # Restrict to a specific IP address AllowUsers *@192.0.0.2 @@ -64,4 +65,4 @@ AllowUsers *@192.0.0.0/24 # Restrict a specific user to a specific IP address Match User alice AllowUsers alice@192.0.0.2 -``` \ No newline at end of file +```