Re: atak na serwer www - apache 1.3.x

[bieniu gras <bieniu@gras.poznan.pl>]

Witaj bieniu,

W Twoim liście datowanym 9 lutego 2006 (21:56:51) można przeczytać:

dobra to sproboje ustawic squida jak na razie mam tak:

dalem przekierowanie iptablesami:

iptables -t nat -A PREROUTING -i eth0 -p tcp -d
ip_na_ktorym_bedzie_domena --dport 80 -j DNAT --to 127.0.0.1:3128

squid na localhoscie i ma ustawione:

http_port  127.0.0.1:3128
cache_mem 8 MB

http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

httpd_accel_port 127.0.0.1:80
httpd_accel_host virtual
httpd_accel_single_host on
httpd_accel_uses_host_header on

# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563      # https, snews
acl SSL_ports port 873          # rsync
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443 563     # https, snews
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl Safe_ports port 631         # cups
acl Safe_ports port 873         # rsync
acl Safe_ports port 901         # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

#tutaj sa wpisane pliki ddd.jpg, q.jpg oraz my_foto.zip aby squid nie
pozwalal na przejscie

acl pliki_wormy urlpath_regex "/etc/squid/pliki_wormy"
http_access deny pliki_wormy


i teraz laczac sie po ip http://ip_na_ktorym_jest_domena
niestety mam connection timeout a widze ze pakiety przechodza:

iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 6163K packets, 350M bytes)
 pkts bytes target     prot opt in     out     source               destination
   93  5580 DNAT       tcp  --  eth0   any     anywhere
   ip_na_ktorym_jest_domena2        tcp dpt:www to:127.0.0.1:3128


   tylko jakby nie wiem squid nie puszcza dalej ???


-- 
Pozdrowienia,
 bieniu gras