Inhaltsverzeichnis
- SSH
- Automatic updates
- Brute Force Attacks
- Logging
- Restricting Access from three devices
- 1. Register your home computer (Windows) at a dyndns service to provide the current ipv6, see dynv6.com
- 2. Windows: create script (I use python) to set local IP at dynv6
- 3. Windows schedule script to run each time the PC is booted, see "Aufgabenplanung" (task scheduler)
- 4. Raspberry: create and set iptables ruleset, see Firewall with iptables
- 5. Raspberry: use python script to query the current ipv6 from dynv6 (Windows) and replace in iptables ruleset
- 6. Raspberry: schedule the ipv6 update in firewall (ip6tables) via crontab
SSH#
Change SSH Port
> sudo vi /etc/ssh/sshd_config # here is the port
Port xx x # set port here
ListenAddress :: # enable all ipv6
ListenAddress 0.0.0.0 # enable all ipv4
LogLevel DEBUG # change log level like INFO, DEBUG3
AllowUsers <user> # allow only this user
PermitRootLogin prohibit-password # activate to disable root
> sudo vi /etc/ssh/ssh_config # this is general
> cd /etc/ssh/sshd_config.d # check also sub configurations
> sudo systemctl status ssh # check status
> sudo service ssh restart # reload / restart
> sudo /etc/init.d/ssh restart # reload / restart alternative
> sudo netstat -pantWul # check connections
Check port ranges
, Common Ports
- System/well known ports: 0-1023
- User or registered ports: 1024-49151 <== use port from here
- Dynamic/private ports: 49152-65535
Windows
> ssh 2a02:5a0:4110:f590:4670:d3e6:1234:6547 -p 123 # with custom port > ssh markus@192.168.188.76 # with username > ssh pi5backup.v6.rocks -p 31415 ipv6 fe80::7ea5:7cb2:6563:1518 # with source ipv6
Automatic updates#
> sudo apt install unattended-upgrades > sudo dpkg-reconfigure --priority=low unattended-upgrades
Brute Force Attacks#
Disable IPs on multiple failed 6 logins for 10 minutes> sudo apt-get install fail2ban > sudo vi /etc/fail2ban/jail.conf
Logging#
> sudo journalctl -b # since last boot > sudo journalctl -k | grep netfilter > sudo journalctl _COMM=sshd > sudo journalctl --vacuum-time=1d # purge, keep last day > sudo journalctl --vacuum-size=500M # purge, keep last 500MB > sudo rm -r /var/log/journal/* # if purging does not help you can erase the whole file and restart > systemctl restart systemd-journald
Restricting Access from three devices#
1. Register your home computer (Windows) at a dyndns service to provide the current ipv6, see dynv6.com#
2. Windows: create script (I use python) to set local IP at dynv6 #
3. Windows schedule script to run each time the PC is booted, see "Aufgabenplanung" (task scheduler)#
4. Raspberry: create and set iptables ruleset, see Firewall with iptables #
5. Raspberry: use python script to query the current ipv6 from dynv6 (Windows) and replace in iptables ruleset#
Notes:- package "python3-iptables" manages legacy ones only, docu1, docu2
- package "python3-nftables" manages nft tables, docu
- alternatively you can use subprocess.run to call the original system commands (easiest)
#!/usr/bin/env python
import socket # determine ipv6
import subprocess # run local commands
tupel = socket.getaddrinfo('your.pc.com', None, socket.AF_INET6)
# tupel like [(<AddressFamily.AF_INET6: 23>, 0, 0, '', ('2a02:5a0:4110:f590:4670:1234:9876:6541', 8384, 0, 0))]
print("tupel=", tupel)
ipv6=tupel[0][4][0]
print("ipv6=", ipv6)
subprocess.run(["/usr/sbin/ip6tables", "-R", "INPUT", "1", "-s", ipv6, "-j", "ACCEPT"]) # replace first ipv6 INPUT rule
subprocess.run(["/usr/sbin/ip6tables", "-R", "OUTPUT", "1", "-d", ipv6, "-j", "ACCEPT"]) # replace first ipv6 OUTPUT rule
6. Raspberry: schedule the ipv6 update in firewall (ip6tables) via crontab#
Run every 5 minutes> sudo crontab -u root -e # anything is activated on save automatically # add following */5 * * * * /home/markus/update_ip6tables.py
No Copyright