IPv6 Security: Pembatasan Akses - Revision history

Onnowpurbo: /* Untuk /etc/hosts.deny */

2019-02-15T03:27:17Z

Untuk /etc/hosts.deny

← Older revision		Revision as of 03:27, 15 February 2019
Line 40:		Line 40:

	ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`"		ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`"
	\| tee -a /var/log/tcp.deny.log \| mail root@localhost)		tee -a /var/log/tcp.deny.log \| mail root@localhost)

	==Logging==		==Logging==

Onnowpurbo: /* Logging */

2019-02-15T03:26:57Z

Logging

← Older revision		Revision as of 03:26, 15 February 2019
Line 44:		Line 44:
	==Logging==		==Logging==

	Tergantung entri di konfigurasi syslog daemon /etc/syslog.conf tcp_wrapper log biasanya di simpan di /var/log/secure.		Tergantung entri di konfigurasi syslog daemon /etc/syslog.conf tcp_wrapper log biasanya di simpan di /var/log/secure atau /var/log/syslog

	===Penolakan Sambungan===		===Penolakan Sambungan===

Onnowpurbo: /* Mengijinkan Sambungan */

2019-02-15T03:25:52Z

Mengijinkan Sambungan

← Older revision		Revision as of 03:25, 15 February 2019
Line 68:		Line 68:

	Jan 2 20:37:50 gate xinetd-ipv6[12346]: START: daytime-stream pid=0		Jan 2 20:37:50 gate xinetd-ipv6[12346]: START: daytime-stream pid=0
	¬ from=::ffff:1.2.3.4		from=::ffff:1.2.3.4
	Jan 2 20:37:56 gate xinetd-ipv6[12346]: START: daytime-stream pid=0		Jan 2 20:37:56 gate xinetd-ipv6[12346]: START: daytime-stream pid=0
	from=2001:0db8:100:200::212:34ff:fe12:3456		from=2001:0db8:100:200::212:34ff:fe12:3456

	Ijin sambungan melalui IPv4 ke semua sshd yang dual-listen sshd menghasilkan kalimat sebagai berikut		Ijin sambungan melalui IPv4 ke semua sshd yang dual-listen sshd menghasilkan kalimat sebagai berikut

	Jan 2 20:43:10 gate sshd[21975]: Accepted password for user from ::ffff:1.2.3.4		Jan 2 20:43:10 gate sshd[21975]: Accepted password for user from ::ffff:1.2.3.4
	¬ port 33381 ssh2		port 33381 ssh2
	Jan 2 20:42:19 gate sshd[12345]: Accepted password for user		Jan 2 20:42:19 gate sshd[12345]: Accepted password for user
	from 2001:0db8:100:200::212:34ff:fe12:3456 port 33380 ssh2		from 2001:0db8:100:200::212:34ff:fe12:3456 port 33380 ssh2

	==Referensi==		==Referensi==

Onnowpurbo: /* Penolakan Sambungan */

2019-02-15T03:25:09Z

Penolakan Sambungan

← Older revision		Revision as of 03:25, 15 February 2019
Line 51:		Line 51:

	Jan 2 20:40:44 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap		Jan 2 20:40:44 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap
	¬ from=::ffff:1.2.3.4		from=::ffff:1.2.3.4
	Jan 2 20:32:06 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap		Jan 2 20:32:06 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap
	from=2001:0db8:100:200::212:34ff:fe12:3456		from=2001:0db8:100:200::212:34ff:fe12:3456

	Penolakan sambungan melalui IPv4 ke sshd dual-listen akan menghasilkan kalimat sebagai berikut		Penolakan sambungan melalui IPv4 ke sshd dual-listen akan menghasilkan kalimat sebagai berikut

	Jan 2 20:24:17 gate sshd[12345]: refused connect from ::ffff:1.2.3.4		Jan 2 20:24:17 gate sshd[12345]: refused connect from ::ffff:1.2.3.4
	¬ (::ffff:1.2.3.4)		(::ffff:1.2.3.4)
	Jan 2 20:39:33 gate sshd[12345]: refused connect		Jan 2 20:39:33 gate sshd[12345]: refused connect
	from 2001:0db8:100:200::212:34ff:fe12:3456		from 2001:0db8:100:200::212:34ff:fe12:3456
	¬ (2001:0db8:100:200::212:34ff:fe12:3456)		(2001:0db8:100:200::212:34ff:fe12:3456)

	===Mengijinkan Sambungan===		===Mengijinkan Sambungan===

Onnowpurbo: /* Referensi */

2018-09-23T00:40:38Z

Referensi

← Older revision		Revision as of 00:40, 23 September 2018
Line 82:		Line 82:

	* http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/hints-daemons-tcpwrapper.html		* http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/hints-daemons-tcpwrapper.html



			==Pranala Menarik==

			* [[IPv6]]

Onnowpurbo: /* Program mana yang mengunakan tcp_wrapper */

2015-06-27T01:03:14Z

Program mana yang mengunakan tcp_wrapper

← Older revision		Revision as of 01:03, 27 June 2015
Line 13:		Line 13:
	Berikut ini yang di ketahui:		Berikut ini yang di ketahui:

	* Setiap layanan yang di panggil oleh xinetd (jika xinetd di compile menggunakan library tcp_wrapper) sshd (jika dicompile menggunakan tcp_wrapper)		* Setiap layanan yang di panggil oleh xinetd (jika xinetd di compile menggunakan library tcp_wrapper)
			* sshd (jika dicompile menggunakan tcp_wrapper)

	==Penggunaan==		==Penggunaan==

Onnowpurbo: /* Program mana yang mengunakan tcp_wrapper */

2013-07-11T00:48:10Z

Program mana yang mengunakan tcp_wrapper

← Older revision		Revision as of 00:48, 11 July 2013
Line 11:		Line 11:
	==Program mana yang mengunakan tcp_wrapper==		==Program mana yang mengunakan tcp_wrapper==

	~~Following are known~~:		Berikut ini yang di ketahui:

	* ~~Each service which is called by~~ xinetd (if xinetd ~~is compiled using~~ tcp_wrapper ~~library~~) sshd (~~if compiled using~~ tcp_wrapper)		* Setiap layanan yang di panggil oleh xinetd (jika xinetd di compile menggunakan library tcp_wrapper) sshd (jika dicompile menggunakan tcp_wrapper)

	==Penggunaan==		==Penggunaan==

Onnowpurbo: /* Logging */

2013-07-11T00:46:23Z

Logging

← Older revision		Revision as of 00:46, 11 July 2013
Line 43:		Line 43:
	==Logging==		==Logging==

	~~Depending on the entry in the~~ syslog daemon ~~configuration file~~ /etc/syslog.conf ~~the~~ tcp_wrapper ~~logs normally into~~ /var/log/secure.		Tergantung entri di konfigurasi syslog daemon /etc/syslog.conf tcp_wrapper log biasanya di simpan di /var/log/secure.

	===Penolakan Sambungan===		===Penolakan Sambungan===

	~~A refused connection via~~ IPv4 ~~to an~~ xinetd ~~covered~~ daytime ~~service produces a line like following example~~		Penolakan sambungan melalui IPv4 ke xinetd yang di lindungi oleh layanan daytime akan menghasilkan kalimat sebagai berikut

	Jan 2 20:40:44 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap		Jan 2 20:40:44 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap
Line 54:		Line 54:
	from=2001:0db8:100:200::212:34ff:fe12:3456		from=2001:0db8:100:200::212:34ff:fe12:3456

	~~A refused connection via~~ IPv4 ~~to an~~ dual-listen ~~sshd produces a line like following example~~		Penolakan sambungan melalui IPv4 ke sshd dual-listen akan menghasilkan kalimat sebagai berikut

	Jan 2 20:24:17 gate sshd[12345]: refused connect from ::ffff:1.2.3.4		Jan 2 20:24:17 gate sshd[12345]: refused connect from ::ffff:1.2.3.4
Line 77:		Line 77:
	Jan 2 20:42:19 gate sshd[12345]: Accepted password for user		Jan 2 20:42:19 gate sshd[12345]: Accepted password for user
	from 2001:0db8:100:200::212:34ff:fe12:3456 port 33380 ssh2		from 2001:0db8:100:200::212:34ff:fe12:3456 port 33380 ssh2


	==Referensi==		==Referensi==

	* http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/hints-daemons-tcpwrapper.html		* http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/hints-daemons-tcpwrapper.html

Onnowpurbo at 00:44, 11 July 2013

2013-07-11T00:44:08Z

← Older revision		Revision as of 00:44, 11 July 2013
Line 36:		Line 36:
	ALL: ALL		ALL: ALL

	~~If this~~ node ~~is a more sensible one you can replace the standard line above with this one, but this can cause a~~ DoS ~~attack~~ (~~load of~~ mailer ~~and~~ spool ~~directory~~)~~, if too many connects were made in short time~~. ~~Perhaps a~~ logwatch ~~is better for such issues~~.		Jika node yang dioperasikan ingin lebih baik kita dapat mengubah kalimat di atas dengan kalimat di bawah ini. Akan tetapi ini bisa menyebabkan serangan DoS (membebani mailer dan directory spool) jika terlalu banyak sambungan dilakukan dalam waktu yang pendek. Mungkin logwatch dapat digunakan untuk kasus seperti itu.

	ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`"		ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`"
	\| tee -a /var/log/tcp.deny.log \| mail root@localhost)		\| tee -a /var/log/tcp.deny.log \| mail root@localhost)

	==~~22.8.4.~~ Logging==		==Logging==

	Depending on the entry in the syslog daemon configuration file /etc/syslog.conf the tcp_wrapper logs normally into /var/log/secure.		Depending on the entry in the syslog daemon configuration file /etc/syslog.conf the tcp_wrapper logs normally into /var/log/secure.

	===~~22.8.4.1. Refused connection~~===		===Penolakan Sambungan===

	A refused connection via IPv4 to an xinetd covered daytime service produces a line like following example		A refused connection via IPv4 to an xinetd covered daytime service produces a line like following example
Line 62:		Line 62:
	¬ (2001:0db8:100:200::212:34ff:fe12:3456)		¬ (2001:0db8:100:200::212:34ff:fe12:3456)

	===~~22.8.4.2. Permitted connection~~===		===Mengijinkan Sambungan===

	~~A permitted connection via~~ IPv4 ~~to an~~ xinetd ~~covered~~ daytime ~~service produces a line like following example~~		Ijin untuk menyambungkan diri melalui IPv4 ke xinetd yang di lindungi oleh layanan daytime menghasilkan kalimat berikut

	Jan 2 20:37:50 gate xinetd-ipv6[12346]: START: daytime-stream pid=0		Jan 2 20:37:50 gate xinetd-ipv6[12346]: START: daytime-stream pid=0
Line 71:		Line 71:
	from=2001:0db8:100:200::212:34ff:fe12:3456		from=2001:0db8:100:200::212:34ff:fe12:3456

	~~A permitted connection via~~ IPv4 ~~to an~~ dual-listen sshd ~~produces a line like following example~~		Ijin sambungan melalui IPv4 ke semua sshd yang dual-listen sshd menghasilkan kalimat sebagai berikut

	Jan 2 20:43:10 gate sshd[21975]: Accepted password for user from ::ffff:1.2.3.4		Jan 2 20:43:10 gate sshd[21975]: Accepted password for user from ::ffff:1.2.3.4

Onnowpurbo: /* Penggunaan */

2013-07-11T00:21:39Z

Penggunaan

← Older revision		Revision as of 00:21, 11 July 2013
Line 17:		Line 17:
	==Penggunaan==		==Penggunaan==

	tcp_wrapper ~~is controlled by two files name~~ /etc/hosts.allow ~~and~~ /etc/hosts.deny. ~~For more information see~~		tcp_wrapper di kontrol oleh dua file /etc/hosts.allow dan /etc/hosts.deny. Untuk informasi lebih lanjut ada baiknya membaca

	$ man hosts.allow		$ man hosts.allow

	===~~22.8.3.1. Example for~~ /etc/hosts.allow===		===Contoh Untuk /etc/hosts.allow===

	~~In this~~ file, ~~each service which should be positive filtered~~ (~~means connects are accepted~~) ~~need a line.~~		Dalam file ini, setiap layanan harus di filter secara positif (artinya sambungan akan di terima) yang di representasikan dalam kalimat:

	sshd: 1.2.3. [2001:0db8:100:200::]/64		sshd: 1.2.3. [2001:0db8:100:200::]/64
	daytime-stream: 1.2.3. [2001:0db8:100:200::]/64		daytime-stream: 1.2.3. [2001:0db8:100:200::]/64

	~~Note~~: ~~there are broken implementations around, which uses following broken~~ IPv6 ~~network description:~~ [2001:0db8:100:200::/64]. ~~Hopefully~~, ~~such versions will be fixed soon~~.		Catatan: ada beberapa implementasi yang tidak baik yang menggunakan deskripsi jaringan IPv6 yang tidak baik [2001:0db8:100:200::/64]. Mudah-mudahan, pada versi mendatang akan lebih baik.

	===~~22.8.3.2. Example for~~ /etc/hosts.deny===		===Untuk /etc/hosts.deny===

	~~This file contains all negative~~ filter ~~entries and should normally deny the rest using~~		File ini berisi entri negatif filter, sebaiknya secara normal menolak semua dengan menggunakan perintah

	ALL: ALL		ALL: ALL