Использование ProFTPd сервера

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 10:15, 9 November 2010 (edit)
LWF (Talk | contribs)
(Использование ProFTPd сервера)
← Previous diff
Revision as of 11:23, 9 November 2010 (edit) (undo)
LWF (Talk | contribs)
(Использование ProFTPd сервера)
Next diff →
Line 17: Line 17:
Чтобы открыть доступ из WAN должен быть задан аккаун для DDNS. Ссылка на пока не переведенную инструкцию [[DDNS - How to setup Custom DDNS settings using embedded inadyn - HOWTO | Dynamic DNS]]. Чтобы открыть доступ из WAN должен быть задан аккаун для DDNS. Ссылка на пока не переведенную инструкцию [[DDNS - How to setup Custom DDNS settings using embedded inadyn - HOWTO | Dynamic DNS]].
Далее можно перейти к другим настройкам. Далее можно перейти к другим настройкам.
 +
 +===Открытие доступа к FTP из WAN===
 +
 +По умолчанию порт 21 (FTP протокол) заблокирован вcтроенным файрволом. Чтобы открыть этому сервису доступ через файрвол вы должны ввести несколько комманд [[Iptables command]] в поле Administration -> Commands. Меню выглядит так http://www.dd-wrt.com/demo/Diagnostics.asp
 +
 +By opening port 21 to the world, there is always going to be an inherent risk of an attacker probing the open port, and then attempting to crack your password. This risk however can be thwarted by setting strong passwords (more than 8 characters, with random characters, i.e !@#$%^&*() ) and by adding some clever commands via Iptables. Lets discuss them and show what they do.
 +
 +When inserting Iptables rules, it is important to remember that the bottom line, or rule, is the first to be executed. The top line is the last.
 +
 +A basic command for allowing WAN FTP access is as follows:
 +
 + iptables -I INPUT 1 -p tcp --dport 21 -j logaccept
 +
 +
 +The above command dictates that TCP Port 21 will be allowed through the INPUT (Internet) chain and will Log all activity to the routers Kernel.
 +
 +This command, however, is not very secure as anyone with a port scanner and a password generator can attempt to "guess" your user-name(s) and password(s). The following rules will provide a much safer alternative:
 +
 + wanf=`nvram get wan_iface`
 + iptables -I INPUT 2 -i $wanf -p tcp --dport 21 -j logdrop
 + iptables -I INPUT 2 -i $wanf -p tcp -m state --state NEW --dport 21 -m limit --limit 3/minute --limit-burst 2 -j logaccept
 +
 +
 +The above commands are much more effective as the --limit and --limit-burst parameters have been added. The example dictates that if a remote user/attacker attempts to hack your FTP server, they will only get 2 attempts (--limit-burst 2) to connect before the Kernel logs those two packets, after which the 3 per minute syntax is implemented, meaning only 3 attempts at "guessing" your user-name(s) and password(s) will be allowed every minute. If they fail 3 times, the firewall will temporarily "Ban" their IP for 1 minute. This renders most password bots useless, however there are some pretty determined hackers out there that can discover this and adapt their software to match the limit rule. You can change the --limit rule to either Seconds, Minutes, Hours, or Days. The --limit burst value may also be changed.

Revision as of 11:23, 9 November 2010

Оригинальная статья http://www.dd-wrt.com/wiki/index.php/ProFTPd_Server


Использование ProFTPd сервера

DD-WRT по умолчанию на обоих сборках и mini-usb и MEGA включает FTP службу, известную как ProFTPd. Есть некоторые опции которые не доступны через веб интерфейс, и о которых лучше узнать до того как вы соберетесь открыть доступ к содержимому жесткого диска через LAN или WAN.

Одна из важных настроек это назначение параметров доступа. По умолчанию разрешение на запись "Allow Write" отключено. Если вы хотите загружать информацию или файлы через локальную сеть или из удаленного местоположения вы должны сделать доступным запись. Следующим шагом будет задание пользователей и их паролей. Важно отметить, что когда это сделано ваш супер пользователь должен идти первой строчкой. Приблизительный формат:

root P@ssw0rd
guest P@ssw0rd
username P@ssw0rd

... и так далее.

Чтобы открыть доступ из WAN должен быть задан аккаун для DDNS. Ссылка на пока не переведенную инструкцию Dynamic DNS. Далее можно перейти к другим настройкам.

Открытие доступа к FTP из WAN

По умолчанию порт 21 (FTP протокол) заблокирован вcтроенным файрволом. Чтобы открыть этому сервису доступ через файрвол вы должны ввести несколько комманд Iptables command в поле Administration -> Commands. Меню выглядит так http://www.dd-wrt.com/demo/Diagnostics.asp

By opening port 21 to the world, there is always going to be an inherent risk of an attacker probing the open port, and then attempting to crack your password. This risk however can be thwarted by setting strong passwords (more than 8 characters, with random characters, i.e !@#$%^&*() ) and by adding some clever commands via Iptables. Lets discuss them and show what they do.

When inserting Iptables rules, it is important to remember that the bottom line, or rule, is the first to be executed. The top line is the last.

A basic command for allowing WAN FTP access is as follows:

iptables -I INPUT 1 -p tcp --dport 21 -j logaccept 


The above command dictates that TCP Port 21 will be allowed through the INPUT (Internet) chain and will Log all activity to the routers Kernel.

This command, however, is not very secure as anyone with a port scanner and a password generator can attempt to "guess" your user-name(s) and password(s). The following rules will provide a much safer alternative:

wanf=`nvram get wan_iface`
iptables -I INPUT 2 -i $wanf -p tcp  --dport 21 -j logdrop
iptables -I INPUT 2 -i $wanf -p tcp -m state --state NEW --dport 21 -m limit --limit 3/minute --limit-burst 2 -j logaccept


The above commands are much more effective as the --limit and --limit-burst parameters have been added. The example dictates that if a remote user/attacker attempts to hack your FTP server, they will only get 2 attempts (--limit-burst 2) to connect before the Kernel logs those two packets, after which the 3 per minute syntax is implemented, meaning only 3 attempts at "guessing" your user-name(s) and password(s) will be allowed every minute. If they fail 3 times, the firewall will temporarily "Ban" their IP for 1 minute. This renders most password bots useless, however there are some pretty determined hackers out there that can discover this and adapt their software to match the limit rule. You can change the --limit rule to either Seconds, Minutes, Hours, or Days. The --limit burst value may also be changed.