主页 / user-283004

LUser's questions

Martin Hope
LUser
Asked: 2017-11-29 02:33:32 +0800 CST
  • 0

所以我知道这是某种防火墙规则问题。我会尽力解释。我有一个环境，它是 VPS 内的 KVM VM。

网络图

VPS-WAN=1.1.1.1 => KVM-virbr-Interface=10.0.0.1 => KVM-VM 10.0.0.2

由于这些规则，我可以从任何地方远程登录到互联网以访问 KVM-VM。

firewall-cmd --zone=public --add-forward-port=port=25:proto=tcp:toport=25:toaddr=10.0.0.2 --permanent

从 KVM-VM 发送电子邮件时会出现此问题。如果我从这台主机远程登录端口 25 上的任何内容，我将被重定向回我自己。

查看 tcpdump，我可以看到数据包只是被重定向到自身。例如，我正在远程登录 8.8.8.8 25，因为那里显然没有 smtp 服务，并且我的远程登录会话被重定向回我自己。

5:08:36.439608 IP 10.10.0.2.44558 > 10.10.0.2.25: Flags [S], seq 688613034, win 29200, options [mss 1460,sackOK,TS val 1183513828 ecr 0,nop,wscale 7], length 0
05:08:36.439668 IP 10.10.0.1.44558 > 10.10.0.2.25: Flags [S], seq 688613034, win 29200, options [mss 1460,sackOK,TS val 1183513828 ecr 0,nop,wscale 7], length 0
05:08:36.439901 IP 10.10.0.2.25 > 10.10.0.2.44558: Flags [S.], seq 1310863117, ack 688613035, win 28960, options [mss 1460,sackOK,TS val 1183513829 ecr 1183513828,nop,wscale 7], length 0
05:08:36.439927 IP 8.8.8.8.25 > 10.10.0.2.44558: Flags [S.], seq 1310863117, ack 688613035, win 28960, options [mss 1460,sackOK,TS val 1183513829 ecr 1183513828,nop,wscale 7], length 0
05:08:36.440127 IP 10.10.0.2.44558 > 10.10.0.2.25: Flags [.], ack 1, win 229, options [nop,nop,TS val 1183513829 ecr 1183513829], length 0
05:08:36.440152 IP 10.10.0.1.44558 > 10.10.0.2.25: Flags [.], ack 1310863118, win 229, options [nop,nop,TS val 1183513829 ecr 1183513829], length 0
05:08:36.483292 IP 10.10.0.2.25 > 10.10.0.2.44558: Flags [P.], seq 1:35, ack 1, win 227, options [nop,nop,TS val 1183513872 ecr 1183513829], length 34: SMTP: 220 mail.axoai.com ESMTP Postfix
05:08:36.483346 IP 8.8.8.8.25 > 10.10.0.2.44558: Flags [P.], seq 1:35, ack 1, win 227, options [nop,nop,TS val 1183513872 ecr 1183513829], length 34: SMTP: 220 mail.axoai.com ESMTP Postfix
05:08:36.483558 IP 10.10.0.2.44558 > 10.10.0.2.25: Flags [.], ack 35, win 229, options [nop,nop,TS val 1183513872 ecr 1183513872], length 0
05:08:36.483582 IP 10.10.0.1.44558 > 10.10.0.2.25: Flags [.], ack 35, win 229, options [nop,nop,TS val 1183513872 ecr 1183513872], length 0
email
Martin Hope
LUser
Asked: 2016-01-21 10:56:56 +0800 CST
  • 0

我将一个标签列入白名单，我很好奇是否有办法将其列入白名单并同时保持记录。

SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" !ARGS:/^fallout/

像这样的东西会起作用吗？

SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION", "log","allow" !ARGS:/^fallout/

logging
Martin Hope
LUser
Asked: 2015-11-21 14:55:11 +0800 CST
  • 1

我看到在我们的服务器上生成的 cookie 似乎来自站点中的第 3 方对象，并且在登录或浏览站点时不会显示自己。

cookie 是随机的，但都以 Wm 开头。所以其中一些可能是 wm_cm_12345-12345-12345-12345，其中一些可能是 wm-wtchd-22。我在想，如果他们是 Wm*，也许我可以让他们不警觉。

如何将 Wm 开头的 cookie 列入白名单？

以及您可能想要包含的任何其他想法，我如何将这些想法列入白名单？

谢谢

一个示例 cookie

TX:981243-Detects classic SQL injection probings 2/2-OWASP_CRS/WEB_ATTACK/SQLI-REQUEST_COOKIES:wm_rx_123456eabcdef7890_0edb4989-1523-ff12-ccab-beddddaaffccc. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "26"] [id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 41, SQLi=9, XSS=): Last Matched Message: 981243-Detects classic SQL injection probings 2/2"] [data "Last Matched Data: \\x22:61"] [hostname "Somefoowebsite.com"] [uri "/images/nyancat.jpg"]

我所看到的另一个例子：

[30/Nov/2015:13:54:27 --0700] [bumblebeetune.com/sid#7fee134ee758][rid#7fee13b510d8][/nyancat.foo][2] Warning. Pattern match "(.*)" at TX:981243-Detects classic SQL injection probings 2/2-OWASP_CRS/WEB_ATTACK/SQLI-REQUEST_COOKIES:[30/Nov/2015:13:54:27 --0700] [bumblebeetuna.com/sid#7fee134ee758][rid#7fee13b510d8][/nyancat.foo][2] Warning. Pattern match "(.*)" at TX:981243-Detects classic SQL injection probings 2/2-OWASP_CRS/WEB_ATTACK/SQLI-REQUEST_COOKIES:wm_ct_877bb6e0e4744fd6a270f70f3e0c8a67_d464ab47-3cf0-fe3f-89d5-bd785f7bdcfa. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "26"] [id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 18, SQLi=4, XSS=): Last Matched Message: 981243-Detects classic SQL injection probings 2/2"] [data "Last Matched Data: \x22:61"]. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "26"] [id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 18, SQLi=4, XSS=): Last Matched Message: 981243-Detects classic SQL injection probings 2/2"] [data "Last Matched Data: \x22:61"]
cookies