[개념 따라 잡기]
SYN-Flooding 공격 원리
SYN-Flooding 공격은 A클라이언트가 B서버에게 ACK를 보내지 않기 때문이다.
A클라이언트가 B서버에게 ACK를 보내지 안으면 이 연결은 메모리 공간인 백로그큐(Backlog Queue)에 계속 쌓이게 된다.
이처럼 백로그큐가 가득찼을 경우에 공격을 당한 해당 포트로만 접속이 이루어지지 않을 뿐 다른 포트에는 영향을
주지 않고, 또한 서버에 별다른 부하도유발하지 않으므로 관리자가 잘 모르는 경우가 많다.
또한 다른 DoS 공격과는 달리 많은 트래픽을 유발하는 공격이 아니므로쉽게 파악이 되지 않는 공격 형태이다.
실무에서의 효과 - 공격을 받는 포트가 죽지는 않는다.
일단 커널 컴파일 옵션에서 CONFIG_SYN_COOKIES이 Y 로 선택되어 있어야 한다.
]#make menuconfig
이 옵션이 선택되어 있으므로 걱정할 필요는 없다.
or
]#echo 1 > /proc/sys/net/ipv4/tcp_syncookies
syncookies는 백로그큐가 가득 찼을 경우에도 정상적인 접속 요구를 계속 받아들일 수 있도록 해 주므로 SYN_Flooding 공격에 대비한 가장 효과적인 방법중 하나이다.
2. iptables 활용
[기본 정보]
* centos 의 커널이 적재 되는 곳은 "/lib/modules" 이다
[시나리오]
[해결 방법]
*patch-o-matic-ng-20080923.tar.bz2 날짜순으로 업데이트 되는 자료
Successfully downloaded external patch geoip
Successfully downloaded external patch condition
Successfully downloaded external patch IPMARK
Successfully downloaded external patch ROUTE
Successfully downloaded external patch connlimit
Successfully downloaded external patch ipp2p
Successfully downloaded external patch time
./patchlets/ipv4options exists and is not external
./patchlets/TARPIT exists and is not external
Successfully downloaded external patch ACCOUNT
Successfully downloaded external patch pknock
Loading patchlet definitions......................... done
Excellent! Source trees are ready for compilation.
[에러 발생]
에러 메세지 : "/usr/src/kernels/2.6.18-92.1.10.el5-i686/ doesn't seem to be a directory"
커널의 위치가 아니라는 메세지 입니다.
[해결 방법]
]#yum install -y kernel-devel.i686
실행이 완료되면 /usr/src/kernels/2.6.18-XX.X.XX.el5-i686/ 생성된다.
3. connlimit 컴파일
Loading patchlet definitions......................... done
Welcome to Patch-o-matic ($Revision$)!
Kernel: 2.6.18, /usr/src/kernels/2.6.18-92.1.10.el5-i686/
Iptables: 1.3.8, /usr/src/iptables-1.3.8/
Each patch is a new feature: many have minimal impact, some do not.
Almost every one has bugs, so don't apply what you don't need!
-------------------------------------------------------
Already applied:
Testing connlimit... not applied
The connlimit patch:
Author: Gerd Knorr <kraxel@bytesex.org>
Status: ItWorksForMe[tm]
This adds an iptables match which allows you to restrict the
number of parallel TCP connections to a server per client IP address
(or address block).
Examples:
# allow 2 telnet connections per client host
iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
# you can also match the other way around:
iptables -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT
# limit the nr of parallel http requests to 16 per class C sized
# network (24 bit netmask)
iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 \
--connlimit-mask 24 -j REJECT
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?] y
Excellent! Source trees are ready for compilation.
4. 컴파일 환경설정 추가
scripts/kconfig/conf -o arch/i386/Kconfig
*
* Linux Kernel Configuration
*
*
* Code maturity level options
*
Prompt for development and/or incomplete code/drivers (EXPERIMENTAL) [Y/n/?] y
*
* General setup
*
...중략...
Connections/IP limit match support (IP_NF_MATCH_CONNLIMIT) [M/n/?] m
...중략...
#
# configuration written to .config
#
make[1]: *** [scripts/basic/fixdep] 오류 127
make: *** [scripts_basic] 오류 2
4. 모듈 준비 및 환경 설정
CHK include/linux/version.h
CHK include/linux/utsrelease.h
HOSTLD scripts/genksyms/genksyms
MKELF scripts/mod/elfconfig.h
HOSTCC scripts/mod/file2alias.o
HOSTCC scripts/mod/modpost.o
HOSTCC scripts/mod/sumversion.o
HOSTLD scripts/mod/modpost
[root@localhost 2.6.18-92.1.10.el5-i686]# cp net/ipv4/netfilter/Makefile net/ipv4/netfilter/Makefile.orig
obj-m := ipt_connlimit.o
KDIR := /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)
$(MAKE) -C $(KDIR) M=$(PWD) modules
[root@localhost 2.6.18-92.1.10.el5-i686]# make M=net/ipv4/netfilter/
Building modules, stage 2.
MODPOST
CC net/ipv4/netfilter/ipt_connlimit.mod.o
LD [M] net/ipv4/netfilter/ipt_connlimit.ko
5. 모듈 복사 및 권한 설정
6. 추가 모듈 확인
arpt_mangle.ko ip_nat_pptp.ko ipt_ULOG.ko
arptable_filter.ko ip_nat_sip.ko ipt_addrtype.ko
ip_conntrack.ko ip_nat_snmp_basic.ko ipt_ah.ko
ip_conntrack_amanda.ko ip_nat_tftp.ko ipt_connlimit.ko
ip_conntrack_ftp.ko ip_queue.ko ipt_dscp.ko
ip_conntrack_h323.ko ip_tables.ko ipt_ecn.ko
ip_conntrack_irc.ko ipt_CLUSTERIP.ko ipt_hashlimit.ko
ip_conntrack_netbios_ns.ko ipt_DSCP.ko ipt_iprange.ko
ip_conntrack_netlink.ko ipt_ECN.ko ipt_owner.ko
ip_conntrack_pptp.ko ipt_LOG.ko ipt_recent.ko
ip_conntrack_proto_sctp.ko ipt_MASQUERADE.ko ipt_tos.ko
ip_conntrack_sip.ko ipt_NETMAP.ko ipt_ttl.ko
ip_conntrack_tftp.ko ipt_REDIRECT.ko iptable_filter.ko
ip_nat.ko ipt_REJECT.ko iptable_mangle.ko
ip_nat_amanda.ko ipt_SAME.ko iptable_nat.ko
ip_nat_ftp.ko ipt_TCPMSS.ko iptable_raw.ko
ip_nat_h323.ko ipt_TOS.ko
7. 모듈 실행 및 connlimit 옵션 활용
ip_conntrack_ftp 11697 0
ip_conntrack_netbios_ns 6977 0
ipt_REJECT 9537 1
ip_conntrack 53025 4 ipt_connlimit,ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state
nfnetlink 10713 1 ip_conntrack
iptable_filter 7105 1
ip_tables 17029 1 iptable_filter
x_tables 17349 5 ipt_connlimit,ipt_REJECT,xt_state,xt_tcpudp,ip_tables
dm_multipath 22089 0
dm_mod 61661 2 dm_mirror,dm_multipath
ipv6 258145 16
xfrm_nalgo 13765 1 ipv6
ipw2200 137641 0
ieee80211 33289 1 ipw2200
[root@localhost 2.6.18-92.1.10.el5-i686]# /etc/init.d/iptables save
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp --dport 80 --syn -m connlimit --connlimit-above 10 -j DROP
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
chains를 ACCEPT 규칙으로 설정함: filter [ OK ]
iptables 모듈을 제거하는 중: [ OK ]
[root@localhost 2.6.18-92.1.10.el5-i686]# /etc/init.d/iptables start
추가 iptables 모듈을 읽어오는 중: ip_conntrack_netbios_ns i[ OK ]ack_ftp
ip_conntrack_netbios_ns 6977 0
ipt_connlimit 7680 1
ip_conntrack 53025 4 ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state,ipt_connlimit
nfnetlink 10713 1 ip_conntrack
iptable_filter 7105 1
ip_tables 17029 1 iptable_filter
ipt_REJECT 9537 1
x_tables 17349 5 xt_state,ipt_connlimit,ip_tables,ipt_REJECT,xt_tcpudp
dm_multipath 22089 0
dm_mod 61661 2 dm_mirror,dm_multipath
ipv6 258145 16
xfrm_nalgo 13765 1 ipv6
ipw2200 137641 0
ieee80211 33289 1 ipw2200
[root@localhost 2.6.18-92.1.10.el5-i686]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp dpt:http flags:FIN,SYN,RST,ACK/SYN #conn/32 > 10
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
동일한 웹서버를 한개더 셋팅한 다음 DNS에서 분산처리해 준다.
SYN-Flooding 공격의 경우 처음 접속을 맺은 ip에만 공격을 한다.
1번 서버에 syncookies 기능 활용을 활용하여 아무리 많은 SYN-Flooding공격이 와도 서비스가
중지되지 않게 설정해 놓고 DNS에 의해 분산처리를 하면 최소한 서비스가 중지 되는것을 막을 수 있다.
