最近做安全审计的工作做多了，找了点路由器安全加固的资料。 1.使用autosecure特性 --- AutoSecure Configuration ---
the router, but it will not make it absolutely resistant to all security attacks ***
All configuration changes will be shown. For a detailed explanation of how the configuration changes enhance security and any possible side effects, please refer to Cisco.com for Autosecure documentation. At any prompt you may enter '?' for help. Use ctrl-c to abort this session at any prompt.
注释 12.3(1)开始路由器增加了autosecure的特性来通过问题的方式自动对路由器进行加固，下面是一个生成的配置实例
no service finger no service pad no service udp-small-servers no service tcp-small-servers service password-encryption service tcp-keepalives-in service tcp-keepalives-out no cdp run no ip bootp server no ip http server no ip finger no ip source-route no ip gratuitous-arps no snmp-server community public no snmp-server community private banner ^C Test ^C security passwords min-length 6 security authentication failure rate 10 log enable password 7 00071A1507545B54 aaa new-model aaa authentication login local_auth local line con 0 login authentication local_auth exec-timeout 5 0 transport output telnet line aux 0 login authentication local_auth exec-timeout 10 0 transport output telnet line vty 0 6 login authentication local_auth transport input telnet login block-for 5 attempts 5 within 6
ip ssh time-out 60 ip ssh authentication-retries 2 line vty 0 6 transport input ssh telnet service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone logging facility local2 logging trap debugging service sequence-numbers logging console critical logging buffered interface FastEthernet0/0 no ip redirects no ip proxy-arp no ip unreachables no ip directed-broadcast no ip mask-reply ! interface Serial0/0 no ip redirects no ip proxy-arp no ip unreachables no ip directed-broadcast no ip mask-reply ! ip cef Router2#
2.使用基于上下文的控制列表（Context-Based Access-Lists） 配置路由器类似防火墙的高级过滤功能
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 166 deny ip any any Router1(config)#access-list 167 permit tcp any any eq telnet Router1(config)#ip inspect name Telnet tcp Router1(config)#interface Serial0/1 Router1(config-if)#ip access-group 166 in Router1(config-if)#ip access-group 167 out Router1(config-if)#ip inspect Telnet out Router1(config-if)#exit Router1(config)#end Router1#
列表来允许回程的数据包，对于上述例子，回来的telnet数据包可以允许通过
Established Sessions Session 821061C0 (172.25.1.1:1379)=>(10.2.2.2:23) tcp SIS_OPEN Router1#
对于以前提到的被动FTP访问问题，也可以采用才方法安全解决
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 155 permit tcp any any eq ftp Router1(config)#access-list 155 deny ip any any Router1(config)#ip inspect name TEST ftp Router1(config)#interface Serial0/0 Router1(config-subif)#ip access-group 155 in Router1(config-subif)#ip inspect TEST in Router1(config-subif)#exit Router1(config)#end Router1# Router1#show ip access-list 155 Extended IP access list 155 permit tcp host 172.20.1.2 eq 11252 host 172.25.1.3 eq 49155 (1415 matches) permit tcp any any eq ftp (151 matches) deny ip any any (3829 matches) Router1#
Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#ip inspect tcp idle-time 1800 Router1(config)#ip inspect udp idle-time 20 Router1(config)#ip inspect tcp finwait-time 1 Router1(config)#ip inspect tcp synwait-time 15 Router1(config)#end Router1#
也增加了对log的支持ip inspect name Telnet tcp audit-trail on 3. 透明IOS防火墙 配置路由器作为2层防火墙
首先配置Integrated Routing and Bridging (IRB)的支持 Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#bridge 1 protocol ieee Router1(config)#interface FastEthernet0/0 Router1(config-if)#bridge-group 1 Router1(config-if)#interface FastEthernet0/1 Router1(config-if)#bridge-group 1 Router1(config-if)#exit Router1(config)#bridge irb Router1(config)#bridge 1 route ip Router1(config)#interface BVI1 Router1(config-if)#ip address 172.25.1.101 255.255.255.0 Router1(config-if)#no shutdown Router1(config-if)#end Router1#
然后配置防火墙的检查规则和ACL
Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#ip inspect name OREILLY tcp Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip inspect OREILLY in Router1(config-if)#exit Router1(config)#access-list 111 deny tcp any host 172.25.1.102 eq 23 Router1(config)#access-list 111 permit ip any any Router1(config)#access-list 112 deny ip any any Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip access-group 111 in Router1(config-if)#interface FastEthernet0/1 Router1(config-if)#ip access-group 112 in Router1(config-if)#end Router1#
方式来过滤 4. 防止拒绝服务攻击 通过对半开放连接的限制来防范拒绝服务攻击
Router1#configure terminal Router1(config)#access-list 109 permit ip any host 192.168.99.2 Router1(config)#ip tcp intercept list 109 Router1(config)#ip tcp intercept max-incomplete high 10 Router1(config)#ip tcp intercept one-minute high 15 Router1(config)#ip tcp intercept max-incomplete low 5 Router1(config)#ip tcp intercept one-minute low 10 Router1(config)#end Router1#
Router1(config)#ip tcp intercept watch-timeout 15 Router1(config)#ip tcp intercept mode watch
Intercepting new connections using access-list 109 9 incomplete, 1 established connections (total 10) 8 connection requests per minute Router1#
检查非标准端口的应用
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#ip port-map http port tcp 8000 Router1(config)#end Router1#
Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 22 permit host 10.1.2.14 Router1(config)#ip port-map http port 8080 list 22 Router1(config)#end Router1# Router1#show ip port-map http Default mapping: http tcp port 80 system defined Default mapping: http tcp port 8000 user defined Host specific: http tcp port 8080 in list 22 user defined
利用内置的入侵监测软件来防范攻击
Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 21 deny 192.168.100.205 Router1(config)#access-list 21 permit any Router1(config)#ip audit notify log Router1(config)#ip audit info action alarm drop reset Router1(config)#ip audit attack action alarm drop reset Router1(config)#ip audit smtp spam 10 Router1(config)#ip audit signature 1107 disable Router1(config)#ip audit signature 2004 disable Router1(config)#ip audit name COOKBOOK info list 21 action alarm drop reset Router1(config)#ip audit name COOKBOOK attack list 21 action alarm drop reset Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip audit COOKBOOK in Router1(config-if)#exit Router1(config)#end Router1#
Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 21 deny 192.168.100.205 Router1(config)#access-list 21 permit any Router1(config)#ip ips name NEOSHI list 21 Router1(config)#ip ips signature 4050 disable Router1(config)#ip ips fail closed Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip ips NEOSHI in Router1(config-if)#exit Router1(config)#end Router1#
Signature statistics [process switch:fast switch] signature 4050:0 packets checked: [0:85] Interfaces configured for ips 1 Session creations since subsystem startup or last reset 0 Current session counts (estab/half-open/terminating) [0:0:0] Maxever session counts (estab/half-open/terminating) [0:0:0] Last session created never Last statistic reset never 7. 登录密码重试锁定 防止对登录密码的暴力xx
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#username kwiley password test123 Router1(config)#aaa new-model Router1(config)#aaa authentication login local_auth local Router1(config)#aaa local authentication attempts max-fail 6 Router1(config)#line vty 0 4 Router1(config-line)#login authentication local_auth Router1(config-line)#end Router1#
kwiley 当然要防止黑客利用才方法对合法用户名进行故意的锁定攻击 8. 认证代理（Authentication Proxy）
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#aaa new-model Router1(config)#aaa authorization auth-proxy default local Router1(config)#ip auth-proxy auth-proxy-banner http Router1(config)#ip auth-proxy name HTTPPROXY http Router1(config)#ip admission auth-proxy-banner http Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip auth-proxy HTTPPROXY Router1(config-if)#ip http server Router1(config)#ip http authentication local Router1(config)#end Router1#
Router1#show ip auth-proxy cache Authentication Proxy Cache Client Name ijbrown, Client IP 172.25.1.52, Port 4224, timeout 60, Time Remaining 53, state ESTAB
|
