cles::blog

# install package dnf -y install sshguard # create conf cp /usr/share/doc/sshguard/examples/sshguard.conf.sample /etc/sshguard.conf cp -a /etc/sshguard.whitelist{,.org} # change conf pushd /etc patch -p2 <<'EOF' --- /etc/sshguard.whitelist.org 2020-08-02 14:53:08.000000000 +0900 +++ /etc/sshguard.whitelist 2021-02-28 16:20:01.621414766 +0900 @@ -5,9 +5,9 @@ #2001:0db8:85a3:08d3:1319:8a2e:0370:7344 # address blocks in CIDR notation -#127.0.0.0/8 +127.0.0.0/8 #10.11.128.0/17 -#192.168.0.0/24 +192.168.0.0/16 # hostnames #rome-fw.enterprise.com EOF patch -p2 <<'EOF' --- /usr/share/doc/sshguard/examples/sshguard.conf.sample 2018-12-16 11:41:51.000000000 +0900 +++ /etc/sshguard.conf 2021-03-02 09:22:13.490714460 +0900 @@ -6,14 +6,14 @@ #### REQUIRED CONFIGURATION #### # Full path to backend executable (required, no default) -#BACKEND="/usr/local/libexec/sshg-fw-iptables" +BACKEND="/usr/libexec/sshguard/sshg-fw-firewalld" # Space-separated list of log files to monitor. (optional, no default) -#FILES="/var/log/auth.log /var/log/authlog /var/log/maillog" +#FILES="/var/log/secure" # Shell command that provides logs on standard output. (optional, no default) # Example 1: ssh and sendmail from systemd journal: -#LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -t sendmail -o cat" +LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -t sendmail -o cat" # Example 2: ssh from os_log (macOS 10.12+) #LOGREADER="/usr/bin/log stream --style syslog --predicate '(processImagePath contains \"sshd\")'" @@ -24,17 +24,17 @@ # Block attackers for initially BLOCK_TIME seconds after exceeding THRESHOLD. # Subsequent blocks increase by a factor of 1.5. (optional, default 120) -BLOCK_TIME=120 +BLOCK_TIME=300 # Remember potential attackers for up to DETECTION_TIME seconds before # resetting their score. (optional, default 1800) -DETECTION_TIME=1800 +DETECTION_TIME=86400 # Size of IPv6 'subnet to block. Defaults to a single address, CIDR notation. (optional, default to 128) IPV6_SUBNET=128 # Size of IPv4 subnet to block. Defaults to a single address, CIDR notation. (optional, default to 32) -IPV4_SUBNET=32 +IPV4_SUBNET=24 #### EXTRAS #### # !! Warning: These features may not work correctly with sandboxing. !! @@ -44,8 +44,8 @@ # Colon-separated blacklist threshold and full path to blacklist file. # (optional, no default) -#BLACKLIST_FILE=90:/var/lib/sshguard/enemies +BLACKLIST_FILE=60:/var/lib/sshguard/enemies # IP addresses listed in the WHITELIST_FILE are considered to be # friendlies and will never be blocked. -#WHITELIST_FILE=/etc/friends +WHITELIST_FILE=/etc/sshguard.whitelist EOF popd # enable/start daemon systemctl enable --now sshguard.service

# firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: cockpit dhcpv6-client ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv6" source ipset="sshguard6" drop rule family="ipv4" source ipset="sshguard4" drop

# journalctl -u sshguard Feb 28 16:58:51 sshhost.example.com sshguard[57453]: Attack from "999.999.999.999" on service SSH with danger 2. Feb 28 16:58:51 sshhost.example.com sshguard[57453]: Attack from "999.999.999.999" on service SSH with danger 2. Feb 28 16:59:23 sshhost.example.com sshguard[57453]: Attack from "999.999.999.999" on service SSH with danger 2. Feb 28 16:59:23 sshhost.example.com sshguard[57453]: Blocking "999.999.999.999/32" for 120 secs (3 attacks in 32 secs, after 1 abuses over 32 secs.)

# ipset list sshguard4 Name: sshguard4 Type: hash:net Revision: 6 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 440 References: 0 Number of entries: 1 Members: 999.999.999.999

dnf -y groupinstall "Development Tools" dnf -y install readline-devel ncurses-devel openssl-devel wget https://jp.softether-download.com/files/softether/v4.34-9745-rtm-2020.04.05-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.34-9745-rtm-2020.04.05-linux-x64-64bit.tar.gz tar zxvf softether-vpnserver-v4.27-9668-beta-2018.05.29-linux-x64-64bit.tar.gz chmod 700 vpnserver pushd vpnserver make i_read_and_agree_the_license_agreement cat << EOS > ./adminip.txt 192.168.0.0/16 EOS popd mv vpnserver /usr/local/bin cat << EOS > /etc/systemd/system/softether.service [Unit] Description=SoftEther VPN Server After=network.target [Service] Type=forking ExecStart=/usr/local/vpnserver/vpnserver start ExecStartPre=/sbin/ip link set dev ens224 arp off promisc on ExecStop=/usr/local/vpnserver/vpnserver stop [Install] WantedBy=multi-user.target EOS systemctl daemon-reload systemctl enable softether.service systemctl status softether.service cat << EOS > /etc/firewalld/services/softether.xml <service> <short>Softether</short> <description>Softether VPN Server</description> <port protocol="tcp" port="443"/> <port protocol="tcp" port="5555"/> <port protocol="udp" port="443"/> <port protocol="udp" port="5555"/> </service> EOS firewall-cmd --reload firewall-cmd --add-service=softether firewall-cmd --runtime-to-permanent nmcli connection show ens224 connection.zone nmcli connection up ens224

wget https://software.intel.com/sites/default/files/article/181731/intel-aesni-sample-library-v1.2.zip wget https://jp.softether-download.com/files/softether/v4.34-9744-beta-2020.03.20-tree/Source_Code/softether-src-v4.34-9744-beta.tar.gz wget https://raw.githubusercontent.com/el1n/OpenWRT-package-softether/master/softethervpn/patches/102-regionunlock.patch unzip intel-aesni-sample-library-v1.2.zip cat << EOS >./intel_aes_lib.patch --- Intel_AESNI_Sample_Library_v1.2/intel_aes_lib/src/intel_aes.c.org 2010-10-01 17:37:14.000000000 -0400 +++ Intel_AESNI_Sample_Library_v1.2/intel_aes_lib/src/intel_aes.c 2021-02-20 04:49:34.126103061 -0500 @@ -293,17 +293,30 @@ * ECX = 'l' 'e' 't' 'n' */ +// See: https://github.com/rrnewton/intel-aes/blob/master/cbits/Intel_AESNI_Sample_Library_v1.0/intel_aes_lib/src/intel_aes.c +// AuthenticAMD + + int intel = 1; + int amd = 1; if (memcmp((unsigned char *)&cpuid_results[1], "Genu", 4) != 0 || memcmp((unsigned char *)&cpuid_results[3], "ineI", 4) != 0 || memcmp((unsigned char *)&cpuid_results[2], "ntel", 4) != 0) - return no; + intel = 0; - __cpuid(cpuid_results,1); + if (memcmp((unsigned char *)&cpuid_results[1], "Auth", 4) != 0 || + memcmp((unsigned char *)&cpuid_results[3], "enti", 4) != 0 || + memcmp((unsigned char *)&cpuid_results[2], "cAMD", 4) != 0) + amd = 0; - if (cpuid_results[2] & AES_INSTRCTIONS_CPUID_BIT) - return yes; + if (intel || amd) + { + __cpuid(cpuid_results,1); - return no; + if (cpuid_results[2] & AES_INSTRCTIONS_CPUID_BIT) + return yes; + } + else + return no; } EOS sed -i "s/\r//g" Intel_AESNI_Sample_Library_v1.2/intel_aes_lib/src/intel_aes.c patch -p0 --ignore-whitespace < intel_aes_lib.patch pushd ./Intel_AESNI_Sample_Library_v1.2/intel_aes_lib ./mk_lnx_lib64.sh popd cat << EOS > ./enable_aesni.patch --- src/makefiles/linux_64bit.mak.org 2021-02-20 03:15:08.467625594 -0500 +++ src/makefiles/linux_64bit.mak 2021-02-20 03:15:57.523605859 -0500 @@ -66,9 +66,9 @@ OPTIONS_LINK_DEBUG=-g -fsigned-char -m64 -lm -ldl -lrt -lpthread -lssl -lcrypto -lreadline -lncurses -lz -OPTIONS_COMPILE_RELEASE=-DNDEBUG -DVPN_SPEED -DUNIX -DUNIX_LINUX -DCPU_64 -D_REENTRANT -DREENTRANT -D_THREAD_SAFE -D_THREADSAFE -DTHREAD_SAFE -DTHREADSAFE -D_FILE_OFFSET_BITS=64 -I./src/ -I./src/Cedar/ -I./src/Mayaqua/ -O2 -fsigned-char -m64 +OPTIONS_COMPILE_RELEASE=-DUSE_INTEL_AESNI_LIBRARY -DNDEBUG -DVPN_SPEED -DUNIX -DUNIX_LINUX -DCPU_64 -D_REENTRANT -DREENTRANT -D_THREAD_SAFE -D_THREADSAFE -DTHREAD_SAFE -DTHREADSAFE -D_FILE_OFFSET_BITS=64 -I./src/ -I./src/Cedar/ -I./src/Mayaqua/ -O2 -fsigned-char -m64 -OPTIONS_LINK_RELEASE=-O2 -fsigned-char -m64 -lm -ldl -lrt -lpthread -lssl -lcrypto -lreadline -lncurses -lz +OPTIONS_LINK_RELEASE=-O2 ../Intel_AESNI_Sample_Library_v1.2/intel_aes_lib/lib/x64/intel_aes64.a -fsigned-char -m64 -lm -ldl -lrt -lpthread -lssl -lcrypto -lreadline -lncurses -lz INSTALL_BINDIR=/usr/bin/ INSTALL_VPNSERVER_DIR=/usr/vpnserver/ EOS tar zxvf softether-src-v4.34-9744-beta.tar.gz cd v4.34-9744/ patch -p1 < ../102-regionunlock.patch patch -p0 < ../enable_aesni.patch ./configure make cp -af ./bin/vpnserver/* /usr/local/vpnserver systemctl restart softether.service