IPv6 Security: Pembatasan Akses

Banyak layanan menggunakan library tcp_wrapper untuk kontrol akses. Library tcp_wrapper dapat menolong kita untuk memproteksi layanan dari penggunaan yang salah.

Kemampuan Filtering

Kita dapat menggunakan tcp_wrapper untuk

• Filtering terhadap source address (IPv4 atau IPv6)
• Filtering terhadap pengguna (memerlukan inet daemon di client)

Program mana yang mengunakan tcp_wrapper

Following are known:

• Each service which is called by xinetd (if xinetd is compiled using tcp_wrapper library) sshd (if compiled using tcp_wrapper)

Penggunaan

tcp_wrapper di kontrol oleh dua file /etc/hosts.allow dan /etc/hosts.deny. Untuk informasi lebih lanjut ada baiknya membaca

$ man hosts.allow

Contoh Untuk /etc/hosts.allow

Dalam file ini, setiap layanan harus di filter secara positif (artinya sambungan akan di terima) yang di representasikan dalam kalimat:

sshd:           1.2.3. [2001:0db8:100:200::]/64
daytime-stream: 1.2.3. [2001:0db8:100:200::]/64

Catatan: ada beberapa implementasi yang tidak baik yang menggunakan deskripsi jaringan IPv6 yang tidak baik [2001:0db8:100:200::/64]. Mudah-mudahan, pada versi mendatang akan lebih baik.

Untuk /etc/hosts.deny

File ini berisi entri negatif filter, sebaiknya secara normal menolak semua dengan menggunakan perintah

ALL: ALL

If this node is a more sensible one you can replace the standard line above with this one, but this can cause a DoS attack (load of mailer and spool directory), if too many connects were made in short time. Perhaps a logwatch is better for such issues.

ALL: ALL: spawn (echo "Attempt from %h %a to %d at `date`" 
 | tee -a /var/log/tcp.deny.log | mail root@localhost)

22.8.4. Logging

Depending on the entry in the syslog daemon configuration file /etc/syslog.conf the tcp_wrapper logs normally into /var/log/secure.

22.8.4.1. Refused connection

A refused connection via IPv4 to an xinetd covered daytime service produces a line like following example

Jan 2 20:40:44 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap
¬ from=::ffff:1.2.3.4
Jan 2 20:32:06 gate xinetd-ipv6[12346]: FAIL: daytime-stream libwrap 
 from=2001:0db8:100:200::212:34ff:fe12:3456

A refused connection via IPv4 to an dual-listen sshd produces a line like following example

Jan 2 20:24:17 gate sshd[12345]: refused connect from ::ffff:1.2.3.4
¬ (::ffff:1.2.3.4)
Jan 2 20:39:33 gate sshd[12345]: refused connect 
 from 2001:0db8:100:200::212:34ff:fe12:3456
¬ (2001:0db8:100:200::212:34ff:fe12:3456)

22.8.4.2. Permitted connection

A permitted connection via IPv4 to an xinetd covered daytime service produces a line like following example

Jan 2 20:37:50 gate xinetd-ipv6[12346]: START: daytime-stream pid=0
¬ from=::ffff:1.2.3.4 
Jan 2 20:37:56 gate xinetd-ipv6[12346]: START: daytime-stream pid=0 
 from=2001:0db8:100:200::212:34ff:fe12:3456

A permitted connection via IPv4 to an dual-listen sshd produces a line like following example

Jan 2 20:43:10 gate sshd[21975]: Accepted password for user from ::ffff:1.2.3.4
¬ port 33381 ssh2
Jan 2 20:42:19 gate sshd[12345]: Accepted password for user 
 from 2001:0db8:100:200::212:34ff:fe12:3456 port 33380 ssh2

Referensi

• http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/hints-daemons-tcpwrapper.html