IPBan 윈도우 RDP 차단 설치 명령어로 하기

[동우]

https://xinet.kr/?p=3423 이분의 글을 보고 작성 하다 안되서 내가 만듬 ㅋㅋㅋ; ㅎㅎ ㅠㅠ..

ss.txt

4.45KB

https://github.com/DigitalRuby/IPBan
https://github.com/DigitalRuby/IPBan/releases 여기서 다운로드 하면 된다.  IPBan-Windows-x64_*_*_*.zip 이런 식의 파일

REM "윈도우의 기본 설정을 해야 합니다"

REM "들어오는 NTLM 트래픽 모두거부 https://docs.microsoft.com/ko-kr/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic "
reg add HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA\MSV1_0 /v RestrictReceivingNTLMTraffic /t REG_DWORD /d 2 /f

REM "TLS 1.2 이상으로 하기 이걸 필수적으로 해야 하는 것 같아요 아래는 파워쉘.. 저의 경우 안되서.. 아래의 레지스트로 등록 했어요"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

REM https://xinet.kr/?p=3423
REM https://devblogs.microsoft.com/powershell/powershell-gallery-tls-support/
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /t REG_DWORD /d 1 /f

REM TLS1.3 등록 하기 서버 클라우드 모두
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" /v "DisabledByDefault" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" /v "Enabled" /t REG_DWORD /d 1 /f
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /v "DisabledByDefault" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /v "Enabled" /t REG_DWORD /d 1 /f
REM "되돌리기 reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3" /f  "

REM https://learn.microsoft.com/ko-kr/dotnet/framework/network-programming/tls
REM https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /v "SystemDefaultTlsVersions" /t REG_DWORD /d 1 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /t REG_DWORD /d 1 /f
REM TLS 1.2 설정 끝.

---

echo "인터넷에서 다운로드 한다 그럼 다운로드 폴더에 파일이 들어 간다고 가정 하고"
echo md 폴더 만들기 그리고 cd 그리고 이동하기
md "%USERPROFILE%\Downloads\IPBan"
cd "%USERPROFILE%\Downloads\IPBan"

echo "파일 찾아서 풀어 주기"
for /f "delims=" %a in ('dir /a-d /b /o /s "%USERPROFILE%\Downloads\IPBan-Windows-x64*.zip"') do (tar -zxvf "%a" -C ".") 

echo "압축해제한 파일을 프로그램 폴더로 이동 시키기"
xcopy "%USERPROFILE%\Downloads\IPBan" "%ProgramFiles%\IPBan\" /e /h /k

echo "감사 권한을 주기 실패 성공 모두"
auditpol.exe /set /category:"{69979849-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol.exe /set /category:"{69979850-797A-11D9-BED3-505054503030}" /success:enable /failure:enable

echo "서비스 등록 해주기"
sc.exe create IPBAN type= own start= auto binPath= "%ProgramFiles%\IPBan\DigitalRuby.IPBan.exe" DisplayName= "IPBan Service"

echo "서비스 설명 적어 주기 이런 이런 프로그램 입니다 하고."
sc.exe description IPBAN "Automatically builds firewall rules for abusive login attempts: https://github.com/DigitalRuby/IPBan"

echo "이건 나도 모름 ㅎㅎ"
sc.exe failure IPBAN reset= 9999 actions= "restart/60000/restart/60000/restart/60000"

echo "서비스 실행 하기 에러 안나면 첫번째 실행은 성공 한 것입니다."
sc.exe start IPBAN

sc config IPBAN start=auto

echo "일단 서비스 중단 하기 편집 해야 하니"
net stop IPBAN

echo "편집 하기 전에 저장 해주기 나중에 고장 나면 복구 해야 하니"
cd "%ProgramFiles%\IPBan" && tar -cvzf "%ProgramFiles%\IPBan\ipban-config.zip" "ipban.config"
notepad "%ProgramFiles%\IPBan\ipban.config"

REM https://cafe.daum.net/candan/GGFN/475

REM 날짜 시간 초단위 까지 압축 하기 tar 

powershell -Command "& { $datetime = (Get-Date).ToString('yyyyMMddHHmmss'); Compress-Archive -Path '%ProgramFiles%\IPBan\ipban.config' -DestinationPath ('%ProgramFiles%\IPBan\ipbanconfig' + $datetime + '.zip'); }"

echo 실행해 본다 되는지
net start IPBAN

---

특별 부분

https://kin.naver.com/qna/detail.nhn?d1Id=1&dirId=104&docId=432288858   

전승환님이께서 자동 다운로드 만들어 주심 그것도 한줄로 ㅋㅋㅋㅋ

대박이요.

md "%USERPROFILE%\Downloads\IPBan"
cd "%USERPROFILE%\Downloads\IPBan"

$target = (Invoke-WebRequest -Uri 'https://github.com/DigitalRuby/IPBan/releases').Links.Href | findstr "tree";$targetStr = "";foreach($Line in $target) {$targetStr = $Line;break;}foreach($Line in $targetStr.Split('/')) {$targetStr1 = $Line;}$targetStr2 = $targetStr1 -replace "\.","_";Invoke-WebRequest ('https://github.com/DigitalRuby/IPBan/releases/download/'+$targetStr1+'/IPBan-Windows-x64_'+ $targetStr2 + '.zip') -OutFile ('%USERPROFILE%\Downloads\IPBan\IPBan-Windows-x64.zip');

아쉽게 파워쉘로 하세요 ㅎㅎ cmd랑 파워쉘이랑 켜야 하지만 이게 한계네요

---

echo 들어오는 NTLM 트래픽 모두거부 https://docs.microsoft.com/ko-kr/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic
reg add HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA\MSV1_0 /v RestrictReceivingNTLMTraffic /t REG_DWORD /d 2 /f

echo 위의 내용 설명 안하고 그냥 명령어로 했을때

md "%USERPROFILE%\Downloads\IPBan"
cd "%USERPROFILE%\Downloads\IPBan"
for /f "delims=" %a in ('dir /a-d /b /o /s "%USERPROFILE%\Downloads\IPBan-Windows-x64*.zip"') do (tar -zxvf "%a" -C ".") 
xcopy "%USERPROFILE%\Downloads\IPBan" "%ProgramFiles%\IPBan\" /e /h /k
auditpol.exe /set /category:"{69979849-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol.exe /set /category:"{69979850-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
sc.exe create IPBAN type= own start= auto binPath= "%ProgramFiles%\IPBan\DigitalRuby.IPBan.exe" DisplayName= "IPBan Service"
sc.exe description IPBAN "Automatically builds firewall rules for abusive login attempts: https://github.com/DigitalRuby/IPBan"
sc.exe failure IPBAN reset= 9999 actions= "restart/60000/restart/60000/restart/60000"
sc.exe start IPBAN
net stop IPBAN
cd "%ProgramFiles%\IPBan" && tar -cvzf "%ProgramFiles%\IPBan\ipban-config.zip" "ipban.config"
notepad "%ProgramFiles%\IPBan\ipban.config"

net stop IPBAN 

net start IPBAN

---

echo "https://memonote.tistory.com/2 "

echo 추가 정보 "https://github.com/DigitalRuby/IPBan/wiki/Configuration "
echo 경로 레벨 Trace 추적 섬세함
echo "https://www.uname.in/176 https://mdj1234.tistory.com/63 "
echo FailedLoginLogLevel
Trace, Debug, Info, Warn, Error, Critical
<FailedLoginLogLevel>Trace</FailedLoginLogLevel>
#
#
echo FailedLoginRegex 실패한 로그인 정규식
<Source>IPBanCustom</Source>
<FailedLoginThreshold>1</FailedLoginThreshold>
#
#
echo 로그인 시도 차단 "https://support.forpsi.hu/kb/a612/windows-remote-desktop-protocol-rdp-bejelentkezesi-hiba-elharitas.aspx "
echo 이게 중요 한것 같음 결론. RDP 차단 1회 부터 차단 틀릴 경우 6으로 하면 6번 틀릴 경우 차단
* WINDOWS ONLY * 
<FailedLoginThreshold>1</FailedLoginThreshold>
#
#
echo ProcessInternalIPAddresses 내부 아이피 처리 true
    <!-- Whether to process internal ip addresses -->
    <add key="ProcessInternalIPAddresses" value="true"/>
#
#
수정해야 할 부분 정리
로그인 5회 실패시 등록
<add key="FailedLoginAttemptsBeforeBan" value="5"/>
#
#
ipban 시간 2일
<add key="BanTime" value="02:00:00:00"/>

차단후 제거 기준일 2일
<add key="ExpireTime" value="02:00:00:00"/>

---

여기서 부터 보세요

<!-- Optional, set a log level for failed logins - must match exactly (case sensitive) one of the following:
<FailedLoginLogLevel>Warn</FailedLoginLogLevel>
<FailedLoginLogLevel>Trace</FailedLoginLogLevel>

WINDOWS ONLY
<LogLevel>Warn</LogLevel>
<LogLevel>Trace</LogLevel>

<!-- Number of failed logins before banning the ip address -->
<add key="FailedLoginAttemptsBeforeBan" value="5"/>
<add key="FailedLoginAttemptsBeforeBan" value="2"/>

<add key="BanTime" value="01:00:00:00"/>
<add key="BanTime" value="02:00:00:00"/>

<add key="ExpireTime" value="01:00:00:00"/>
<add key="ExpireTime" value="02:00:00:00"/>

ipban.zip

9.55KB

ipbanconfig20230327010650.zip

9.53KB

처음으로 성공한 것

wf.msc 

윈도우키 + R

IPBan_Block_0 이런식으로 등록 되어 있으면 성공 한거네요 만약 없으면 실패한거고요 ㅠ 

두번째 파일은 dns 허용한거에요 9.9.9.9 로 말이죠.

---

REM 자신의 DNS를 입력 하면 된다
<add key="Whitelist" value=""/>
<add key="Whitelist" value="9.9.9.9"/>

REM 이것은 와일드 카드 즉 * 이런 형태를 추가 할수 있는 것 같다
<add key="WhitelistRegex" value=""/>

REM https://cafe.daum.net/candan/GGFN/475

REM 날짜 시간 초단위 까지 압축 하기 tar 

powershell -Command "& { $datetime = (Get-Date).ToString('yyyyMMddHHmmss'); Compress-Archive -Path '%ProgramFiles%\IPBan\ipban.config' -DestinationPath ('%ProgramFiles%\IPBan\ipbanconfig' + $datetime + '.zip'); }"

---

cd "%ProgramFiles%\IPBan" && tar -cvzf "%ProgramFiles%\IPBan\ipban-config2.zip" "ipban.config"
다시 다른 이름으로 저장 하기 

echo 실행해 본다 되는지
net start IPBAN

이걸 이렇게 해야 하는 이유는 지연 시작 하면 한나절 되어서 켜짐 -_-;;
sc config IPBAN start=auto

로그 보는 방법 여기에 fail 이라고 막 찍히고 이상한 ip 찍히기 시작하면 의심 해봐야 하는 것.
notepad "%ProgramFiles%\IPBan\logfile.txt"

cd ..
sc.exe stop IPBAN
sc.exe delete IPBAN
rmdir "%ProgramFiles%\IPBan" /s
만약 서비스가 마음에 안들면 삭제 하기

기타 번역은

https://cafe.daum.net/candan/GGFN/382   

기타 권한 주기

echo 권한 제한 하기 IPBan 켜는 문제. 네트워크 S-1-5-2

REM 권한을 주어도 수정 할수 있다. 권한을 풀 필요가 없다

---

REM "PowerShell 파워쉘 해킹 시도?"
REM "%ProgramFiles%\IPBan\SAM 아쉽게 이 경로는 안된다 %ProgramFiles%\IPBan 이렇게 해야 한다고" 
icacls "%ProgramFiles%\IPBan" 
takeown /F "%ProgramFiles%\IPBan" /A /R /D Y
icacls "%ProgramFiles%\IPBan" /grant Administrators:F /t
icacls "%ProgramFiles%\IPBan" /save d:\IPBan.txt /t
REM icacls "%ProgramFiles%\IPBan" /setintegritylevel H /t
icacls "%ProgramFiles%\IPBan" /deny "NETWORK SERVICE":(OI)(CI)F "GUEST":(OI)(CI)F "IIS_IUSRS":(OI)(CI)F "REMOTE INTERACTIVE LOGON":(OI)(CI)F "*S-1-5-32-546:(OI)(CI)F" "*S-1-0-0:(OI)(CI)F" "*S-1-5-7:(OI)(CI)F" "*S-1-5-13:(OI)(CI)F" /t /inheritance:e
icacls "%ProgramFiles%\IPBan" /setowner "NT SERVICE\TrustedInstaller" /t
icacls "%ProgramFiles%\IPBan" /grant:r Administrators:RX /t
icacls "%ProgramFiles%\IPBan"

REM icacls "%ProgramFiles%\IPBan" /deny "*S-1-5-13":F"
REM 터미널 사용자 서버 "*S-1-5-13":F 

REM "복구 할때"
REM icacls "%ProgramFiles%\IPBan" /reset /t
REM icacls /restore "%windir%\System32" d:\IPBan.txt

---

takeown /F "%ProgramFiles%\IPBan" /A /r
icacls "%ProgramFiles%\IPBan" /grant Administrators:F /t
icacls "%ProgramFiles%\IPBan" /remove "*S-1-5-2" /t
icacls "%ProgramFiles%\IPBan" /setowner "NT SERVICE\TrustedInstaller" /t
icacls "%ProgramFiles%\IPBan" /grant:r Administrators:RX /t
icacls "%ProgramFiles%\IPBan" 

echo 수정 해야 할때

takeown /F "%ProgramFiles%\nlog.config" /A

icacls "%ProgramFiles%\IPBan\nlog.config" /grant Administrators:F

takeown /F "%ProgramFiles%\IPBan\ipban.config" /A

icacls "%ProgramFiles%\IPBan\ipban.config" /grant Administrators:F

echo 다시 권한 높이기

takeown /F "%ProgramFiles%\nlog.config" /A

icacls "%ProgramFiles%\IPBan\nlog.config" /setowner "NT SERVICE\TrustedInstaller" /t

icacls "%ProgramFiles%\IPBan\nlog.config" /grant Administrators:RX /t

takeown /F "%ProgramFiles%\IPBan\ipban.config" /A

icacls "%ProgramFiles%\IPBan\ipban.config" /setowner "NT SERVICE\TrustedInstaller" /t

icacls "%ProgramFiles%\IPBan\ipban.config" /grant Administrators:RX /t

net stop IPBAN 
net start IPBAN

cd "%ProgramFiles%\IPBan" && tar -cvzf "%ProgramFiles%\IPBan\ipban-config.zip" "ipban.config"
notepad "%ProgramFiles%\IPBan\ipban.config"

echo 권한중 경우 삭제 방법

sc.exe stop IPBAN
sc.exe delete IPBAN

takeown /F "%ProgramFiles%\IPBan" /A /r
icacls "%ProgramFiles%\IPBan" /grant Administrators:F /t

rd /s /q "%ProgramFiles%\IPBan"

echo 권한 처음으로 돌리기
takeown /F "%ProgramFiles%\IPBan" /A /r
icacls "%ProgramFiles%\IPBan" /t /q /c /t /reset
icacls "%ProgramFiles%\IPBan" 

---

https://youtu.be/4BEamJCphKM

---

Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
This group will block RRAS login failures to Windows
SVN failed login attempts on Windows
Override failed login threshold or leave 0 for default
Custom log entries, Windows
This group will block custom ipban login failures on Windows

---

FailedLoginRegex  프로만 된다?
<PlatformRegex>Linux</PlatformRegex>

<PlatformRegex>Windows</PlatformRegex>
Windows 으로 변경

<FailedLoginThreshold>1</FailedLoginThreshold>

Smarter mail failed logins, Windows
<FailedLoginThreshold>1</FailedLoginThreshold>


Setup expressions to block for Windows event viewer.
<FailedLoginThreshold>1</FailedLoginThreshold>


This group will block OpenSSH login failures
<FailedLoginThreshold>1</FailedLoginThreshold>


Smarter mail failed logins, Windows
<FailedLoginThreshold>1</FailedLoginThreshold>
Linux and Windows
<FailedLoginThreshold>1</FailedLoginThreshold>

Custom log entries, Windows
<FailedLoginThreshold>1</FailedLoginThreshold>

Exchange logins, Windows
<FailedLoginThreshold>1</FailedLoginThreshold>

Override failed login threshold or leave 0 for default
<FailedLoginThreshold>1</FailedLoginThreshold>

ipban-config2.zip

9.31KB

1.8.0 버전