°ä²¼¹¦·ò£º2019-03-11
½üÆÚ£¬ÃûΪ“GlobeImposter ”µÄÀÕË÷²¡¶¾Ôٴη¢×÷£¬Öйú¶à¶àÓû§“ÖÐÕД¡£GA»Æ½ð¼×ÍøÂçÒÑ°ä²¼ÏÂÒ»´ú·À»ðǽµÄ·À±¸´ëÊ©£¬½¨Òé¿Í»§ÊµÊ±µ÷Õû·À»ðǽ¼°Öնˣ¬·À±¸²¡¶¾¡£ÎªÁËÔ®ÊÖÓû§³¹µ×¶Å¾ø¸Ã²¡¶¾£¬GA»Æ½ð¼×¼¼Êõ·þÎñ¹¤³ÌʦΪ¿í´óÓû§½øÒ»²½Ìṩ¸üΪ¾ßÌåµÄ´¦Öù滮¡£
GA»Æ½ð¼×²úÆ·Õë¶Ô“GlobeImposter ”µÄ·À±¸´ëÊ©
“GlobeImposter”ÀÕË÷²¡¶¾³ýÀûÓÃÒÑÖªµÄWindowsµÄϵͳ·ì϶֮±í£¬»¹ÀûÓÃWindowsÔ¶³Ì×ÀÃæ·þÎñÓйض˿ڽøÐд«²¼£¬GA»Æ½ð¼×ÍøÂçÇ¿ÁÒ½¨ÒéÓйص¥ÔªºÍÓ×ÎÒÓû§×öºÃÒÔÏ´ëÊ©£º
£¨Ò»£©¹Ø¹Ø135¡¢137¡¢139¡¢445µÈ¶Ë¿ÚµÄ±í²¿ÍøÂç½Ó¼ûȨÏÞ£¬ÔÚ·þÎñÆ÷ÉϹعز»ÓÃÒªµÄÉÏÊö·þÎñ¶Ë¿Ú£»
£¨¶þ£©¼ÓÇ¿¶Ô135¡¢137¡¢139¡¢445µÈ¶Ë¿ÚµÄÄÚ²¿ÍøÂçÇøÓò½Ó¼ûÉó¼Æ£¬ÊµÊ±·¢ÏÖ·ÇÊÚȨÐÐΪ»òDZÔڵĹ¥»÷ÐÐΪ£»
£¨Èý£©¹Ø¹ØWindowsÔ¶³Ì×ÀÃæ·þÎñµÄ±íÍø½Ó¼ûȨÏÞ£¨Ä¬È϶˿ÚΪTCP 3389£©£¬Í¬Ê±ÔÚ·þÎñÆ÷ÉϹعØWindowsÔ¶³Ì×ÀÃæ·þÎñ¡£ÈçÈ·Ð迪ÆôÔ¶³Ì×ÀÃæ·þÎñ£¬½¨ÒéÅú¸ÄĬÈϵÄWindowsÔ¶³Ì×ÀÃæ·þÎñ¶Ë¿Ú£¬»òͨ¹ýWindows·À»ðǽ¡¢ÍøÂçÉ豸ÉèÖÃÔÊÐí½Ó¼û¸Ã·þÎñµÄÔ¶³ÌÖ÷»úµØÖ·£»
£¨ËÄ£©¼ÓÇ¿·þÎñÆ÷µÄÃÜÂëÖÎÀí£¬ÉèÖÃÇ¿¿ÚÁî²¢¶¨ÆÚ¸ü»»ÃÜÂ룻
Ñ¡È¡GA»Æ½ð¼×²úÆ·×齨µÄÍøÂ磬Äܹ»¿ªÆôÓйزúÆ·Ö°ÄܽøÐÐÔ¤·À£¬ÒÔ·À±¸ºÍ½µµÍ¹¥»÷²úÉúµÄÓ°Ïì¡£¿ÉÔÚÍøÂçÌìǵ£¨³ö¿ÚÍø¹Ø¡¢Â·ÓÉÆ÷»ò°²È«É豸£©¡¢ÄÚ²¿ÍøÂçÇøÓò£¨»¥»»»ú¼°ÎÞÏßÉ豸£©¡¢Ö÷»ú°²È«£¨ÀûÓÃÈí¼þ£©µÄÒµÎñÓÅÏÈÅŲ¼Âß¼½Ç¶È£¬²¿Êð°²È«Õ½Êõ£¬¾ßÌå·À±¸¹æ»®ÈçÏ£º
°ÑÎÈ£ºÈôͨ¹ýÍøÂçÉ豸×è¶Ï445¼°ÆäËû¹ØÁª¶Ë¿Ú£¨Èç: 135¡¢137¡¢139¡¢3389¶Ë¿Ú)µÄ±í²¿ÍøÂç½Ó¼ûȨÏÞ£¬»áÓ°Ïìµ½“WindowsÎļþ¹²ÏíÖ°ÄÜ”¡¢“ADÓò¡¢LDAP¶Ô½Ó³¡¾°”¡¢“ÔÆ×ÀÃæ²úÆ·“µÈµÄʹÓ㬽¨Òéƾ¾Ý¿Í»§ÏÖʵҵÎñÇé¿öÑ¡Ôñ·â¶ÂµÄ¶Ë¿Ú£¬Õë¶ÔÔÆ·þÎñÆ÷»òÒµÎñ·þÎñÆ÷£¬·Åͨ139ºÍ445¶Ë¿Ú¡£
• ³ö¿ÚÍø¹Ø²úÆ·
ÍøÂçÌìǵ³ö¿Ú²¿ÊðGA»Æ½ð¼×NPE/NBR/EGÍø¹Ø²úÆ·£¬ÖØҪѡȡ²»ÈÝ135¡¢137¡¢139¡¢445¡¢3389·þÎñ¶Ë¿Ú·À±¸·çÏÕ¡£±ØÒª°ÑÎÈÍø¹Ø²úÆ·¾³£»á²¿ÊðºÃ¶àµÄÓ³ÉäÒµÎñ£¬ÇëÎñ±ØÈ·ÈÏÒµÎñʹÓõĶ˿ÚÊÇ·ñÓÐÔڴ˲»ÈÝÐÐÁУ¬Ô¤·ÀÓ°ÏìÕý³£ÒµÎñʹÓ㬾ßÌ巽ʽÈçÏÂ:
Ruijie#configure terminal
Ruijie(config)#ip access-list 2999£¨Acl num<1-3000>£¬°ÑÎȲ»Òª¸úÆäËûACLì¶ÜÁË£©
Ruijie(config-ext-nacl)#10 deny tcp any any eq 135
Ruijie(config-ext-nacl)#20 deny tcp any any eq 137
Ruijie(config-ext-nacl)#30 deny tcp any any eq 139
Ruijie(config-ext-nacl)#40 deny tcp any any eq 445
Ruijie(config-ext-nacl)#50 deny tcp any any eq 3389
Ruijie(config-ext-nacl)#60 deny udp any any eq 135
Ruijie(config-ext-nacl)#70 deny udp any any eq 137
Ruijie(config-ext-nacl)#80 deny udp any any eq 139
Ruijie(config-ext-nacl)#90 deny udp any any eq 445
Ruijie(config-ext-nacl)#120 permit ip any any (·çÏյ㣺×îºó±ØÐëÅäÖÃÔÊÐíËùÓУ¬²»È»»áµ¼Ö¶ÏÍø)
Ruijie(config-ext-nacl)#exit
Ruijie(config)#ip session filter 2999 (°ÑÎÈ°¤´Î£¬±ØÐëÏÈÅäÖÃACL 2999ÔÙÅäÖÃip session filter)
• ·ÓɲúÆ·
ÍøÂçÌìǵ³ö¿Ú²¿ÊðGA»Æ½ð¼×RSR·ÓÉÆ÷²úÆ·£¬ÖØҪѡȡ²»ÈÝ135¡¢137¡¢139¡¢445¡¢3389·þÎñ¶Ë¿ÚÒÔ·À±¸·çÏÕ¡£°ÑÎÈÈ·ÈÏÊÇ·ñÓÐÆäËûÕý³£ÒµÎñÉæ¼°¸Ã¶Ë¿Ú£¬Ô¤·ÀÓ°ÏìÕý³£ÒµÎñʹÓá£
RSR1002e/RSR2004e/RSR2014EF/RSR3044/RSR30-X/RSR50E40/RSR77 /RSR77XϵÁвúÆ·ÍƼöʹÓÃsession filter·½Ê½£¬ÅäÖ÷½Ê½ÈçÏ£º
È«¾Ö´´½¨ACE±íÏ²¢ÔÚÈ«¾ÖģʽŲÓøÃACLʹÆäÉúЧ¡£
Ruijie#configure terminal
Ruijie(config)#ip access-list extend deny_onion
Ruijie(config-ext-nacl)#10 deny tcp any any eq 135
Ruijie(config-ext-nacl)#20 deny tcp any any eq 137
Ruijie(config-ext-nacl)#30 deny tcp any any eq 139
Ruijie(config-ext-nacl)#40 deny tcp any any eq 445
Ruijie(config-ext-nacl)#50 deny tcp any any eq 3389
Ruijie(config-ext-nacl)#60 deny udp any any eq 135
Ruijie(config-ext-nacl)#70 deny udp any any eq 137
Ruijie(config-ext-nacl)#80 deny udp any any eq 139
Ruijie(config-ext-nacl)#90 deny udp any any eq 445
Ruijie(config-ext-nacl)#120 permit ip any any (·çÏյ㣺×îºó±ØÐëÅäÖÃÔÊÐíËùÓУ¬²»È»»áµ¼Ö¶ÏÍø)
Ruijie(config-ext-nacl)#exit
Ruijie(config)#ip fpm session filter deny_onion
Õë¶ÔRSR20,RSR50,RSR50eϵÁв»Ö§³Ösession filterÖ°ÄܵÄ·ÓÉÆ÷É豸£¬ÍƼöʹÓÃACLÅäÖã¬ÅäÖ÷½Ê½ÈçÏÂ:
Ruijie#configure terminal
Ruijie(config)#ip access-list extend deny_onion
Ruijie(config-ext-nacl)#10 deny tcp any any eq 135
Ruijie(config-ext-nacl)#20 deny tcp any any eq 137
Ruijie(config-ext-nacl)#30 deny tcp any any eq 139
Ruijie(config-ext-nacl)#40 deny tcp any any eq 445
Ruijie(config-ext-nacl)#50 deny tcp any any eq 3389
Ruijie(config-ext-nacl)#60 deny udp any any eq 135
Ruijie(config-ext-nacl)#70 deny udp any any eq 137
Ruijie(config-ext-nacl)#80 deny udp any any eq 139
Ruijie(config-ext-nacl)#90 deny udp any any eq 445
Ruijie(config-ext-nacl)#120 permit ip any any (·çÏյ㣺×îºó±ØÐëÅäÖÃÔÊÐíËùÓУ¬²»È»»áµ¼Ö¶ÏÍø)
Ruijie(config-ext-nacl)#exit
Ruijie(config)#interface gigabitEthernet 0/1 //ƾ¾Ý·ÖÆç¶Ë¿Ú½øÐе÷Õû
Ruijie(config-if-gigabitEthernet)#ip access-group deny_onion in
ÈôÊÇ֮ǰÒѾÓÐÅäÖÃÕâÁ½ÖÖÖ°ÄÜ£¬Ö»±ØÒª°ÑÕâ´Î¹ýÂ˶˿ڵÄACE²ÎÓë֮ǰµÄACL¼´¿É¡£
• °²È«²úÆ·
ÍøÂçÌìǵ°²È«ÇøÓò²¿ÊðGA»Æ½ð¼×GA»Æ½ð¼×·À»ðǽ²úÆ·£¬Äܹ»Í¨¹ý×è¶Ï·ì϶¶Ë¿Ú»òÉý¼¶¹æ¶¨¿âµÄ·½Ê½´¦Öãº
1£©°²È«²úÆ·Ê×ÏÈÑ¡È¡²»ÈÝTCP135¡¢TCP/UDP137¡¢TCP139¡¢TCP445¡¢TCP3389·þÎñ¶Ë¿Ú¡£È粿Êð³ö¿ÚµÄ·À»ðǽÉ豸¾³£»á²¿ÊðºÃ¶àµÄÓ³ÉäÒµÎñ£¬ÇëÎñ±ØÈ·ÈÏÒµÎñʹÓõĶ˿ÚÊÇ·ñÓÐÔڴ˲»ÈÝÐÐÁУ¬Ô¤·ÀÓ°ÏìÕý³£ÒµÎñʹÓá£
ÒÔÈ«ÐÂÏÂÒ»´ú·À»ðǽΪÀý£¬ÅäÖò½ÖèÈçÏ£º
2£©UTMÌصã¿âÊÚȨÔÚÓÐЧÆÚÄÚµÄÓû§£¬¿É¿ªÆôÈëÇÖ·ÀÓù»ò·À²¡¶¾Ö°ÄܽøÐÐÉî¶È·ÀÓù£º
• RG-WALL 1600ϵÁÐÈ«ÐÂÏÂÒ»´ú·À»ðǽ²úÆ·£¨ÐͺţºRG-WALL 1600-S3100/S3200/S3600/S3700/M5100/M6600/X8500/9300/X9850£©,½«ÈëÇÖ·ÀÓùÌصã¿â¸üе½14.00570°æ±¾£¬ ²¡¶¾Ìصã¿â¸üе½ 66.00963 °æ±¾Ö®ºó£¬Í¬Ê±¿ªÆôÈëÇÖ·ÀÓùºÍ²¡¶¾·À»¤Ö°Äܼ´¿ÉÓÐЧÀ¹½ØÀÕË÷²¡¶¾£¨ÈëÇÖ·ÀÓùºÍ²¡¶¾·À»¤Ö°ÄܵľßÌåÅäÖò½Ö裬¿É²Î¿¼²úÆ·µÄÖ´ÐÐÒ»±¾Í¨£©£»
• RG-WALL 1600-EϵÁÐÈ«ÐÂÄ£¿é»¯·À»ðǽ²úÆ·£¨ÐͺţºRG-WALL 1600-E200/E300/E400/E600/E800£©£¬½«ÈëÇÖ·ÀÓùÌصã¿â£¨ipsÌصã¿â£©¹æ¶¨¿â/¼±¾ç¼ì²â²¡¶¾¿â°æ±¾¸üе½ 2019-03-11 °æ±¾¼°Ö®ºó£¬Í¬Ê±¿ªÆôÈëÇÖ·ÀÓù¡¢²¡¶¾·À»¤Ö°Äܼ´¿ÉÓÐЧÀ¹½ØÀÕË÷²¡¶¾£¨ÈëÇÖ·ÀÓùÖ°ÄܵľßÌåÅäÖò½Ö裬¿É²Î¿¼²úÆ·µÄÖ´ÐÐÒ»±¾Í¨£©£»
• »¥»»²úÆ·
Èô¿Í»§³ö¿ÚÌìǵÉ豸ÎÞ·¨ÅäÖøôÀ룬¿É˼¿¼ÔÚ»¥»»²úÆ·Óë±íÍø³ö¿Ú»¥Áª¶Ë¿Ú¼°ÆäËü´æÔÚϰȾ²¡¶¾·çÏÕµÄÈë¶Ë¿ÚÉϲ¿ÊðACL¡£µ«Çë°ÑÎÈÈ·ÈÏÊÇ·ñÓÐÆäËûÕý³£ÀûÓÃÉæ¼°¸Ã¶Ë¿Ú£¬Ô¤·ÀÓ°ÏìÕý³£ÒµÎñʹÓ㬷½Ê½ÈçÏ£º
´´½¨ACE±íÏî
Ruijie#configure terminal
Ruijie(config)#ip access-list extend deny_onion
Ruijie(config-ext-nacl)#10 deny tcp any any eq 135
Ruijie(config-ext-nacl)#20 deny tcp any any eq 137
Ruijie(config-ext-nacl)#30 deny tcp any any eq 139
Ruijie(config-ext-nacl)#40 deny tcp any any eq 445
Ruijie(config-ext-nacl)#50 deny tcp any any eq 3389
Ruijie(config-ext-nacl)#60 deny udp any any eq 135
Ruijie(config-ext-nacl)#70 deny udp any any eq 137
Ruijie(config-ext-nacl)#80 deny udp any any eq 139
Ruijie(config-ext-nacl)#90 deny udp any any eq 445
Ruijie(config-ext-nacl)#150 permit ip any any (·çÏյ㣺×îºó±ØÐëÅäÖÃÔÊÐíËùÓУ¬²»È»»áµ¼Ö¶ÏÍø)
Ruijie(config-ext-nacl)#exit
ÍƼöÑ¡ÔñÔÚÎïÀí½Ó¿ÚÉÏÀûÓøÃACL£¬ÎÞÐèÔÚSVI½Ó¿ÚÉÏÅäÖá£ÀýÈ磺
Ruijie(config)#interface gigabitEthernet 0/1 //ƾ¾Ý·ÖÆç¶Ë¿Ú½øÐе÷Õû
Ruijie(config-if-gigabitEthernet)#ip access-group deny_onion in
• ÎÞÏß²úÆ·
ÈôÊÇÍøÂçÖв¿ÊðGA»Æ½ð¼×ÎÞÏßÉ豸£¬ÖØҪѡȡ²»ÈÝ135¡¢137¡¢139¡¢445¡¢3389·þÎñ¶Ë¿ÚÒÔ·À±¸·çÏÕ£¬°ÑÎÈÈ·ÈÏÊÇ·ñÓÐÆäËûÕý³£ÒµÎñÉæ¼°¸Ã¶Ë¿Ú£¬Ô¤·ÀÓ°ÏìÕý³£ÒµÎñʹÓá£
1£©ÈôÊÇACÔÚ¾ÖÓòÍø»·¾³£¬½¨ÒéÔÚ³ö¿ÚÉ豸×öÏàÓ¦·À»¤Õ½Êõ£¬ÎÞÐèµ÷ÕûACÅäÖá£
2£©ÈôÊÇAC×÷Ϊ»¥ÁªÍø³ö¿Ú£¬ÔòÐèÔÚACÉϲ¿ÊðACL·À»¤Õ½Êõ£¬¾ßÌåÅäÖò½ÖèÈçÏÂ:
°ÑÎÈ£ºÅäÖÃÇ°ÇëÏÈÈ·ÈÏÊÇ·ñÓÐÆäËûÕý³£ÀûÓÃÐèʹÓÃÒÔ϶˿ڣ¬Ô¤·ÀÓ°ÏìÕý³£ÒµÎñʹÓá£
Ruijie#configure terminal
Ruijie(config)#ip access-list extend deny_onion
Ruijie(config-ext-nacl)#10 deny tcp any any eq 135
Ruijie(config-ext-nacl)#20 deny tcp any any eq 137
Ruijie(config-ext-nacl)#30 deny tcp any any eq 139
Ruijie(config-ext-nacl)#40 deny tcp any any eq 445
Ruijie(config-ext-nacl)#50 deny tcp any any eq 3389
Ruijie(config-ext-nacl)#60 deny udp any any eq 135
Ruijie(config-ext-nacl)#70 deny udp any any eq 137
Ruijie(config-ext-nacl)#80 deny udp any any eq 139
Ruijie(config-ext-nacl)#90 deny udp any any eq 445
Ruijie(config-ext-nacl)#120 permit ip any any (·çÏյ㣺×îºó±ØÐëÅäÖÃÔÊÐíËùÓУ¬²»È»»áµ¼Ö¶ÏÍø)
Ruijie(config-ext-nacl)#exit
²¿Ê𳡾°£º
1£©ÈôÊÇÄÚÍøÎÞÏßÖÕ¶ËÒѾ³öÏÖÎÊÌ⣬ÔÚÎÞÏßµÄwlansecÏÂŲÓöÔÓ¦µÄÎÞÏßACL£¬·À»¤ÄÚÍø
Ruijie(config)#wlansec 1 £¨°ÑÎÈ£ºÃ¿¸öÓû§µÄwlansec϶¼±ØҪŲÓã©
Ruijie(config-wlansec)#ip access-group deny_onion in (°ÑÎÈ°¤´Î£¬±ØÐëÅäÖúÃACL deny_onionÔÙÅäÖÃip access-group deny_onion in)
Ruijie(config-wlansec)#exit
Ruijie(config)#exit
Ruijie#write
2£©ÈôÊǵ±Ç°ÄÚÍøÎÞÏßʹÓÃÕý³££¬Ö»±ØÒª·À»¤±íÍøµÄ¹¥»÷±¨ÎÄ£¬¿ÉÔÚACÉÏÁªÎïÀí½Ó¿ÚŲÓÃ
Ruijie(config)# interface gigabitEthernet 0/1 £¨±ØÒªÔÚACÉÏÁªµÄÎïÀí½Ó¿ÚŲÓã©
Ruijie (config-if-GigabitEthernet 0/1)#ip access-group deny_onion in (°ÑÎÈ°¤´Î£¬±ØÐëÅäÖúÃACL deny_onionÔÙÅäÖÃip access-group deny_onion in)
Ruijie (config-if-GigabitEthernet 0/1)# exit
Ruijie(config)#exit
Ruijie#write
ÈçÐè½øÒ»²½Õ÷ѯ»ò¼¼ÊõÖ§³Ö£¬Äܹ»ÁªÏµÍ³Ò»¿Í·þµç»°£º4008111000¡£
ÎĵµÆÀ¼Û
