prevent script kiddies to abuse my ppp connection

prevent script kiddies to abuse my ppp connection

[Ivan Kanis]

Hello,

I have a ppp connection to the internet. My connection is limited to
30 hours per month so I am watching it pretty closely. I have set up
pppd to timeout after 3 minutes of inactivity. This works most of the
time.

Some time it doesn't. Once I left my computer for an hour and I was
surprised to see that the connection was still on! I thought that one
of my proces was using the connection so i did a quick dump of ppp0. I
was surprise to see that some script kiddy was looking at my netbios
port!

Now I have been thinking of ways to prevent these silliness from
shutting down my conneciton within 3mn. If I firewall these incoming
packets I believe that it won't help me. The blocked packet will still
traverse the ppp link. So it will still be seen as "activity" to the
ppp daemon. Correct me if I am mistaken.

Is there a way to setup the the firewall to shutdown ppp if it doesnt
see any valid packets within a given time limit?

Love to hear some suggestions.

Please CC me, I am not subscribed to the mailing list.

Ivan
-- 
/-----------------------------------------------------------------------------*
|     "...Deep Hack Mode--that mysterious and       |        Ivan Kanis       |
|     frightening state of consciousness where      |     ivank@juliva.com    |
|     Mortal Users fear to tread." (Matt Welsh)     |      www.juliva.com     |
*-----------------------------------------------------------------------------/

Re: prevent script kiddies to abuse my ppp connection

[Antony Stone]

On Thursday 10 October 2002 9:29 pm, Ivan Kanis wrote:

> Hello,
>
> I left my computer for an hour and I was
> surprised to see that the connection was still on! I thought that one
> of my proces was using the connection so i did a quick dump of ppp0. I
> was surprise to see that some script kiddy was looking at my netbios
> port!
>
> Now I have been thinking of ways to prevent these silliness from
> shutting down my conneciton within 3mn. If I firewall these incoming
> packets I believe that it won't help me. The blocked packet will still
> traverse the ppp link. So it will still be seen as "activity" to the
> ppp daemon. Correct me if I am mistaken.

I don't know - try it and see.

Set a simple ruleset in netfilter, such as:

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

(assuming netfilter and you applications, are running on the machine with the 
dialup connection).

Then set up an inbound ping from some remote machine and see if your 
connection times out...

If not, maybe you can adjust your ppp daemon to only count outgoing packets 
as contributing to a connection which should be kept alive ?   Then inbound 
packets which get no response won't count...

Antony.

-- 

All matter in the Universe can be placed into one of two categories:

1. things which need to be fixed
2. things which will need to be fixed once you've had a few minutes to play 
with them

RE: prevent script kiddies to abuse my ppp connection

[Rowan Reid]

,
> >
> > I left my computer for an hour and I was
> > surprised to see that the connection was still on! I 
> thought that one 
> > of my proces was using the connection so i did a quick dump 
> of ppp0. I 
> > was surprise to see that some script kiddy was looking at 
> my netbios 
> > port!
> >
> > Now I have been thinking of ways to prevent these silliness from 
> > shutting down my conneciton within 3mn. If I firewall these 
> incoming 
> > packets I believe that it won't help me. The blocked packet 
> will still 
> > traverse the ppp link. So it will still be seen as 
> "activity" to the 
> > ppp daemon. Correct me if I am mistaken.
> 

I'm no expert but the way I would go about this is to log established
outgoing connections, then have a perl script analyze this log if the
last entry is less than x minutes old and there is no existing
connection then kill your ppp deamon. Now those script kiddies are
probable nimda worms which seem to be everywhere. It shouldn’t' be hard
you may even be able to do a cat /var/log/firewall | last | grep IN=eth0
.... Get my drift ..