Хроники хардеринга системы: поиск конфигурации, устойчивой к целевой атаке

# Список правил nftables, конфигурация 2
# Получено: 13.04.2026

table inet filter {
	chain input {
		type filter hook input priority filter; policy accept;
		udp sport 53 queue flags bypass to 0
		iif "lo" accept
		ct state established,related accept
		ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
		ip saddr 0.0.0.0/0 ct state new drop
		ip protocol icmp icmp type echo-request limit rate 1/second burst 5 packets accept
		ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
		ip protocol icmp icmp type echo-request drop
		ip daddr 239.255.255.250 udp dport 1900 drop
		ip daddr 224.0.0.251 udp dport 5353 drop
		udp dport 137 drop
		udp dport 138 drop
		udp dport 5355 drop
		ip saddr { 45.9.20.0/24, 89.248.160.0/19, 185.107.56.0/24, 185.129.62.0/23, 185.220.100.0/22, 198.96.155.0/24 } log prefix "🔥 BAN: known bots " flags all
		ip saddr { 45.9.20.0/24, 89.248.160.0/19, 185.107.56.0/24, 185.129.62.0/23, 185.220.100.0/22, 198.96.155.0/24 } drop
		tcp flags ! fin,syn,rst,psh,ack,urg drop
		tcp flags & (fin | psh | urg) == fin | psh | urg drop
		tcp flags & (fin | syn) == fin | syn drop
		tcp flags & (fin | syn | rst) == fin | syn | rst drop
		tcp flags & (fin | syn | rst | psh | ack) == fin | syn | rst | ack drop
		ip frag-off & 0x1fff != 0x0 drop
		ip saddr 127.0.0.0/8 drop
		ip saddr 10.0.0.0/8 drop
		ip saddr 172.16.0.0/12 drop
		ip saddr 192.168.0.0/16 drop
		ip saddr 169.254.0.0/16 drop
		ip saddr 0.0.0.0/8 drop
		ip saddr 224.0.0.0/4 drop
		ip saddr 240.0.0.0/5 drop
	}

	chain forward {
		type filter hook forward priority filter; policy accept;
		tcp dport { 53, 80, 443, 873, 12043, 13000-13050 } accept
		udp dport { 53, 443, 3478-3481 } accept
		tcp dport { 21, 22, 23, 137, 138, 139, 445, 1080, 1234, 1337, 1433, 1434, 1900, 3128, 3306, 3389, 4444, 5555, 5900, 8000, 8080, 8888, 9001, 9200, 10000 } drop
		udp dport { 161, 162 } drop
		tcp dport { 1024-65535 } drop
		udp dport { 1024-65535 } drop
		ip saddr { 37.0.0.0/8, 77.0.0.0/8, 88.0.0.0/8, 91.0.0.0/8, 185.0.0.0/8 } drop
	}

	chain output {
		type filter hook output priority filter; policy accept;
		ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
		ip saddr 0.0.0.0/0 ct state new drop
		ip protocol icmp icmp type echo-request limit rate 1/second burst 5 packets accept
		ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
		ip protocol icmp icmp type echo-request drop
		ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
		ip6 nexthdr ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
		ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
		ip6 nexthdr ipv6-icmp icmpv6 type { nd-router-solicit, nd-router-advert } accept
		ip protocol icmp drop
		ip6 nexthdr ipv6-icmp drop
		meta l4proto sctp drop
		meta l4proto dccp drop
		tcp dport { 53, 80, 443, 873, 3000, 3306, 3478, 3690, 4443, 12043, 13000-13050 } accept
		udp dport { 443, 13000-13050 } accept
		tcp dport { 21, 22, 23, 137, 138, 139, 445, 1080, 1234, 1337, 1433, 1434, 1900, 3128, 3306, 3389, 4444, 5555, 5900, 8000, 8080, 8888, 9001, 9200, 10000 } drop
		udp dport { 161, 162 } drop
		tcp dport { 1-5999, 7000-7999, 9000-32767 } drop
		udp dport { 1024-4095, 8192-32767 } drop
		ip saddr { 37.0.0.0/8, 77.0.0.0/8, 88.0.0.0/8, 91.0.0.0/8, 185.0.0.0/8 } drop
	}
}
table inet nat {
	chain filter-prerouting {
		type filter hook prerouting priority filter; policy accept;
	}

	chain prerouting {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
	}

	chain input {
		type nat hook input priority srcnat; policy accept;
	}

	chain output {
		type nat hook output priority 100; policy accept;
	}
}
table inet mangle {
	chain output {
		type filter hook output priority mangle; policy accept;
		icmp type { echo-reply, destination-unreachable, echo-request } accept
		udp dport 51820 accept
		meta l4proto != tcp ct state related,new queue flags bypass to 0
		tcp flags & (fin | syn | rst | ack) == syn queue flags bypass to 0
	}

	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
	}

	chain forward {
		type filter hook forward priority mangle; policy accept;
	}
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
	chain DOCKER {
		iifname "docker0" counter packets 0 bytes 0 return
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
	}

	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
	}
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
	chain DOCKER {
	}

	chain DOCKER-ISOLATION-STAGE-1 {
		iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
		counter packets 0 bytes 0 return
	}

	chain DOCKER-ISOLATION-STAGE-2 {
		oifname "docker0" counter packets 0 bytes 0 drop
		counter packets 0 bytes 0 return
	}

	chain FORWARD {
		type filter hook forward priority filter; policy drop;
		counter packets 0 bytes 0 jump DOCKER-USER
		counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1
		oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
		oifname "docker0" counter packets 0 bytes 0 jump DOCKER
		iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
		iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
	}

	chain DOCKER-USER {
		counter packets 0 bytes 0 return
	}
}

# ============================================
# SYSTEM HARDENING CONFIG (Debian 13 / MATE)
# Version: 6.0 (final)
# Date: 2026-03-03 16:31
# ============================================
# Apply: sudo sysctl --system
# ============================================

# ========== CORE NETWORK ==========

net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.ip_forward = 0
net.ipv4.tcp_rfc1337 = 1
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv4.tcp_synack_retries = 2

# ========== NETWORK HARDENING ==========

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.*.rp_filter = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# ========== KERNEL HARDENING ==========

kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.randomize_va_space = 2
kernel.yama.ptrace_scope = 1
dev.tty.ldisc_autoload = 0
fs.protected_fifos = 2
kernel.sysrq = 0
net.core.bpf_jit_harden = 2
kernel.unprivileged_bpf_disabled = 1

# ========== END OF CONFIG ==========

# ============================================
# ПОЛЬЗОВАТЕЛЬСКИЕ ПРАВИЛА OpenSnitch
# Дата создания: 2026-04-03 — 2026-04-08
# ============================================

# ========== БРАУЗЕРЫ (разрешены) ==========


# LibreWolf
{
  "name": "allow-librewolf",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/app/lib/librewolf/librewolf"
  }
}

# Firefox ESR
{
  "name": "allow-firefox-esr",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/lib/firefox-esr/firefox-esr"
  }
}

# ========== ПРИЛОЖЕНИЯ (разрешены) ==========

# Python интерпретатор (для скриптов)
{
  "name": "allow-python3.13",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/bin/python3.13"
  }
}

# Git (доступ к GitHub)
{
  "name": "allow-git-remote-http",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/lib/git-core/git-remote-http"
  }
}

# Systemd NTP-клиент (синхронизация времени)
{
  "name": "allow-systemd-timesyncd",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/lib/systemd/systemd-timesyncd"
  }
}

# APT (обновление пакетов)
{
  "name": "allow-apt-http-method",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/lib/apt/methods/http"
  }
}

# NetworkManager (основной сетевой менеджер)
{
  "name": "allow-networkmanager",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/sbin/NetworkManager"
  }
}

# Kernel connection (VPN сервисы)
{
  "name": "allow-kernel-connection",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "Kernel connection"
  }
}

# Client for updating firmware (fwupdmgr)
{
  "name": "allow-fwupdmgr",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/bin/fwupdmgr"
  }
}

# ========== ЗАБЛОКИРОВАННЫЕ ПРИЛОЖЕНИЯ ==========

# Ruby интерпретатор (подозрительная активность)
{
  "name": "deny-ruby3.3",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/bin/ruby3.3"
  }
}

# DNS утилита dig (риск)
{
  "name": "deny-dig",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/bin/dig"
  }
}

# GNOME Software (не нужна)
{
  "name": "deny-gnome-software",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/bin/gnome-software"
  }
}

# Демон сканеров (не нужен)
{
  "name": "deny-colord-sane",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/libexec/colord-sane"
  }
}

# Служба принтеров (не нужна)
{
  "name": "deny-gsd-print-notifications",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/libexec/gsd-print-notifications"
  }
}

# LibreOffice (доступ в интернет запрещён)
{
  "name": "deny-libreoffice-soffice",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/lib/libreoffice/program/soffice.bin"
  }
}

# WebKitNetworkProcess (движок рендеринга GNOME)
{
  "name": "deny-webkit-network-process",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/lib/x86_64-linux-gnu/webkitgtk-6.0/WebKitNetworkProcess"
  }
}

# Почтовый сервер (не нужен)
{
  "name": "deny-exim4",
  "action": "deny",
  "duration": "always",
  "operator": {
    "operand": "process.path",
    "data": "/usr/sbin/exim4"
  }
}