쪽팔리면 질문하지 맙시다. 소중한 답변 댓글을 삭제하는건 부끄러운 일 입니다 

참.. 쪽팔리는 일입니다만, 그래도 공유하고 방법을 들어보고자 합니다.

개인 데이터를 독일에 보관하고 있습니다. 하드 많은 서버에 proxmox를 올렸는데, 보안에 너무 안일했습니다.

사용하는 포트 외에는 모두 닫고, GUI에 TOTP를 걸어두었는데,

미래의 내가 하겠지라는 마인드로 ssh-key 사용도 하지 않고 있었고, 심지어 fail2ban조차 설정하지 않았습니다.

아래 메일이 온 뒤, 메일에 언급된 111포트를 닫고, syslog를 보니 gui가 버벅일정도로 엄청나게 쏟아지더군요..

fail2ban 바로 설치/설정 완료하고나니 일단은 syslog에서 보이는 건 cronjob 제외하고는 조용해졌습니다.

ssh-key 설정하는 도중에, ssh-key로도 bruteforce가 보여서 아득해지네요.

혹시나 제언을 해주실 부분이 있을지 문의 드립니다.

미리 감사드립니다.

-----------

현재 proxmox서버의 상황을 공유 드립니다.
- 호스팅 회사에서 제공하는 firewall을 이용해서 사용중이지 않은 포트들은 모두 닫아둔 상태
  - Rules Incoming
    - ipv4 icmp accept
    - ipv4 tcp dst:8006,5900 accept
    - ipv4 tcp dst:32768-65535 ack accept
    - ipv4 udp src:53,123 accept
    - ipv4 udp src:41641 accept
    - ipv4 tcp dst:2222 accept
 - Rules outgoing
    - ipv4 tcp dst:25,465 discard
    - ipv4 tcp,udp dst:111 discard
    - ipv4 tcp allow all accept
- 공인ip 1개, ssh를 통한 root 접속 차단, GUI에서 TOTP사용 중이며
- vm 1개에 truenas를 이용하는 중.
  - truenas에서 tailscale 사용 중
- vm의 네트워크는 host의 interfaces 파일에서 iptable을 통하여 nat 적용.
  - truenas에서 sftp를 통해 rclone으로 2차 백업지로 향함. 

+ 아무래도 유동ip환경에서 접속하다보니, source IP로 접속제한하는데는 위험부담이 있어보여 하지 않고 있습니다.

-----------

아래 이메일이 약 3시간 전에 왔었습니다.

-----------

다음 이메일 본문은 호스팅 회사에서 보내온 메일
------------

We have received a notification from the German Federal Office for Information Security (BSI) for (the IP address of) a server you have with us. We are automatically forwarding this notification on to you, for your information.

The original report has been included below. Additional information is provided with the how-to guides referenced in the report. Please note that we do not have any further information to share.

These notifications do not mean your server was involved in any abusive activity. They are simply alerting you to a potential issue on your server, that could be exploited, and that is usually fairly easy to secure.

You do not need to send us, or the BSI, a response.

In case of further questions, please contact ********@***.bund.de and keep the ticket number of the original report [CB-Report#...] in the subject line. Do not reply to <*******@*******.cert-bund.de> as this is just the sender address for the reports and messages sent to this address will not be read.

Kind regards

Abuse Team

-----------

아래는 이메일에 붙어온 BSI의 메일
------------

> Dear Sir or Madam,

> the Portmapper service (portmap, rpcbind) is required for mapping RPC
> requests to a network service. The Portmapper service is needed e.g.
> for mounting network shares using the Network File System (NFS).
> The Portmapper service runs on port 111 tcp/udp.

> In addition to being abused for DDoS reflection attacks, the
> Portmapper service can be used by attackers to obtain information
> on the target network like available RPC services or network shares.

> Over the past months, systems responding to Portmapper requests from
> anywhere on the Internet have been increasingly abused DDoS reflection
> attacks against third parties.

> Please find below a list of affected systems hosted on your network.
> The timestamp (timezone UTC) indicates when the openly accessible
> Portmapper service was identified.

> We would like to ask you to check this issue and take appropriate
> steps to secure the Portmapper services on the affected systems or
> notify your customers accordingly.

> If you have recently solved the issue but received this notification
> again, please note the timestamp included below. You should not
> receive any further notifications with timestamps after the issue
> has been solved.

> Additional information on this notification, advice on how to fix
> reported issues and answers to frequently asked questions:

> <https://reports.cert-bund.de/en/>

> This message is digitally signed using PGP.
> Information on the signature key is available at:
> <https://reports.cert-bund.de/en/digital-signature>>

> Please note:
> This is an automatically generated message. Replies to the
> sender address <*******@*******.cert-bund.de> will NOT be read
> but silently be discarded. In case of questions, please contact
> <********@***.bund.de> and keep the ticket number [CB-Report#...]
> of this message in the subject line.
> Affected systems on your network:
> Format: ASN | IP | Timestamp (UTC) | RPC response
>  24940 | [서버 공인 ip라서 삭제합니다 ] | 2024-02-27 03:01:18 | 100000 4 111/udp; 100000 3 111/udp; 100000 2 111/udp; 100000 4 111/udp; 100000 3 111/udp; 100000 2 111/udp;
> Mit freundlichen Grüßen / Kind regards
> Team CERT-Bund
> Bundesamt für Sicherheit in der Informationstechnik
> Federal Office for Information Security (BSI)
> Referat OC22 - CERT-Bund
> Godesberger Allee 87, 53175 Bonn, Germany

>