Netatmo Webhook Hackversuche

Kamik · 05 Oktober 2018, 13:29:46

Hallo zusammen,

mir ist nun schon wiederholt aufgefallen, dass jemand versucht hat, meinen freigegebenen Webhookport zu hacken.
Ist es möglich die Anzahl der Anmeldeversuche einzustellen? Damit bspw. ddos attacken unterdrückt werden?

Ich gehe davon aus, das dadurch dass ich kein https verwende, meine url abgefangen wurde. Ich glaube auch, dass das mit https bei netatmo nicht funktioniert hat.

Jemand eine Idee wie ich mich besser schützen kann?

Hier mal einige Lists und Der Hackversuch aus dem Log:

Code Auswählen

Internals:
   DEF        WEBHOOK
   IODev      Wetter_Netatmo
   NAME       netatmo_webhook
   NOTIFYDEV  global
   NR         614
   NTFY_ORDER 50-netatmo_webhook
   STATE      Tier erfasst
   SUBTYPE    WEBHOOK
   TYPE       netatmo
   model      WEBHOOK
   status     ok
   READINGS:
     2018-10-05 12:45:39   camera_id       xx:xx:xx.xx...
     2018-10-05 12:45:39   event_type      animal
     2018-10-05 12:45:39   snapshot        https://api.netatmo.com/api/getcamerapicture?image_id=XXX&key=XXX
     2018-10-05 12:45:39   state           Tier erfasst
     2018-10-01 14:45:27   webhook         added
   helper:
     last_status_store 0
Attributes:
   IODev      Wetter_Netatmo
   room       Extern,netatmo
   webhookURL http://XXX(ausgeschriebene Kennung):XXX@XXX.myfritz.net:8088/netatmo/netatmo

Code Auswählen

Internals:
   NAME       allowedWEBhook
   NR         613
   STATE      validFor:WEBhook
   TYPE       allowed
   allowedCommands 1
   validFor   WEBhook
   READINGS:
     2018-10-01 14:45:10   state           validFor:WEBhook
Attributes:
   allowedCommands 1
   basicAuth  SHA256:XXX+XXX
   password   SHA256:XXX+XXX
   room       Extern
   validFor   WEBhook

Code Auswählen

2018.10.05 08:06:25 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56125
2018.10.05 08:06:25 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56249
2018.10.05 08:06:25 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56392
2018.10.05 08:06:25 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56477
2018.10.05 08:06:25 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56612
2018.10.05 08:06:25 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56729
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56810
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56934
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for Admin via WEBhook_35.242.146.120_56995
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for Admin via WEBhook_35.242.146.120_57067
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57339
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57387
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57505
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57542
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57630
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57764
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57874
2018.10.05 08:06:26 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_57970
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58082
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58161
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58323
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58330
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58430
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58473
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58532
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58565
2018.10.05 08:06:27 3: Login denied by allowedWEBhook for airlive via WEBhook_35.242.146.120_58913
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for airlive via WEBhook_35.242.146.120_59311
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59408
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59458
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for support via WEBhook_35.242.146.120_59895
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for support via WEBhook_35.242.146.120_59946
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for support via WEBhook_35.242.146.120_60038
2018.10.05 08:06:28 3: Login denied by allowedWEBhook for support via WEBhook_35.242.146.120_60148
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_60466
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_60564
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_60698
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_60776
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_60850
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_60900
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for adsl via WEBhook_35.242.146.120_60944
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for adsl via WEBhook_35.242.146.120_60987
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for osteam via WEBhook_35.242.146.120_61064
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for osteam via WEBhook_35.242.146.120_61108
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_61222
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_61282
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for ZXDSL via WEBhook_35.242.146.120_61397
2018.10.05 08:06:29 3: Login denied by allowedWEBhook for ZXDSL via WEBhook_35.242.146.120_61507
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61632
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61765
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_61885
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for super via WEBhook_35.242.146.120_61912
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61997
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62218
2018.10.05 08:06:30 3: Login denied by allowedWEBhook for mts via WEBhook_35.242.146.120_62272
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for mts via WEBhook_35.242.146.120_62397
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for telecomadmin via WEBhook_35.242.146.120_63264
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for telecomadmin via WEBhook_35.242.146.120_63336
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for mgts via WEBhook_35.242.146.120_63382
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for mgts via WEBhook_35.242.146.120_63425
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63523
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63622
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63679
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63803
2018.10.05 08:06:31 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63931
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64035
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for kyivstar via WEBhook_35.242.146.120_64345
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for kyivstar via WEBhook_35.242.146.120_64392
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64468
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64704
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for telekom via WEBhook_35.242.146.120_64830
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for telekom via WEBhook_35.242.146.120_64867
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for superadmin via WEBhook_35.242.146.120_64936
2018.10.05 08:06:32 3: Login denied by allowedWEBhook for superadmin via WEBhook_35.242.146.120_65091
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for superadmin via WEBhook_35.242.146.120_65206
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for superadmin via WEBhook_35.242.146.120_65251
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_65411
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_65521
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49235
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49276
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49398
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49442
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49480
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49565
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49609
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49692
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for engineer via WEBhook_35.242.146.120_49789
2018.10.05 08:06:33 3: Login denied by allowedWEBhook for engineer via WEBhook_35.242.146.120_49904
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50017
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50108
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for superadmin via WEBhook_35.242.146.120_50242
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for superadmin via WEBhook_35.242.146.120_50331
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50418
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50466
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50540
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50662
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50725
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50779
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50906
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50942
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51014
2018.10.05 08:06:34 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51150
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51225
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51375
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51490
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51600
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51659
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51736
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51824
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51860
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51943
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52006
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52070
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52145
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52241
2018.10.05 08:06:35 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52354
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52460
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52561
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52766
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52820
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52872
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52957
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52993
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53163
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53193
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53299
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53362
2018.10.05 08:06:36 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53413
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53648
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53760
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53868
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53978
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54106
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54167
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54188
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54310
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54355
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54398
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54496
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54588
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54663
2018.10.05 08:06:37 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54805
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54910
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54987
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55318
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55404
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55503
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55609
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55664
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55803
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for fuck3g1 via WEBhook_35.242.146.120_55843
2018.10.05 08:06:38 3: Login denied by allowedWEBhook for fuck3g1 via WEBhook_35.242.146.120_55903
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for fuck3g1 via WEBhook_35.242.146.120_56025
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for fuck3g1 via WEBhook_35.242.146.120_56143
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56266
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56403
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56510
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56568
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56645
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56719
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56771
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56853
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56861
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56964
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57052
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57117
2018.10.05 08:06:39 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57270
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57341
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57455
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57571
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57688
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57740
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57806
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57880
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_57916
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58040
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58139
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58255
2018.10.05 08:06:40 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58316
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58498
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58612
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58750
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58869
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_58974
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59033
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59110
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59184
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59235
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59470
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59546
2018.10.05 08:06:41 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59616
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59731
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59863
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_59949
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60091
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60200
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60250
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60337
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60374
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60500
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60590
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60685
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60749
2018.10.05 08:06:42 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60840
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_60964
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61038
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61152
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61308
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61424
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61508
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61566
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61660
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61711
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61784
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61800
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61898
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_61992
2018.10.05 08:06:43 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62056
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62116
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62281
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62395
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62430
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62624
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62714
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62735
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62823
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62922
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_62983
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63069
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63100
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63221
2018.10.05 08:06:44 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63258
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63389
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63489
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63555
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63698
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63821
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_63948
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64039
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64061
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64182
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64255
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64272
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64350
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64419
2018.10.05 08:06:45 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64530
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64568
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64691
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64792
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64938
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_64987
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_65142
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_65204
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_65294
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for supervisor via WEBhook_35.242.146.120_65332
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for supervisor via WEBhook_35.242.146.120_65456
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_65518
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49191
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49316
2018.10.05 08:06:46 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49354
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49481
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49586
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49868
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_49944
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50078
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50140
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50190
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50285
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50357
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50373
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50493
2018.10.05 08:06:47 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50536
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50629
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50699
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50856
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_50974
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51044
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51094
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51250
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51312
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51401
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51438
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51606
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51662
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51683
2018.10.05 08:06:48 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51837
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51894
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_51978
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52418
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52551
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52612
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52637
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52756
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52829
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52846
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_52944
2018.10.05 08:06:49 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53041
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53103
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53201
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53329
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53521
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53633
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53759
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53826
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53905
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_53982
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54073
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54130
2018.10.05 08:06:50 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54212
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54305
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54393
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54467
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54561
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54686
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54829
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_54942
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55023
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55104
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55177
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55228
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55301
2018.10.05 08:06:51 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_55316
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for Cisco via WEBhook_35.242.146.120_55571
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for Cisco via WEBhook_35.242.146.120_55632
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for cisco via WEBhook_35.242.146.120_56077
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for cisco via WEBhook_35.242.146.120_56167
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56303
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56343
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56502
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56552
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56624
2018.10.05 08:06:52 3: Login denied by allowedWEBhook for admin via WEBhook_35.242.146.120_56748
2018.10.05 08:06:53 3: Login denied by allowedWEBhook for enable via WEBhook_35.242.146.120_57767
2018.10.05 08:06:53 3: Login denied by allowedWEBhook for enable via WEBhook_35.242.146.120_57809
2018.10.05 08:06:53 3: Login denied by allowedWEBhook for pnadmin via WEBhook_35.242.146.120_57866
2018.10.05 08:06:53 3: Login denied by allowedWEBhook for pnadmin via WEBhook_35.242.146.120_57956
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_58064
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_58125
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_58176
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for root via WEBhook_35.242.146.120_58293
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for user via WEBhook_35.242.146.120_58441
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for user via WEBhook_35.242.146.120_58484
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for user via WEBhook_35.242.146.120_58630
2018.10.05 08:06:54 3: Login denied by allowedWEBhook for user via WEBhook_35.242.146.120_58741

CoolTux · 05 Oktober 2018, 13:32:21

Du kannst versuchen fail2ban zu installieren und zu konfiguerieren.

rudolfkoenig · 05 Oktober 2018, 13:40:34

Man kann auch ein notify mit readLog spezifizieren.

Kamik · 05 Oktober 2018, 13:49:50

Also Fail2ban hört sich erstmal nicht schlecht an.
Würde es dann auf meiner raspberry einrichten.

Beim readlog-notify bekomme ich ja nur einen Hinweis, dass es gerade jemand versucht. Schützen kann ich mich damit aber erstmal nicht.

Die IP-Adresse die hinten am Logeintrag steht, ist das die IP Adresse des Absenders?

Danke aber schonmal für die Ansätze.

Kamik · 05 Oktober 2018, 13:54:30

Also wenn ich mich selbst über diesen Port einwähle, dann habe ich zumindest das gute Gefühl, dass ich in fhem keine Befehle absetzen kann. Aber ich denke, dass es einem Hacker ja nur um das Türchen geht über das er rein kommt.

Hier mal die Versuche, die im Log auch aufgezeichnet wurden:

Code Auswählen

2018.10.05 13:31:44 1: Netatmo webhook no data received!
2018.10.05 13:32:09 3: Forbidden command set for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:09 1: stacktrace:
2018.10.05 13:32:09 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:09 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:09 1:     main::Authorized                    called by fhem.pl (1202)
2018.10.05 13:32:09 1:     main::AnalyzeCommand                called by ./FHEM/01_FHEMWEB.pm (2583)
2018.10.05 13:32:09 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:09 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:09 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:09 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:11 3: Forbidden command set for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:11 1: stacktrace:
2018.10.05 13:32:11 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:11 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:11 1:     main::Authorized                    called by fhem.pl (1202)
2018.10.05 13:32:11 1:     main::AnalyzeCommand                called by ./FHEM/01_FHEMWEB.pm (2583)
2018.10.05 13:32:11 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:11 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:11 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:11 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:16 3: Forbidden command set for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:16 1: stacktrace:
2018.10.05 13:32:16 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:16 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:16 1:     main::Authorized                    called by fhem.pl (1202)
2018.10.05 13:32:16 1:     main::AnalyzeCommand                called by ./FHEM/01_FHEMWEB.pm (2583)
2018.10.05 13:32:16 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:16 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:16 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:16 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:18 3: Forbidden command set for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:18 1: stacktrace:
2018.10.05 13:32:18 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:18 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:18 1:     main::Authorized                    called by fhem.pl (1202)
2018.10.05 13:32:18 1:     main::AnalyzeCommand                called by ./FHEM/01_FHEMWEB.pm (2583)
2018.10.05 13:32:18 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:18 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:18 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:18 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:20 3: Forbidden command set for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:20 1: stacktrace:
2018.10.05 13:32:20 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:20 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:20 1:     main::Authorized                    called by fhem.pl (1202)
2018.10.05 13:32:20 1:     main::AnalyzeCommand                called by ./FHEM/01_FHEMWEB.pm (2583)
2018.10.05 13:32:20 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:20 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:20 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:20 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:44 3: Forbidden command perl for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:44 1: stacktrace:
2018.10.05 13:32:44 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:44 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:44 1:     main::Authorized                    called by fhem.pl (1077)
2018.10.05 13:32:44 1:     main::AnalyzePerlCommand            called by fhem.pl (1140)
2018.10.05 13:32:44 1:     main::AnalyzeCommand                called by fhem.pl (1062)
2018.10.05 13:32:44 1:     main::AnalyzeCommandChain           called by ./FHEM/01_FHEMWEB.pm (2585)
2018.10.05 13:32:44 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:44 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:44 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:44 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:48 3: Forbidden command perl for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:48 1: stacktrace:
2018.10.05 13:32:48 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:48 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:48 1:     main::Authorized                    called by fhem.pl (1077)
2018.10.05 13:32:48 1:     main::AnalyzePerlCommand            called by fhem.pl (1140)
2018.10.05 13:32:48 1:     main::AnalyzeCommand                called by fhem.pl (1062)
2018.10.05 13:32:48 1:     main::AnalyzeCommandChain           called by ./FHEM/01_FHEMWEB.pm (2585)
2018.10.05 13:32:48 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:48 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:48 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:48 1:     main::CallFn                        called by fhem.pl (726)
2018.10.05 13:32:50 3: Forbidden command attr for WEBhook_xx.xxx.xx.xx_52166
2018.10.05 13:32:50 1: stacktrace:
2018.10.05 13:32:50 1:     main::allowed_Authorize             called by fhem.pl (3597)
2018.10.05 13:32:50 1:     main::CallFn                        called by fhem.pl (5364)
2018.10.05 13:32:50 1:     main::Authorized                    called by fhem.pl (1202)
2018.10.05 13:32:50 1:     main::AnalyzeCommand                called by ./FHEM/01_FHEMWEB.pm (2583)
2018.10.05 13:32:50 1:     main::FW_fC                         called by ./FHEM/01_FHEMWEB.pm (861)
2018.10.05 13:32:50 1:     main::FW_answerCall                 called by ./FHEM/01_FHEMWEB.pm (533)
2018.10.05 13:32:50 1:     main::FW_Read                       called by fhem.pl (3597)
2018.10.05 13:32:50 1:     main::CallFn                        called by fhem.pl (726)

Christoph Morrison · 05 Oktober 2018, 14:34:14

35.242.146.120 gehört zu einem Adressblock von Google.

Code Auswählen


Comment:        *** The IP addresses under this Org-ID are in use by Google Cloud customers ***
Comment:
Comment:        Direct all copyright and legal complaints to
Comment:        https://support.google.com/legal/go/report
Comment:
Comment:        Direct all spam and abuse complaints to
Comment:        https://support.google.com/code/go/gce_abuse_report
Comment:
Comment:        For fastest response, use the relevant forms above.
Comment:
Comment:        Complaints can also be sent to the GC Abuse desk
Comment:        (google-cloud-compliance@google.com)
Comment:        but may have longer turnaround times.
Ref:            https://rdap.arin.net/registry/ip/35.208.0.0

Ich würde mich auf jeden Fall auch beschweren, damit der User abgeklemmt wird. Falls du die Source-IP deines Webhooks fest definieren kannst, würde ich auch eher in diese Richtung (whitelisten) gehen als Leute zu blacklisten - geht aber mit einem Forward Proxy deutlich komfortabler.

Markus M. · 05 Oktober 2018, 19:48:52

Zitat von: Kamik am 05 Oktober 2018, 13:29:46Ich gehe davon aus, das dadurch dass ich kein https verwende, meine url abgefangen wurde.

Dem ist nicht so. Alleine der nach aussen offene Port reicht schon.
Genaugenommen hast du deine Addresse vielleicht sogar veröffentlicht WEIL du HTTPS auf deiner FritzBox aktiviert hast:
Probier mal https://crt.sh/?q=deinemyfritzid.myfritz.net

ZitatIch glaube auch, dass das mit https bei netatmo nicht funktioniert hat.

Es funktionieren keine selbst ausgestellten Zertifikate. Let's encrypt sollte aber gehen.

ZitatJemand eine Idee wie ich mich besser schützen kann?

Keine Standardkombinationen für den Zugang verwenden

Wenn du die IPs von Netatmo mal mitloggst, sollte auch Whitelisting klappen.

Kamik · 05 Oktober 2018, 20:46:25

Hallo Markus,

ZitatProbier mal https://crt.sh/?q=deinemyfritzid.myfritz.net

Die Ausgabe zeigt lediglich, dass keine Zertifikate gefunden wurden.

ZitatKeine Standardkombinationen für den Zugang verwenden

Habe ich nicht. Also ich habe einen eigenen Benutzer und ein eigenes Kennwort. Oder meintest du etwas anderes?

ZitatWenn du die IPs von Netatmo mal mitloggst, sollte auch Whitelisting klappen.

wie kann ich die am besten mitloggen? Whitelisting hört sich erstmal gut an, aber ich wüsste jetzt nicht wie ich das mit dem Proxy einrichten müsste. Hast du hierfür einen Link für eine Anleitung oder so?

@Christoph:
Ich habe die Source IP bei google gemeldet. Mal sehen was da jetzt noch kommt.

ZitatFalls du die Source-IP deines Webhooks fest definieren kannst, würde ich auch eher in diese Richtung (whitelisten) gehen als Leute zu blacklisten - geht aber mit einem Forward Proxy deutlich komfortabler.

Ich habe auf der Development Seite von Netatmo meine Webhook URL angegeben (xxx:xxx@...myfritz.net) User und Kennung unverschlüsselt in Klartext. Einmal eingetragen steht es aber nirgends mehr, außer in einem fhemattribut. Ich habe keine feste IP. Nutze auch kein dyndns.
Wie oben schon geschrieben wüsste ich nicht wie ich das mit dem Proxy einrichten müsste.

Danke vorab!

Markus M. · 05 Oktober 2018, 21:10:52

Zitat von: Kamik am 05 Oktober 2018, 20:46:25
Ich habe auf der Development Seite von Netatmo meine Webhook URL angegeben (xxx:xxx@...myfritz.net) User und Kennung unverschlüsselt in Klartext. Einmal eingetragen steht es aber nirgends mehr, außer in einem fhemattribut.

Auf der Seite kannst du irgendwas beliebiges eintragen. Die tatsächliche Callback Adresse wird vom Modul aus dem Attribut gesetzt - selbstverständlich über HTTPS.

ZitatIch habe keine feste IP. Nutze auch kein dyndns.
Wie oben schon geschrieben wüsste ich nicht wie ich das mit dem Proxy einrichten müsste.

MyFritz ist DynDNS.
Und nicht deine IP ist wichtig, sondern die IPs von Netatmo bzw. deren Server.

195.154.0.0/16 und 62.210.0.0/16 reichen vielleicht schon, weil:

Code Auswählen

app.netatmo.net has address 195.154.199.173
app.netatmo.net has address 62.210.178.168
app.netatmo.net has address 195.154.191.74
app.netatmo.net has address 62.210.82.117
api.netatmo.com has address 195.154.172.147
api.netatmo.com has address 195.154.179.238

Kamik · 25 Oktober 2018, 21:02:41

So,

ich habe nun eine dritte Variante probiert, bei der ich aber nicht ganz weiterkomme. Ich habe versucht über iptables den Port für den webhook nur für bestimmte IP's zuzulassen.

Ich habe mich hierfür an der Anleitung für Dashbuttons gelehnt. Hier werden die Einträge für iptables in der Datei /etc/iptables/rules.v4 eingetragen. Damit die Regeln nach einem neustart automatisch geladen werden habe ich iptables-persistent installiert.
https://maker-tutorials.com/fhem-geraete-mit-amazon-dash-button-schaltensteuern-raspberry-pi-home-automation/

Ich habe nun folgende rules.v4

Code Auswählen

# Generated by iptables-save v1.4.21 on Mon Sep  3 16:23:16 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Mon Sep  3 16:23:16 2018
# Generated by iptables-save v1.4.21 on Mon Sep  3 16:23:16 2018
*nat
:PREROUTING ACCEPT [36:3919]
:INPUT ACCEPT [37:4208]
:OUTPUT ACCEPT [147:9486]
:POSTROUTING ACCEPT [147:9486]
-A PREROUTING -s 0.0.0.0/32 -i eth0 -p udp -m udp --dport 67 -j DNAT --to-destinat$
COMMIT
# Completed on Mon Sep  3 16:23:16 2018

Ich habe jetzt im Bereich *filter folgende Einträge versucht, die Leider keinen webhook von Seiten Netatmo mehr auslösen:

Code Auswählen

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -p tcp --dport 8088 -s 195.154.0.0/16 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 62.210.0.0/16 -j ACCEPT
-A INPUT -p tcp --dport 8088 -j DROP

Das hier hat auch nicht funktioniert:

Code Auswählen

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp --dport 8088 -s 195.154.199.173 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 195.154.191.74 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 195.154.172.147 -j ACCEPT
-A INPUT -p tcp --dport 8088 .-s 195.154.179.238 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 62.210.178.168 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 62.210.82.117 -j ACCEPT
-A INPUT -p tcp --dport 8088 -j DROP

Ich teste immer mit meinem Laptop (Wlan) und Handy WLAN und 4G für eine externe IP ob ich auf die Webhookadresse zugreifen kann.
Wenn ich folgende Einträge habe komme ich plötzlich auch über 4G drauf, Netatmo funktioniert aber nicht. 4G dürfte aber nicht funktionieren, weil die IP 66.249... lautet:

Code Auswählen

-A INPUT -p tcp --dport 8088 -s 195.154.0.0/16 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 62.210.0.0/16 -j ACCEPT
-A INPUT -p tcp --dport 8088 -s 192.168.178.150 -j ACCEPT  --> Laptop Heimnetz)
-A INPUT -p tcp --dport 8088 -s 192.168.178.45 -j ACCEPT --> (Handy Heimnetz)
-A INPUT -p tcp --dport 8088 -j DROP

Wo liegt der Hund begraben?

CoolTux · 26 Oktober 2018, 07:13:45

Hast Du das nur so oder auch als bash Script mit iptables Befehl?

Kamik · 26 Oktober 2018, 07:31:15

Moin, also so wie ich das verstanden habe wird die Datei durch iptable-persistent beim reboot geladen.
Das scheint auch zu funktionieren. Teilweise habe ich ja alle Pakete ausgesperrt. Sowohl Netatmo als auch ich sind dann nicht mehr auf den Port gekommen. Nach löschen der Zeilen und reboot ist auch alles wieder gut.
Mit iptables --List werden die Einträge auch nicht mehr angezeigt.

Ich kann dir Einträge auch händisch setzen und löschen. Ich denke dass es eher am Eintrag liegt. Tcp als Protokoll sollte aber korrekt sein oder?

Gesendet von meinem SM-G930F mit Tapatalk

CoolTux · 26 Oktober 2018, 08:16:46

Code Auswählen


*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FHEM_INPUT - [0:0]
-A INPUT -i eth0 -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --dport 8088 -j FHEM_INPUT
-A FHEM_INPUT -s 192.168.178.150 -m comment --comment "Allow inbound FHEM Webhook connections from Lapi" -j ACCEPT
-A FHEM_INPUT -s 192.168.178.??? -m comment --comment "Allow inbound FHEM Webhook connections from Netamo" -j ACCEPT
-A FHEM_INPUT -j RETURN

Du solltest bei diesem Beispiel bitte noch Deine IP des Netamo anpassen. Ansonsten bilde ich mir ein das es so eigentlich gehen sollte

Kamik · 28 Oktober 2018, 13:28:47

Hi CoolTux,

auch das funktioniert nicht.
Unabhängig von der Datei rules.v4 habe ich die Eingaben diesmal händisch in die FW eingetragen.

Ich habe eine neue Chain mit iptables -N FHEM_INPUT erstellt. anschließend deine Zeilen jeweils immer mit "sudo iptables" davor:

Code Auswählen


sudo iptables -F --> Zum Flashen der Regeln
sudo iptables -X --> Zum löschen der custom chains
sudo iptables -N FHEM_INPUT --> Neue custom Chain
sudo iptables -A INPUT -i eth0 -p tcp -m conntrack --ctstate NEW,RELATED,ESTABLISHED -m tcp --dport 8088 -j FHEM_INPUT
sudo iptables -A FHEM_INPUT -s 192.168.178.150 -m comment --comment "Allow inbound FHEM Webhook connections from Lapi" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 192.168.178.45 -m comment --comment "Allow inbound FHEM Webhook connections from Galaxy S7" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 195.154.199.173 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_1" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 195.154.191.74 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_2" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 195.154.172.147 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_3" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 195.154.179.238 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_4" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 62.210.178.168 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_5" -j ACCEPT
sudo iptables -A FHEM_INPUT -s 62.210.82.117 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_6" -j ACCEPT
 und mit 
sudo iptables --table filter --list  --> Die Regeln kontrolliert.

Auswirkung war folgende, dass ich auch über eine oben nicht eingetragene IP (Mein Handy im 4G Netz) auf den Port zugreifen konnte.

Dann habe ich nochmal meine Eingaben händisch eingegeben. (siehe nächsten Code) Inkl. dem letzten Drop.
Auswirkung war, dass ich gar nicht mehr auf den Port kann. Die FW also alles geblockt hat. auch die eingetragenen IP's. Ich konnte weder von intern als auch extern auf den Port zugreifen.

Code Auswählen


sudo iptables -F
sudo iptables -X
sudo iptables -A INPUT -p tcp --dport 8088 -s 192.168.178.150 -m comment --comment "Allow inbound FHEM Webhook connections from Lapi" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 192.168.178.45 -m comment --comment "Allow inbound FHEM Webhook connections from Galaxy S7" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 195.154.199.173 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_1" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 195.154.191.74 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_2" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 195.154.172.147 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_3" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 195.154.179.238 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_4" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 62.210.178.168 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_5" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -s 62.210.82.117 -m comment --comment "Allow inbound FHEM Webhook connections from Netatmo_6" -j ACCEPT &&
sudo iptables -A INPUT -p tcp --dport 8088 -j DROP

Ich möchte natürlich die Anfragen auf den Port 8088 verwerfen, die von nicht eingetragenen IP's erfolgen. Sonst habe ich ja die Möglichkeit einen user und ein Kennwort einzutragen und so die Möglichkeit Zugang zu erhalten.

CoolTux · 28 Oktober 2018, 14:46:48

Ist bisschen schwierig, weil ich immer erst alles Blocke und dann frei gebe. Vielleicht wäre das ein besserer Weg. Aber Du musst ziemlich aufpassen das Du Dich nicht komplett aus sperrst.
Also nur den default INPUT sperren.