Tarmoq xavfsizligi

# UFW - Ubuntu uchun sodda firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing

sudo ufw allow 22/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Faqat ma'lum IP dan SSH
sudo ufw delete allow 22/tcp
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp

sudo ufw enable
sudo ufw status verbose

# nftables - zamonaviy Linux firewall
sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'

# O'rnatilgan ulanishlarga ruxsat
sudo nft add rule inet filter input ct state established,related accept

# Loopback
sudo nft add rule inet filter input iif lo accept

# SSH faqat ma'lum tarmoqdan
sudo nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 22 accept

# Veb
sudo nft add rule inet filter input tcp dport '{ 80, 443 }' accept

# Chegaralash bilan ICMP
sudo nft add rule inet filter input icmp type echo-request limit rate 5/second accept

# Qaysi portlar ochiq?
sudo ss -tulpn

# Ilova serveri faqat baza serveriga chiqa oladi
sudo ufw allow out to 10.0.2.10 port 3306 proto tcp
sudo ufw deny out to 10.0.2.0/24

# Baza serveri faqat ilova serverlaridan kirishga ruxsat beradi
sudo ufw allow from 10.0.1.0/24 to any port 3306 proto tcp
sudo ufw deny 3306

# /etc/ssh/sshd_config
Port 22
Protocol 2

# Parol bilan kirishni butunlay o'chirish
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes

# root sifatida kirishni taqiqlash
PermitRootLogin no

# Faqat ma'lum foydalanuvchilar
AllowUsers husanboy jasur

# Bo'sh parolni taqiqlash
PermitEmptyPasswords no

# Urinishlar soni
MaxAuthTries 3
MaxSessions 5

# Bo'sh sessiyani yopish
ClientAliveInterval 300
ClientAliveCountMax 2

# Zamonaviy algoritmlar
KexAlgorithms [email protected],diffie-hellman-group16-sha512
Ciphers [email protected],[email protected]
MACs hmac-sha2-512[email protected],hmac-sha2-256[email protected]

sudo sshd -t          # sozlamani tekshirish
sudo systemctl reload sshd

# fail2ban - avtomatik bloklash
sudo apt install fail2ban

# /etc/fail2ban/jail.local
[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 5
backend  = systemd

[sshd]
enabled = true
port    = 22
maxretry = 3
bantime  = 86400

[nginx-limit-req]
enabled = true
filter  = nginx-limit-req
logpath = /var/log/nginx/error.log
maxretry = 10

sudo fail2ban-client status sshd

# WireGuard - zamonaviy va sodda VPN
# /etc/wireguard/wg0.conf

[Interface]
Address = 10.100.0.1/24
ListenPort = 51820
PrivateKey = <server_maxfiy_kaliti>
PostUp = ufw route allow in on wg0 out on eth0
PostDown = ufw route delete allow in on wg0 out on eth0

[Peer]
# Husanboy
PublicKey = <mijoz_ochiq_kaliti>
AllowedIPs = 10.100.0.2/32

[Peer]
# Jasur
PublicKey = <mijoz2_ochiq_kaliti>
AllowedIPs = 10.100.0.3/32

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0
sudo wg show

# DNS so'rovni tekshirish
dig dokon.uz +short
dig dokon.uz MX +short
dig dokon.uz TXT +short

; SPF - faqat shu serverlar xat yubora oladi
dokon.uz.  TXT  "v=spf1 ip4:203.0.113.10 include:_spf.google.com -all"

; DMARC - buzilgan xatlarni rad etish
_dmarc.dokon.uz.  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100"

; CAA - faqat Let's Encrypt sertifikat chiqarsin
dokon.uz.  CAA  0 issue "letsencrypt.org"
dokon.uz.  CAA  0 iodef "mailto:[email protected]"

# DNSSEC tekshiruvi
dig dokon.uz +dnssec +short

# Faol ulanishlar
sudo ss -tunp | head -20

# Odatiy bo'lmagan chiquvchi ulanishlar
sudo ss -tunp state established | grep -v -E ':(80|443|53) '

# Real vaqtda trafik
sudo iftop -i eth0

# Paketlarni tahlil qilish
sudo tcpdump -i eth0 -nn 'port 3306'

# Serverdan chiqayotgan katta hajmdagi ma'lumot
sudo iftop -i eth0 -P -N

# Suricata - hujumlarni aniqlash tizimi
sudo apt install suricata
sudo suricata-update
sudo systemctl enable --now suricata

# Ogohlantirishlarni ko'rish
sudo tail -f /var/log/suricata/fast.log

# Mehmon tarmog'ini ajratish
# Ichki tarmoqqa kirishni bloklash
iptables -A FORWARD -i wlan1 -o eth0 -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -i wlan1 -o eth0 -j ACCEPT

# Terraform: xavfsizlik guruhlari
resource "aws_security_group" "veb" {
  name = "veb-serverlar"

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 22
    to_port         = 22
    protocol        = "tcp"
    security_groups = [aws_security_group.bastion.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "baza" {
  name = "baza-serverlar"

  # Faqat veb serverlardan
  ingress {
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [aws_security_group.veb.id]
  }

  # Chiquvchi trafik yo'q
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = []
  }
}

#!/bin/bash
# tarmoq-tekshiruvi.sh

echo "=== Ochiq portlar ==="
sudo ss -tulpn | grep LISTEN

echo -e "\n=== 0.0.0.0 da tinglayotgan xizmatlar ==="
sudo ss -tulpn | grep '0.0.0.0' | grep -v -E ':(80|443|22) '

echo -e "\n=== Firewall holati ==="
sudo ufw status verbose

echo -e "\n=== fail2ban ==="
sudo fail2ban-client status 2>/dev/null || echo "O'rnatilmagan"

echo -e "\n=== SSH sozlamalari ==="
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|maxauthtries)'

echo -e "\n=== Oxirgi muvaffaqiyatsiz kirishlar ==="
sudo grep "Failed password" /var/log/auth.log | tail -5