[SOLVED] My iptables rule not worked.

hack3rcon · 10-09-2017, 09:32 AM

Quote:

Originally Posted by Shadow_7

tcpdump can capture the raw packets, so there's probably way. But only IF you were recording the traffic at the time. Or some iptables mechanism to record the packets that were rejected/logged. Then again encryption is a thing now, so you'd have to know the key(s) and the data to translate. Or have tools that knows those things for you. wireshark? idk, not my wheel house.

Can iptables capture it?

michaelk · 10-09-2017, 10:41 AM

No, ssh traffic is encrypted anyway. iptables can not detect if a password is being entered.

hack3rcon · 10-10-2017, 06:03 AM

Quote:

Originally Posted by michaelk

No, ssh traffic is encrypted anyway. iptables can not detect if a password is being entered.

not SSH, Just regular Login.

hack3rcon · 10-17-2017, 09:11 AM

Can I see it?

michaelk · 10-17-2017, 10:11 AM

Not that I am aware of.

hack3rcon · 10-21-2017, 04:04 AM

Thus, I can't see which passwords entered when I'm not at the desk?

Shadow_7 · 10-21-2017, 05:04 AM

It depends on how things are configured. There are many ways to log things. Screen capture, packet capture, key logger, application logs, perhaps it's more of a where do I look, versus how do I do? Things like iptables are meant to "filter" packets, with some logging. Other things like tcpdump can capture all the packets in their raw format. Which could take some knowledge and time to interpret to human meaningful bits. Or various programs to do that translation for you.

hack3rcon · 10-21-2017, 06:54 AM

Thank you.