Re: ssh brute force attacks
Andres Paglayan <andres-pMggkaTgBv1Wk0Htik3J/[email protected]> Sat, 29 Jan 2011 08:42:06 -0700
| Newsgroups | gmane.org.user-groups.nmlug |
|---|---|
| Message-ID | <1296315726.2687.7.camel@andres-laptop> |
--===============0088153088== Content-Type: multipart/signed; micalg="sha1"; protocol="application/x-pkcs7-signature"; boundary="=-4sRlhEDIWNYyA/m3+Z5+" --=-4sRlhEDIWNYyA/m3+Z5+ Content-Type: multipart/alternative; boundary="=-GPsmAir9F0qkl0LPt2u1" --=-GPsmAir9F0qkl0LPt2u1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 2011-01-28 at 23:42 -0700, J. Marsden DeLapp wrote: > On Friday 28 January 2011 3:18:37 pm Ed Heron <Ed-MBvgLuVkLo/[email protected]> wrote: > > What is the deal with the SSH brute force attacks? I wasn't paying > > attention until recently, but some of my new CentOS machines are giving > > me reports of all the failed login attempts. > >=20 > > Most attackers (several dozen per day) try once every 15 to 20 > > minutes. I assume to avoid automatically being banned. Some were > > throwing thousands of attempts at me from a single IP address. It migh= t > > have been happening on my old servers, but I'm afraid to look. > >=20 > > I didn't have any automatic banning software installed before, but I > > do now. > >=20 > > However, it makes me think about SSH. It is a secure protocol but a > > bad password could open my system up to exploitation. This isn't a SSH > > fault but a lack of confidence in my users. And we don't even use SSH > > from outside the private network that often (just me for maintenance). >=20 > Here are a few things I do to increase SSH security. >=20 > Create a sshuser group and require anyone who needs ssh access to be in t= hat group. >=20 > vim /etc/ssh/sshd_config > #change to not allow root login > PermitRootLogin no > #added sshuser group and > #Added to restrict ssh login to people in the sshuser group > AllowGroups sshuser >=20 > Anyone who is a ssh user should have a unique userID. Don't use common na= mes=20 > like bob, chuck, fred, admin, staff, etc. Things like bobjones, chucksmit= h are better choices.=20 >=20 > Another cute trick to slow them down is to rate limit connections. >=20 > #These two commands will rate limit connection attempts on ssh > iptables -A INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recen= t --set > iptables -A INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recen= t --update --seconds 60 --hitcount 4 -j DROP Mode parent up! ;-) I use those rules from Mars in every server since I got them as response few years ago. even with distributed attacks they are very good, In the more sensitive servers I only allow ssh from two ips,=20 1./ my house dsl ip, 2./ and the ip of another collocated server of mine so worst case, if I am not at home, I can ssh into machine two, then ssh into one and change the rules. there's one comment thought, it counts for every ssh connection, not just failed,=20 so if you open 4 consoles and ssh in in less than a minute from them all, you lock yourself out, it's good to have a rule that always allows ssh from your ip make sure to restore rules on startup, >=20 > But that does not work against the distributed attacks coming from a slew= of different=20 > ip addresses. And it sets you up for a potential denial of service attack= . If you do the > rate limiting thing, make sure you tell your users if they have three fai= led login attempts,=20 > they need to wait for at least 60 seconds before trying again. >=20 > Mars >=20 --=-GPsmAir9F0qkl0LPt2u1 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; CHARSET=3DUTF-8"> <META NAME=3D"GENERATOR" CONTENT=3D"GtkHTML/3.28.3"> </HEAD> <BODY> On Fri, 2011-01-28 at 23:42 -0700, J. Marsden DeLapp wrote: <BLOCKQUOTE TYPE=3DCITE> <PRE> On Friday 28 January 2011 3:18:37 pm Ed Heron <<A HREF=3D"mailto:Ed@hero= n-ent.com">Ed-MBvgLuVkLo/[email protected]</A>> wrote: > What is the deal with the SSH brute force attacks? I wasn't paying > attention until recently, but some of my new CentOS machines are givin= g > me reports of all the failed login attempts. >=20 > Most attackers (several dozen per day) try once every 15 to 20 > minutes. I assume to avoid automatically being banned. Some were > throwing thousands of attempts at me from a single IP address. It mig= ht > have been happening on my old servers, but I'm afraid to look. >=20 > I didn't have any automatic banning software installed before, but I > do now. >=20 > However, it makes me think about SSH. It is a secure protocol but a > bad password could open my system up to exploitation. This isn't a SS= H > fault but a lack of confidence in my users. And we don't even use SSH > from outside the private network that often (just me for maintenance). Here are a few things I do to increase SSH security. Create a sshuser group and require anyone who needs ssh access to be in tha= t group. vim /etc/ssh/sshd_config #change to not allow root login PermitRootLogin no #added sshuser group and #Added to restrict ssh login to people in the sshuser group AllowGroups sshuser Anyone who is a ssh user should have a unique userID. Don't use common name= s=20 like bob, chuck, fred, admin, staff, etc. Things like bobjones, chucksmith = are better choices.=20 Another cute trick to slow them down is to rate limit connections. #These two commands will rate limit connection attempts on ssh iptables -A INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent = --set iptables -A INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent = --update --seconds 60 --hitcount 4 -j DROP </PRE> </BLOCKQUOTE> <BR> Mode parent up! ;-)<BR> <BR> I use those rules from Mars in every server since I got them as response fe= w years ago.<BR> even with distributed attacks they are very good,<BR> <BR> In the more sensitive servers I only allow ssh from two ips, <BR> <BR> 1./ my house dsl ip,<BR> 2./ and the ip of another collocated server of mine<BR> so worst case, if I am not at home, I can ssh into machine two, then ssh in= to one and change the rules.<BR> <BR> there's one comment thought,<BR> it counts for every ssh connection, not just failed, <BR> so if you open 4 consoles and ssh in in less than a minute from them all, y= ou lock yourself out,<BR> it's good to have a rule that always allows ssh from your ip<BR> <BR> make sure to restore rules on startup,<BR> <BR> <BLOCKQUOTE TYPE=3DCITE> <PRE> But that does not work against the distributed attacks coming from a slew o= f different=20 ip addresses. And it sets you up for a potential denial of service attack. = If you do the rate limiting thing, make sure you tell your users if they have three faile= d login attempts,=20 they need to wait for at least 60 seconds before trying again. Mars </PRE> </BLOCKQUOTE> <BR> </BODY> </HTML> --=-GPsmAir9F0qkl0LPt2u1-- --=-4sRlhEDIWNYyA/m3+Z5+ Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRSTCCBN0w ggPFoAMCAQICEHGS++YZX6xNEoV0cTSiGKcwDQYJKoZIhvcNAQEFBQAwezELMAkGA1UEBhMCR0Ix GzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwR Q29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0w NDAxMDEwMDAwMDBaFw0yODEyMzEyMzU5NTlaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQx FzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsx ITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVROLVVTRVJGaXJz dC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3BYHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIx B8dOtINknS4p1aJkxIW9hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8 om+rWV6lL8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLmSGHG TPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM1tZUOt4KpLoDd7Nl yP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu9mIwFIws6wIDAQABo4IBJzCCASMwHwYDVR0j BBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYEFImCZ33EnSZwAEu0UEh83j2uBG59 MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggr BgEFBQcDBDARBgNVHSAECjAIMAYGBFUdIAAwewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5j b21vZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwu Y29tb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDARBglghkgBhvhCAQEEBAMCAQYw DQYJKoZIhvcNAQEFBQADggEBAJ2Vyzy4fqUJxB6/C8LHdo45PJTGEKpPDMngq4RdiVTgZTvzbRx8 NywlVF+WIfw3hJGdFdwUT4HPVB1rbEVgxy35l1FM+WbKPKCCjKbI8OLp1Er57D9Wyd12jMOCAU9s APMeGmF0BEcDqcZAV5G8ZSLFJ2dPV9tkWtmNH7qGL/QGrpxp7en0zykX2OBKnxogL5dMUbtGB8SK N04g4wkxaMeexIud6H4RvDJoEJYRmETYKlFgTYjrdDrfQwYyyDlWjDoRUtNBpEMD9O3vMyfbOeAU TibJ2PU54om4k123KSZB6rObroP8d3XK6Mq1/uJlSmM+RMTQw16Hc6mYHK9/FX8wggYwMIIFGKAD AgECAhEA1MYVVtG5NlYKVwPMleTcrzANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMCVVMxCzAJ BgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVT VCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVU Ti1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw0xMDA4MDIwMDAw MDBaFw0xMTA4MDIyMzU5NTlaMIHeMTUwMwYDVQQLEyxDb21vZG8gVHJ1c3QgTmV0d29yayAtIFBF UlNPTkEgTk9UIFZBTElEQVRFRDFGMEQGA1UECxM9VGVybXMgYW5kIENvbmRpdGlvbnMgb2YgdXNl OiBodHRwOi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeTEfMB0GA1UECxMWKGMpMjAwMyBDb21v ZG8gTGltaXRlZDEYMBYGA1UEAxMPQW5kcmVzIFBhZ2xheWFuMSIwIAYJKoZIhvcNAQkBFhNhbmRy ZXNAcGFnbGF5YW4uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2e0OeOQ9O0/q H18zdfGBKJqUqxrX4I7CpZk+CtvWumCXBXtNHLAlFNI3l5+0wIDa+OYofdFNb7pUPfU3EPVGY04V gS5AKrOoPBkXMf+wTA9kCChqJwzTM4oVr6RiUpNP2QpgQxVjrJakzyA6fzgV1W9iLKnIZ2kYoY16 YiB2n5VAPxANe0+os8yScj0YERMP4rzVe2NmXGrKFhycQtRDf4I1I4rivVDwUxsJ//5Z2bSvGULq S5N1ro05vde90VgGLt3/oaGgGtg3EQIXa04iPy0V/Fi+oEOAMGyhcKuRvyOUYc0AHFsDDk98DOU1 OhqQ11uXJ+/tNMWKP5V66riSKQIDAQABo4ICFTCCAhEwHwYDVR0jBBgwFoAUiYJnfcSdJnAAS7RQ SHzePa4Ebn0wHQYDVR0OBBYEFJr9di/tpfwjFMVCgYKCQYQtkBzUMA4GA1UdDwEB/wQEAwIFoDAM BgNVHRMBAf8EAjAAMCAGA1UdJQQZMBcGCCsGAQUFBwMEBgsrBgEEAbIxAQMFAjARBglghkgBhvhC AQEEBAMCBSAwRgYDVR0gBD8wPTA7BgwrBgEEAbIxAQIBAQEwKzApBggrBgEFBQcCARYdaHR0cHM6 Ly9zZWN1cmUuY29tb2RvLm5ldC9DUFMwgaUGA1UdHwSBnTCBmjBMoEqgSIZGaHR0cDovL2NybC5j b21vZG9jYS5jb20vVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50aWNhdGlvbmFuZEVtYWlsLmNy bDBKoEigRoZEaHR0cDovL2NybC5jb21vZG8ubmV0L1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVu dGljYXRpb25hbmRFbWFpbC5jcmwwbAYIKwYBBQUHAQEEYDBeMDYGCCsGAQUFBzAChipodHRwOi8v Y3J0LmNvbW9kb2NhLmNvbS9VVE5BQUFDbGllbnRDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9v Y3NwLmNvbW9kb2NhLmNvbTAeBgNVHREEFzAVgRNhbmRyZXNAcGFnbGF5YW4uY29tMA0GCSqGSIb3 DQEBBQUAA4IBAQAqAp76qdfrncUft2iy3moOh6aXdzEKSiZbgCjPFA9lLLTPiFqA72pnj/MAxeMY Ivk35AhLYkNP4hqhcuTfQ0jg4WuQM5K6r5PZS72rk3VC9PCZjw1LsWtZMhT/J9lgIf6jMbYmh4GR JrGBqoKUkyPzlFQXYzmiArNt/QZftS0HWGHOvYgK1IfPkTuzcA02MnFiPseuJdMlWLO0UvHJGYDN MXhIV8y8IUsENnJq/YATVQMMRziHYGwsUGlwsWzKq/QF6hRDNPUsQOe7+Y9Thzd741iindgyfDlx yeHZvHmPCuFEGjpU+okB4UcyPbNnMaBD/O4ls1RouHbDOYCMQQo5MIIGMDCCBRigAwIBAgIRANTG FVbRuTZWClcDzJXk3K8wDQYJKoZIhvcNAQEFBQAwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJV VDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29y azEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZp cnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwwHhcNMTAwODAyMDAwMDAwWhcNMTEw ODAyMjM1OTU5WjCB3jE1MDMGA1UECxMsQ29tb2RvIFRydXN0IE5ldHdvcmsgLSBQRVJTT05BIE5P VCBWQUxJREFURUQxRjBEBgNVBAsTPVRlcm1zIGFuZCBDb25kaXRpb25zIG9mIHVzZTogaHR0cDov L3d3dy5jb21vZG8ubmV0L3JlcG9zaXRvcnkxHzAdBgNVBAsTFihjKTIwMDMgQ29tb2RvIExpbWl0 ZWQxGDAWBgNVBAMTD0FuZHJlcyBQYWdsYXlhbjEiMCAGCSqGSIb3DQEJARYTYW5kcmVzQHBhZ2xh eWFuLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANntDnjkPTtP6h9fM3XxgSia lKsa1+COwqWZPgrb1rpglwV7TRywJRTSN5eftMCA2vjmKH3RTW+6VD31NxD1RmNOFYEuQCqzqDwZ FzH/sEwPZAgoaicM0zOKFa+kYlKTT9kKYEMVY6yWpM8gOn84FdVvYiypyGdpGKGNemIgdp+VQD8Q DXtPqLPMknI9GBETD+K81XtjZlxqyhYcnELUQ3+CNSOK4r1Q8FMbCf/+Wdm0rxlC6kuTda6NOb3X vdFYBi7d/6GhoBrYNxECF2tOIj8tFfxYvqBDgDBsoXCrkb8jlGHNABxbAw5PfAzlNToakNdblyfv 7TTFij+Veuq4kikCAwEAAaOCAhUwggIRMB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh83j2uBG59 MB0GA1UdDgQWBBSa/XYv7aX8IxTFQoGCgkGELZAc1DAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/ BAIwADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYBBAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQDAgUg MEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEBMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJl LmNvbW9kby5uZXQvQ1BTMIGlBgNVHR8EgZ0wgZowTKBKoEiGRmh0dHA6Ly9jcmwuY29tb2RvY2Eu Y29tL1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRpb25hbmRFbWFpbC5jcmwwSqBIoEaG RGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9VVE4tVVNFUkZpcnN0LUNsaWVudEF1dGhlbnRpY2F0aW9u YW5kRW1haWwuY3JsMGwGCCsGAQUFBwEBBGAwXjA2BggrBgEFBQcwAoYqaHR0cDovL2NydC5jb21v ZG9jYS5jb20vVVROQUFBQ2xpZW50Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v ZG9jYS5jb20wHgYDVR0RBBcwFYETYW5kcmVzQHBhZ2xheWFuLmNvbTANBgkqhkiG9w0BAQUFAAOC AQEAKgKe+qnX653FH7dost5qDoeml3cxCkomW4AozxQPZSy0z4hagO9qZ4/zAMXjGCL5N+QIS2JD T+IaoXLk30NI4OFrkDOSuq+T2Uu9q5N1QvTwmY8NS7FrWTIU/yfZYCH+ozG2JoeBkSaxgaqClJMj 85RUF2M5ogKzbf0GX7UtB1hhzr2ICtSHz5E7s3ANNjJxYj7HriXTJViztFLxyRmAzTF4SFfMvCFL BDZyav2AE1UDDEc4h2BsLFBpcLFsyqv0BeoUQzT1LEDnu/mPU4c3e+NYop3YMnw5ccnh2bx5jwrh RBo6VPqJAeFHMj2zZzGgQ/zuJbNUaLh2wzmAjEEKOTGCA/8wggP7AgEBMIHEMIGuMQswCQYDVQQG EwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUg VVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQG A1UEAxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsAhEA1MYV VtG5NlYKVwPMleTcrzAJBgUrDgMCGgUAoIICDzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwG CSqGSIb3DQEJBTEPFw0xMTAxMjkxNTQyMDRaMCMGCSqGSIb3DQEJBDEWBBQsjZLEJlcMe+CiDuk1 jDl+yOZvbjCB1QYJKwYBBAGCNxAEMYHHMIHEMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQx FzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsx ITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVROLVVTRVJGaXJz dC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsAhEA1MYVVtG5NlYKVwPMleTcrzCB1wYL KoZIhvcNAQkQAgsxgceggcQwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMO U2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMY aHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBB dXRoZW50aWNhdGlvbiBhbmQgRW1haWwCEQDUxhVW0bk2VgpXA8yV5NyvMA0GCSqGSIb3DQEBAQUA BIIBAGtASA996PuiDuhPJCU3eMGQWPV/sGO02SG9wkbSiskonMQ7s7F2O4uHhfbFfufTtBKoMPzn wMOtoyrcwin6YpsKdnE8OtylH9XzFIAEaHclVya5erNEtI6b+l/E4S9orT0OBb92iqOO8tUhtKv9 Br+sIrCKtDU6oE6BLYM2Co0oZX/EOIYHBMVRnkP5K4Vq6fbf6i0++VoA9bzUxF3vbRi6WIIX2KjA STkUdoKawqR9Oin2OKH1hZH9xEXX5H1d+kyd/YBk52rrmYDwWUD/yWoOuaZSy455pWo7B/t1qJio FzlrlUYjeBhIYv8AhYJQwGv8Dg1g3XH401Jd0w9GSfcAAAAAAAA= --=-4sRlhEDIWNYyA/m3+Z5+-- --===============0088153088== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ NMLUG mailing list [email protected] http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug --===============0088153088==--