-2

I have two ubuntu server into my company:
1) backup server which only backup computer or remote server (IP: 192.168.1.253)
2) real server which contains all data file apache where run our demo project (IP: 192.168.1.254)

Server 2 has the firewall, server 1 no.
I want to know if I have to install firewall into the backup server or is not necessary for our security. Or a method to reject ssh connection from bot or hacker.

Improve this question
1
  • Given the information you've provided there's no way we can intelligently answer this question. We don't know if you have a firewall in front of these machines or if they're just thrown on the internet (since you're using private addresses I have to assume there's SOMETHING between these systems and the internet), and we don't know your organization's security needs. You could easily rework this into a better question (and get better answers) with some effort...
    – voretaq7
    Jun 5, 2013 at 19:29

1 Answer 1

Reset to default
3

Of course you need a firewall.
First allow all SSH, plus the incoming backup traffic from server2.
Then drop everything other traffic.
When this works, you can add for example 'fail2ban' to ban brute force attacks on SSH.

Allowing SSH from everywhere: 

/sbin/iptables -F
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -s 192.168.1.254 -j ACCEPT
/sbin/iptables -P INPUT DROP

If you still can access the server (so didn't mistype something and firewall didn't lock you out), then add the same 4 line to /etc/rc.local .

Improve this answer
4
  • Can you please make an example of allow ssh and the other pass?
    – Alessandro Minoccheri
    May 6, 2013 at 21:00
  • 1
    Edited and added example.
    – Sandor Marton
    May 6, 2013 at 21:12
  • Great but this into te server 1 or server 2? This is to allow ssh everywhere. But why do it? What is the benefict of this? Thanks for the help
    – Alessandro Minoccheri
    May 7, 2013 at 5:53
  • This is on backup server (server 1), since you asked if you should have firewall on that . It allows ssh FROM everywhere, so you can manage the server from home/etc (even if you have dynamic IP) .
    – Sandor Marton
    May 7, 2013 at 12:12

Not the answer you're looking for? Browse other questions tagged .