Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to lock down my centos box using iptables so that it can only make http connections to a valid centos mirror - my concern is that the IPs for the mirror sites is likely to change.

Any suggestions ?

share|improve this question
up vote 0 down vote accepted

iptables won't let you do hostname lookups so as the other commenter suggested, I would setup a proxy which syncs with the master servers and then create a custom repo file to access only your proxy.

Not really more secure though as you're still copying over whatever was on the master servers the proxy was syncing with.

If someone gains enough access to change your repo then you're already hosed because they probably have root or are able to redirect your traffic (arp spoofing). I'd make sure everything else is secure and keep the repos the way they are.

share|improve this answer
Good call. I'll heed your advice :) – Hilton D Jan 8 '10 at 1:50
I'll be testing Opendns' whitelist only feature to reduce the risk of my server resolving other sites. At least then I will know if it is requesting banned sites :) – Hilton D Feb 20 '10 at 10:35

My ISP provides a FTP mirror which contains GNU/Linux distributions as well as local update caches. Bandwidth from this server is not part of my monthly allowance.

Check if your ISP has a public mirror and if they have a local copy of the Centos yum cache.

NOTE: This assumes server running in your SOHO and not hosted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.