Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to lock down my centos box using iptables so that it can only make http connections to a valid centos mirror - my concern is that the IPs for the mirror sites is likely to change.

Any suggestions ?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

iptables won't let you do hostname lookups so as the other commenter suggested, I would setup a proxy which syncs with the master servers and then create a custom repo file to access only your proxy.

Not really more secure though as you're still copying over whatever was on the master servers the proxy was syncing with.

If someone gains enough access to change your repo then you're already hosed because they probably have root or are able to redirect your traffic (arp spoofing). I'd make sure everything else is secure and keep the repos the way they are.

share|improve this answer
    
Good call. I'll heed your advice :) –  Hilt86 Jan 8 '10 at 1:50
    
I'll be testing Opendns' whitelist only feature to reduce the risk of my server resolving other sites. At least then I will know if it is requesting banned sites :) –  Hilt86 Feb 20 '10 at 10:35
add comment

My ISP provides a FTP mirror which contains GNU/Linux distributions as well as local update caches. Bandwidth from this server is not part of my monthly allowance.

Check if your ISP has a public mirror and if they have a local copy of the Centos yum cache.

NOTE: This assumes server running in your SOHO and not hosted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.