Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and drop everything else, but I have no clue how to prevent attacks.

Is there any example scripts out there that cater for as many different attacks as possible (block and optionally log)? A script that will stop DDoS attacks (SYN floods, ICMP floods, etc), port scans, brute force attacks, etc. Everything (or as close to it as we can get)

share|improve this question

closed as not a real question by MadHatter, Tom O'Connor, Bill Weiss, SvW, MDMarra Mar 14 '12 at 14:09

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
You're kind of asking three questions here. 1. "Gimme iptables config" 2. "Prevent attacks" 3. "Stop DDoS, port scans, brute force, etc." The first one is answerable, the second is vague and ill-defined and the third has been answered many times both here and on Security.SE however the answer is always expensive and difficult. –  Ladadadada Mar 13 '12 at 11:46

4 Answers 4

Security is like an onion, it's made of layers. I'll list you couple of useful components.

fail2ban helps you blocking & logging various kinds of attacks, ranging from ssh brute force attacks to Apache attacks to spammers.

Apache's mod_security is a heavy-weight security add-on for Apache. It can deny requests from known blacklisted IP addresses, it can detect SQL injection attempts, and many many more attacks.

Suhosin helps you to protect PHP quite a bit.

SELinux or grsecurity can provide you additional protection by hardening the OS. With those security frameworks a vulnerability in some application might restrict the damage or even prevent someone getting root access.

share|improve this answer
    
Security, in many ways is like an ogre. Shrek taught me that. –  Sirex Mar 13 '12 at 12:13

In addition to the previous suggestions, I suggest you take a look at OSSEC, it's a pretty good IDS. It blocks people trying to bruteforce your server and sends you an email when there was an incident. It also tracks the hashes of certain files so you can see if something fishy was edited. I've also written a tutorial on howto use in on my blog.

share|improve this answer

Something like this answers your first question:

iptables -p INPUT DROP
iptables -p OUTPUT DROP
iptables -p FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

If you also want IMAP and the secure (SSL/TLS) versions of these, add these rules in as well:

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp --dport 993 -j ACCEPT
iptables -A INPUT -p tcp --dport 995 -j ACCEPT
iptables -A INPUT -p tcp --dport 465 -j ACCEPT
share|improve this answer

Start somewhere like this http://wiki.centos.org/HowTos/OS_Protection and end up somewhere like this https://help.ubuntu.com/community/Security

share|improve this answer
    
You seem to have installed a new OS along your journey. :-) –  Ladadadada Mar 13 '12 at 12:31
    
Pitching to the audience ;) –  SuperBOB Mar 15 '12 at 14:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.