Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently limit IP addresses that have access to my SSH service with a rule like this

 # accept already established 
 iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

 iptables -A INPUT -p tcp  --source w.x.y.z/32 --dport 22 -j ACCEPT
 iptables -A INPUT -p tcp  --source a.b.c.d/32 --dport 22 -j ACCEPT

 #drop everyting else
 iptables -A INPUT -j DROP 
 iptables -P FORWARD DROP

Where w.x.y.z and a.b.c.d are the allowed IPs.

I have this rule on multiple servers.

What would be the best way to be able to add and remove IPs to the allowed list and reload all servers rules so the changes are effective?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The best solution would be to use some sort of system management tool such as Puppet, Spacewalk, etc. Where you can push out configuration files to multiple computers at once. This will help you in the long run for other things as well. However, if you don't want to deal with all of the hassle of doing a central management type of setup, you could create ssh keys on all of the servers and then create scripts to modify and restart iptables.

  • Have SSH keys of all of your Linux server so you can do passwordless SSH logins
  • Create mod_iptables_servers.sh
    • ssh login@server1 'bash -s' < change_iptables.sh
    • ssh login@server2 'bash -s' < change_iptables.sh
    • ssh login@server3 'bash -s' < change_iptables.sh
  • Create a change_iptables.sh script that will modify your firewall rules and restart iptables
  • Run mod_iptables_servers.sh, which should login to all of your Linux machines and execute the change_iptables.sh script.

While I would highly recommend the central management solution, this way would be able to get the job done. As a disclaimer, I have never tried this but used the answer from this question to get the correct syntax - http://stackoverflow.com/questions/305035/how-to-use-ssh-to-run-shell-script-on-a-remote-machine.

share|improve this answer
    
Thanks that was very insight full, I will probably be starting with a simple script and post it here once it's been tested. –  Patrick Forget Jun 12 '12 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.