Hot answers tagged

8

You can use the service iptables save command.


6

You can run /etc/init.d/iptables save. This will write out the file /etc/sysconfig/iptables. Look at that file to verify that the contents has the rules that you want (it won't be in same format as iptables run from the command line, but you should be able to get the gist of it). Make sure that iptables is set to run on reboot. Run chkconfig --list ...


6

Your password has 12 characters, which at 6 bits per character is 72 bits of randomness. An SSH key is at least 2048 bits, which is a lot more to try to guess. An SSH key is stored on your client, only accessed by the SSH client, and not even known by you. A password is often used for other purposes (higher chance of leakage) and typed into untrusted ...


5

running iptables -L -n does not give you the interface names the rules might have defined as conditions. Rules that look alike with different targets are probably conditioned for different interfaces unless they have been written a) in a hurry b) by an absent-minded admin c) as a temporary workaround for something or d) all of the above Use iptables ...


5

You need allow DHCP requests: $IPTABLES -I INPUT -i $LAN_IFACE -p udp --dport 67:68 --sport 67:68 -j ACCEPT in CSF you can set 67 and 68 in UDP_IN, UDP_OUT and unset DROP_NOLOG(CSF Firewall Configuration)


4

You don't really seem to have the GRE protocol enabled, from what I can see. You have port 47 TCP allowed, but that's not the same. Your rc.local rules regarding GRE seem fine but are probably being overwritten, so add those rules in your firewall system proper. You also have a DROP policy for forwarding packets - add this rule as a mininum: iptables -A ...


4

It's necessary to add the following lines to the /etc/csf/csf.pignore file. exe:/usr/sbin/php5-fpm exe:/usr/sbin/nginx exe:/usr/sbin/mysqld


4

You should not rely on blocking specific IP addresses to mitigate hacking attempts. To make your system secure, it should be protected against hacking from ANY IP address. You should block access to all ports except for the ports which are used. For example, when you provide a web service, allow port 80, and only allow it to communicate directly with a web ...


4

We use fail2ban It automatically blocks the IP of the spambot or malicious user for a user defined period of time once it detects a user defined number of requests to non-existent pages, failed login attempts etc. We currently use it to protect against ssh attacks but are now extending it to our website.


3

On a lot of consumer internet networks, I can just set my IP to that of the neighbors and have their IP, so yeah, IP's can be spoofed. Colocated servers also often share one subnet among different customers. Just DOS the machine so it goes down, take over its IP and you're done... Anyway, it depends on your situation. Do you have data which you expect to be ...


3

CSF will consider any hits to ports not whitelisted in csf.cfg's TCP_IN setting to be a port scanning attempt. Since 10000 is a legitimate port for you, add it to the list in TCP_IN and TCP_OUT and you'll be good to go.


3

Congratulations, under the influence of slow and patient questioning you've solved your own problem. Rule 13 in the ALLOWIN chain is allowing all traffic from the IP address of your test client (59.189.154.164), so when you started an MTA the nmap response went from filtered (ie, you can get to the port, but there's no listener, so you get a TCP reset) to ...


3

Short Answer: If your MTA is on the same box, you NEED to be able to connect out to TCP 25. Long Answer: SMTP between sites on the internet, uses TCP 25 The encryption is opportunistic (ie, uses STARTTLS). Think about it, not everyone you send email to will support TLS. So, to send mail to gmail, you need to be able to reach gmail's MXs on TCP 25. For ...


3

The solution is not to deny all IPs (e.g. deny 0.0.0.0/0) but to allow only the specified static IPs or ranges. Then, the default action of CSF will be to DROP other traffic. This same principle applies to other firewalls like iptables -- as long as the default action is "DROP," then all you need is allow rules.


2

this means it has blocked the following 3 ip's for the respective reasons 81.4.153.90 connecting to port 4899 on tcp 82.178.69.36 connecting to port 80 via UDP 82.178.182.44 connecting to port 80 via UDP from my knowledge a webserver doesnt run on UDP ports hence why your firewall will block UDP 80 these are blocked because CSF will generally block IP's ...


2

netstat is returning connections like this: udp 0 0 :::57817 :::* which, if piped into "cut -d: f1", will return a blank line. that said, and apologies if this seems condecending, how do you know that you're being DDoS'd?


2

I don't think you can do that but you can use an Include statement in your /etc/csf/csf.deny file Include /etc/csf/csf.denytoo Perhaps you can use that to help organise your blocked IP addresses ?


2

Hard to say since you're not displaying for which chains these rules apply. Easily said: For a firewall you've got to start with the FORWARD chain and follow all rules that match in sequence until you hit an ACCEPT, DROP or REJECT If you reach the end of all rules this way, the FORWARD's default policy applies.


2

Check out this question over on security stack exchange - lots of useful answers.


2

My personal favorite of understanding iptables rulesets is the command iptables-save, which dump all rules to stdout. This helps to get the idea of the right order of rules. A full picture of packet traversal in iptables is here: http://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg


2

CSF/LFD installs easily and works with pretty much zero configuration. But the default configuration will send you a LOT of lfd emails about processes - and whilst it is possible to turn emails off entirely that's a bad idea for obvious reasons. What you will need to do is spend the first few days of running CSF monitoring those emails and deciding if any ...


2

You need to install libwww-perl. sudo aptitude install libwww-perl OR sudo perl -MCPAN -e 'install Bundle::LWP' OR wget http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/libwww-perl-6.04.tar.gz tar xzf libwww-perl-6.04.tar.gz cd libwww-perl-6.04 perl Makefile.PL make sudo make install


2

Kudos for actually recognising that 0777 is a bad permission set... most people come here asking how to make all their files wide-open, not the other way around... I don't have a specific answer for you (I don't use cpanel, thank $DEITY), but I don't think it's a stock configuration thing -- it smells like something's been modified behind the scenes. You ...


2

Check out what the "umask" is set to ... check: /var/cpanel/easy/apache/rawenv/umask /usr/local/apache/bin/envvars Look in /etc/init.d/apache2 or /etc/inet.d/httpd to verify the location of the envvars file. The ".../rawenv/umask is used during the automated re-build for setting "envvars" The "envvars" is used during start-up.


2

Iptables could be used to that end. Blocking parallell connections: iptables -A INPUT -p tcp --syn --dport 80 -m connlimit \ --connlimit-above 20 -j REJECT --reject-with tcp-reset Blocking floods (block more than 10 connections per minute) : iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp --...


2

If memory serves, /etc/sysconfig/iptables-config is the file that describes what options are used when the rhel iptables init script is brought up. It does not have explicit rules in it. the /etc/sysconfig/iptables file on the other hand does have these rules in it. It is formatted per the output of the iptables-save command; in fact, when you run service ...


2

Add cmd:/usr/sbin/apache2 -k start to csf.pignore file and restart CSF and LFD (you might need to kill the lfd process)


2

This are prelink temp files and it is most likely due to selinux or some bug that was introduced with Centos 6.6 that those files aren't automatically removed. There is an old bug with similar behaviour https://bugzilla.redhat.com/show_bug.cgi?id=584550 They should be safe to remove but there will be other files with similar names so you might want to ...


2

-s is meant to specify an IP address, and the filter you're trying to configure will drop every packet with a source of that IP. If you provide a DNS entity, it will be resolved to an IP address when the rule is added. Since that DNS record cannot be resolved, the rule add fails. To make this packet filter work, you'd need to match the record being ...


1

The reason to filter egress traffic (with CSF or anything else) is to reduce your security risk profile. This is especially important in high security threat environments, for instance, a shared web hosting server, where you don't have complete control over what software users install. In such an environment, if a user installs a vulnerable piece of ...



Only top voted, non community-wiki answers of a minimum length are eligible