Tag Info

Hot answers tagged

208

In today's internet this is quite normal sadly. There are hordes of botnets trying to login to each server they find in whole IP networks. Typically, they use simple dictionary attacks on well-known accounts (like root or certain applications accounts). The attack targets are not found via Google or DNS entries, but the attackers just try every IP address ...


87

ICMP is way, way more than "traceroute" and "ping." It is used for feedback when you run a DNS server (port unreachable) which, in a modern DNS server, may actually help select a different machine to query faster. ICMP is also, as was mentioned above, used for path MTU discovery. Chances are your OS sets "DF" (don't fragment) on TCP packets it sends. It ...


74

I note that you've done a great job tying down several different daemons, and from what you've said I think it unlikely that you'll expose yourself to trouble through those services you have already secured. This still leaves you in a "everything is permitted except that which I have forbidden" state, and you can't get out of that state by hunting down ...


69

You basically have three options here. Disconnect your office/users from the internet If they can't get to "the public cloud," they can't upload anything to it. Compile a blacklist of specific services you're worried about users accessing. This is going to be absolutely massive if it's meant to be even remotely effective. Tech-savvy users will always ...


59

A few 100 is just fine... Last month I found one of my servers had 40k failed attempts. I went trough the trouble of plotting them: Map Once I changed the ssh port and implemented Port Knocking, the number dropped to 0 :-)


59

Since you are on the Windows machine, these things can be done, Execute the following command and look for a ":3306" listener (you did not mention UDP/TCP). This will confirm there is something running on the port. netstat -a -n After this, if you are expecting incoming connections on this port and feel that the firewall may be blocking them, you could ...


56

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see if you can boot the VM to a recovery linux CD (some providers offer this) and then correct the firewall rules that way and then boot it like normal. If you ...


54

IPv6 gets rid of NAT, which has certainly been a large part of avoiding accidental exposure of services to the internet from internal hosts.. so in that way, yes, it's a change to how most everyone is doing things. However, it doesn't at all mean that you won't still have a central firewall at the network edge - the change is simply that it'll be acting as ...


50

Obligatory: installation of system with expert mode, only packages that I need hand written firewall with default policy on iptables'input: drop, permitting access to SSH, HTTP or whatever else given server is running Fail2Ban for SSH [ and sometimes FTP / HTTP / other - depending on context ] disable root logins, force using normal user and sudo custom ...


45

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.


36

I think you acknowledge an interesting sys-admin truth there, which is that unless you can reduce the probability of being hacked to zero then eventually, at some point, you are going to get hacked. This is just a basic truth of maths and probability, that for any non-zero probability of an event. The event eventually happens... So the 2 golden ...


36

PREROUTING isn't used by the loopback interface, you need to also add an OUTPUT rule: iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080 iptables -t nat -I OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8080


35

As a general rule, use REJECT when you want the other end to know the port is unreachable' use DROP for connections to hosts you don't want people to see. Usually, all rules for connections inside your LAN should use REJECT. For the Internet, With the exception of ident on certain servers, connections from the Internet are usually DROPPED. Using DROP ...


29

I for one use a "tarpit" in addition to only allowing public key authentication and disallowing root logins. In netfilter there is a recent module, which you can use with (INPUT chain): iptables -A INPUT -i if0 -p tcp --dport 22 -m state --state NEW -m recent --set --name tarpit --rsource iptables -A INPUT -i if0 -p tcp --dport 22 -m state --state NEW -m ...


29

Since 0.8.8 there is the unbanip option (actionunban isn't for this purpose) It can be triggered by the set command, if you look at the list of options, you will see the syntaxis. So it will be (by heart, please check): fail2ban-client set ssh-iptables unbanip m.y.i.p more generic: fail2ban-client set JAIL unbanip MYIP works for me


29

The ping utility does what it's supposed to, hit the ping interface using ICMP, you can't just ping any port you like with it. I'm sure there's a million ways to do it but most people just use 'telnet IP port', i.e. 'telnet 1.2.3.4 25' to test connection.


29

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.


29

There is no way to block it completely, of course, unless the corporate network were to be disconnected from the Internet. If you really want something that should work most of the time while being mostly transparent, you'll need to deep-sniff packets. Set up a man-in-the-middle SSL/TLS proxy, as well as one for unencrypted communication, and block all ...


28

TCP Wrappers could be arguably called a host-based firewall implementation; you're filtering network traffic. For the point on an attacker making outbound connections on an arbitrary port, a firewall would provide a means of controlling outgoing traffic as well; a properly configured firewall manages ingress and egress in a way which is appropriate to the ...


27

Advantages of firewall: You can filter outbound traffic. Layer 7 firewalls (IPS) can protect against known application vulnerabilities. You can block certain IP range and/or port centrally rather than trying to ensure that there is no service listening on that port on each individual machine or denying access using TCP/Wrappers. Firewalls can help if you ...


27

Hardware firewalls are running software too, the only real difference is that the device is purpose built and dedicated to the task. Software firewalls on servers can be just as secure as hardware firewalls when properly configured (note that hardware firewalls are generally 'easier' to get to that level, and software firewalls are 'easier' to screw up). ...


26

Source NAT changes the source address in IP header of a packet. It may also change the source port in the TCP/UDP headers. The typical usage is to change the a private (rfc1918) address/port into a public address/port for packets leaving your network. Destination NAT changes the destination address in IP header of a packet. It may also change the ...


25

There's nothing wrong with creating access mechanisms for hosts in the DMZ to access hosts in the protected network when this is necessary to accomplish your intended result. It's, perhaps, not preferable to do so, but sometimes it's the only way to get the job done. The key things to consider are: Limit the access to the most specific firewall rule you ...


24

A DDOS (or even a DOS), in its essence, is a resource exhaustion. You will never be able to eliminate bottlenecks, as you can only push them farther away. On AWS, you are lucky because the network component is very strong - it would be very surprising to learn that the upstream link was saturated. However, the CPU, as well as disks I/O, are way easier to ...


24

ICMP is used for a range of diagnostic (eg ping, traceroute) and network control (eg PMTU discovery) functions. Indiscriminate blocking of ICMP causes other people all sorts of heartburn, and unless you know exactly what you're doing, you should leave it alone.


23

Specifically TCP 9418, no need for UDP. Reference.


23

rpcinfo -p | grep nfs Port 111 (TCP and UDP) and 2049 (TCP and UDP) for the NFS server. There are also ports for Cluster and client status (Port 1110 TCP for the former, and 1110 UDP for the latter) as well as a port for the NFS lock manager (Port 4045 TCP and UDP). Only you can determine which ports you need to allow depending on which services are needed ...


23

What HopelessN00b said. I just wanted to add that: I have a friend with a job at a government agency where she isn't allowed to bring a cellphone with a camera to the office. She usually phrases that as, "I'm not allowed to own a cellphone with a camera," because, well. If she can't take her cell with her, why own one? She has trouble finding cellphones ...


22

!X means "communication administratively prohibited" and !Z "communication with destination host administratively prohibited" As far as I remember, you get !X on ipv4 and !Z on ipv6 and it should be documented in the man (8) pages. Since Linux uses UDP for trace-routes, this can originate from a --reject-with icmp-host-prohibited rule at the destination. ...


22

By default Windows 2008 does not respond to pings. To enable: Administrative Tools Windows Firewall with Advanced Security Inbound Rules File and Printer Sharing (Echo Request - ICMPv4-IN) Enable Rule You should now be able to ping your server from the LAN.



Only top voted, non community-wiki answers of a minimum length are eligible