Hot answers tagged

208

In today's internet this is quite normal sadly. There are hordes of botnets trying to login to each server they find in whole IP networks. Typically, they use simple dictionary attacks on well-known accounts (like root or certain applications accounts). The attack targets are not found via Google or DNS entries, but the attackers just try every IP address ...


98

ICMP is way, way more than "traceroute" and "ping." It is used for feedback when you run a DNS server (port unreachable) which, in a modern DNS server, may actually help select a different machine to query faster. ICMP is also, as was mentioned above, used for path MTU discovery. Chances are your OS sets "DF" (don't fragment) on TCP packets it sends. It ...


78

I note that you've done a great job tying down several different daemons, and from what you've said I think it unlikely that you'll expose yourself to trouble through those services you have already secured. This still leaves you in a "everything is permitted except that which I have forbidden" state, and you can't get out of that state by hunting down ...


71

Since you are on the Windows machine, these things can be done, Execute the following command and look for a ":3306" listener (you did not mention UDP/TCP). This will confirm there is something running on the port. netstat -a -n After this, if you are expecting incoming connections on this port and feel that the firewall may be blocking them, you could ...


71

With Fail2Ban before v0.8.8: fail2ban-client get YOURJAILNAMEHERE actionunban IPADDRESSHERE With Fail2Ban v0.8.8 and later: fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE The hard part is finding the right jail: Use iptables -L -n to find the rule name... ...then use fail2ban-client status to get the actual jail names. The rule name ...


70

You basically have three options here. 1. Disconnect your office/users from the internet If they can't get to "the public cloud," they can't upload anything to it. 2. Compile a blacklist of specific services you're worried about users accessing. This is going to be absolutely massive if it's meant to be even remotely effective. Tech-savvy users ...


60

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see if you can boot the VM to a recovery linux CD (some providers offer this) and then correct the firewall rules that way and then boot it like normal. If you ...


59

A few 100 is just fine... Last month I found one of my servers had 40k failed attempts. I went trough the trouble of plotting them: Map Once I changed the ssh port and implemented Port Knocking, the number dropped to 0 :-)


58

Since v0.8.8 there is the unbanip option (actionunban isn't for this purpose) It can be triggered by the set command, if you look at the list of options, you will see the syntax is. So it will be (by heart, please check): fail2ban-client set ssh-iptables unbanip IPADDRESSHERE more generic: fail2ban-client set JAILNAMEHERE unbanip IPADDRESSHERE works ...


53

IPv6 gets rid of NAT, which has certainly been a large part of avoiding accidental exposure of services to the internet from internal hosts.. so in that way, yes, it's a change to how most everyone is doing things. However, it doesn't at all mean that you won't still have a central firewall at the network edge - the change is simply that it'll be acting as ...


50

Obligatory: installation of system with expert mode, only packages that I need hand written firewall with default policy on iptables'input: drop, permitting access to SSH, HTTP or whatever else given server is running Fail2Ban for SSH [ and sometimes FTP / HTTP / other - depending on context ] disable root logins, force using normal user and sudo custom ...


50

As a general rule, use REJECT when you want the other end to know the port is unreachable' use DROP for connections to hosts you don't want people to see. Usually, all rules for connections inside your LAN should use REJECT. For the Internet, With the exception of ident on certain servers, connections from the Internet are usually DROPPED. Using DROP ...


47

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.


46

PREROUTING isn't used by the loopback interface, you need to also add an OUTPUT rule: iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080 iptables -t nat -I OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8080


44

Advantages of firewall: You can filter outbound traffic. Layer 7 firewalls (IPS) can protect against known application vulnerabilities. You can block certain IP range and/or port centrally rather than trying to ensure that there is no service listening on that port on each individual machine or denying access using TCP/Wrappers. Firewalls can help if you ...


44

rpcinfo -p | grep nfs Port 111 (TCP and UDP) and 2049 (TCP and UDP) for the NFS server. There are also ports for Cluster and client status (Port 1110 TCP for the former, and 1110 UDP for the latter) as well as a port for the NFS lock manager (Port 4045 TCP and UDP). Only you can determine which ports you need to allow depending on which services are needed ...


41

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it. Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns. Try last -a to display the hostname on the last column without truncation. or ...


40

It depends on the repository. The native git transport uses TCP port 9418. However, git can also run over ssh (often used for pushing), http, https, and less often others. You can look at the repository URL to find out which port it uses. Notice that many public repositories have several alternate URLs; for instance, the kernel.org repositories have git://,...


39

Use the -I switch: sudo iptables -I INPUT 1 -i lo -j ACCEPT This would insert a rule at position #1 in the INPUT chain.


37

Source NAT changes the source address in IP header of a packet. It may also change the source port in the TCP/UDP headers. The typical usage is to change the a private (rfc1918) address/port into a public address/port for packets leaving your network. Destination NAT changes the destination address in IP header of a packet. It may also change the ...


37

Specifically TCP 9418, no need for UDP. Reference.


36

I think you acknowledge an interesting sys-admin truth there, which is that unless you can reduce the probability of being hacked to zero then eventually, at some point, you are going to get hacked. This is just a basic truth of maths and probability, that for any non-zero probability of an event. The event eventually happens... So the 2 golden ...


32

A DDOS (or even a DOS), in its essence, is a resource exhaustion. You will never be able to eliminate bottlenecks, as you can only push them farther away. On AWS, you are lucky because the network component is very strong - it would be very surprising to learn that the upstream link was saturated. However, the CPU, as well as disks I/O, are way easier to ...


31

TCP Wrappers could be arguably called a host-based firewall implementation; you're filtering network traffic. For the point on an attacker making outbound connections on an arbitrary port, a firewall would provide a means of controlling outgoing traffic as well; a properly configured firewall manages ingress and egress in a way which is appropriate to the ...


31

!X means "communication administratively prohibited" and !Z "communication with destination host administratively prohibited" As far as I remember, you get !X on ipv4 and !Z on ipv6 and it should be documented in the man (8) pages. Since Linux uses UDP for trace-routes, this can originate from a --reject-with icmp-host-prohibited rule at the destination. ...


30

In my Ubuntu 11 server, the firewall rules are saved in /lib/ufw/user.rules


30

There is no way to block it completely, of course, unless the corporate network were to be disconnected from the Internet. If you really want something that should work most of the time while being mostly transparent, you'll need to deep-sniff packets. Set up a man-in-the-middle SSL/TLS proxy, as well as one for unencrypted communication, and block all ...


30

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.


29

By default Windows 2008 does not respond to pings. To enable: Administrative Tools Windows Firewall with Advanced Security Inbound Rules File and Printer Sharing (Echo Request - ICMPv4-IN) Enable Rule You should now be able to ping your server from the LAN.


29

To answer your question succinctly, no: there would not be any "leftover" rules after flushing every table. In the interest of being thorough however, you may want to set the policy for the built-in INPUT and FORWARD chains to ACCEPT, as well: iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -F iptables -t mangle ...



Only top voted, non community-wiki answers of a minimum length are eligible