Hot answers tagged

41

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it. Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns. Try last -a to display the hostname on the last column without truncation. or ...


11

In general: Viewing and modifying the firewall configuration requires administrator privileges (root) as does opening services in the restricted port number range. That means that you should either be logged in as root or alternatively use sudo to run the command as root. I'll try to mark such commands with the optional [sudo]. Contents: Order matters or ...


11

You don't need ssh access, Digital Ocean provide console access to your system. You can use this to log in and fix your rules. To access the console click Droplets -> Name of your system, this will take you to a page with a large friendly blue button called Console Access. Click the blue button to get a console. Once you're in, you can change the rules ...


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


8

This is almost nothing to do with being on an ESXi host - it's a routing issue - you just need two separate VLAN coming from your router, both of which have external routes out and no routing between them. Then simply trunk these VLANs to your ESXi uplinks and create two VLAN tagged port groups in you vSwitch/es. It's as simple as that.


6

Common issues with different protocols DNS: DNS uses port 53 UDP by default, but messages that won't fit in a single UDP datagram will be transmitted using TCP instead (typically zone transfers and such) requiring port 53 TCP to be opened as well when you run a name server. Email: Many consumer ISP's block SMTP traffic (or at least the default port TCP ...


6

The -i makes 'last' show the remote hostname in dots and numbers IP address format instead of trying to display the hostname. I am not sure what the '.d' suffix is, nor can I find out anything on google. I can only guess it is trying to do a reverse lookup and is giving you part of a hostname and truncating it, although i thought you must specify -d to do ...


6

Your 'when' column is telling me that ntp last chatted with those servers at best 40 minutes ago, yet your poll interval is 1024 seconds (~17 minutes). ntp does not seem to be running properly, which makes sense given your firewall configuration. You'll need an outbound and an inbound allow rule for UDP 123. The inbound is needed since UDP is stateless. ...


6

ufw firewall, by default, denies any incoming connection (and allows any outgoing ones). You would have to connect your server to a display (since you cannot access remotely with the firewall), and follow these steps: sudo ufw disable --> Now you can access your server by ssh if you prefer sudo ufw allow from <specific ip/subnet> to any port <port ...


6

With the -p tcp option the tcp module is already loaded and therefor it is somewhat redundant and not a must to use the -m tcp option and I don't see any reason why using this option would make the rule more secure. Please see the iptables man page for a better understanding and comparison: -p, --protocol [!] protocol The protocol of the rule or ...


6

Remember that localhost (127.0.0.1) is the loopback interface on the system. If someone can snoop traffic on that interface, they are already on your system so you have worse problems to deal with.


5

There is no charge for the Google Compute Engine ingress traffic. Take a look at GCE network pricing. If you've been charged for the ingress traffic, you can contact the Cloud billing team to clarify and fix the charge. Regarding the requests to port 11, as far as this port is blocked in your GCE network's firewall your VM instances should be safe and the ...


5

The answer is way more complicated than ASN 15169. First Google has more than one ASN: 15169 Google Inc. 16591 Google Fiber Inc. 36039 Google Inc. 36040 Google Inc. 36384 Google Incorporated 36492 Google, Inc. 41264 Google Switzerland GmbH Second, Google, Akamai, etc use IP ranges of their partner ASNs to host content. So ...


5

Schematic: ssh ssh A ------> B ------> C ^ ^ using A's using B's ssh key ssh key Preconditions: A is running ssh-agent; A can access B; B can access C; A's ssh public key is present in B:~/.ssh/authorized_keys B's ssh public key is present in C:~/.ssh/authorized_keys In ~/.ssh/config on A, add Host C ...


5

Actually the ports you mentionned, 465, 995 and 993 are deprecated and should no more be used. See RFC2995 section 7 imaps and pop3s ports Separate "imaps" and "pop3s" ports were registered for use with SSL. Use of these ports is discouraged in favor of the STARTTLS or STLS commands. A number of problems have been observed with separate ...


5

See line 3, 4 and 5 in INPUT chain - those rules allows any packets for any ports comming from interfaces eth0, eth1 and lo to pass. IPTables works with first-match-rule, so when packet gets first rule which allows/deny it, it is applied. You should set only rules to exact ports and reject any other traffic.


4

You're conflating a few different things here, and I suspect it's leading you to some false conclusions. HSTS ("HTTP Strict Transport Security") is (only!) about mandating that HTTPS is used for connections to specified sites. It doesn't enforce anything about which keys, certs, etc are used to authenticate the connection. Public Key Pinning specifies ...


4

Example for SSH in Interactive mode. type in bash: fail2ban-client -i then in interactive mode type: status ssh you ll get like it: Status for the jail: ssh |- Filter | |- Currently failed: 0 | |- Total failed: 6 | `- File list: /var/log/auth.log `- Actions |- Currently banned: 1 |- Total banned: 2 `- Banned IP list: 203.113.167.162 ...


4

Firewalls have two main choices when receiving unwanted connection attempts. REJECT - send a response saying the port/service/etc is closed or unavailable DROP - don't respond and just drop the packets The words REJECT/DROP aren't standard or used across all firewalls but the difference between the concepts behind the two possible actions will be ...


4

Federico is right. AWS has security groups assigned to each EC2 instance. These can be set to protocols or custom port/port ranges and set to allow your IP, custom IP or all. It'll always require a CIDR value if I recall, but if it's just you it'll tack on a /32 at the end of your IP address. Go to your main dashboard, locate the line that has your instance, ...


4

Does the order of the rules actually matter? Yes it does. Denies should be first. Example Is there a more effective way to handle spammy requests than manually fail2ban can scan logs, and add IPs to many types of filtering systems that match defined patterns.


4

4 :INPUT ACCEPT [0:0] 5 :FORWARD ACCEPT [0:0] 6 :OUTPUT ACCEPT [0:0] (snip) 11 -A RH-Firewall-1-INPUT -s 192.168.1.114/32 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT You're using an undefined chain (RH-Firewall-1-INPUT). It seems you copy/pasted the ACCEPT rules from some website without understanding what it actually does. ...


4

well if you use telnet command to check the port connectivity, it will show "connection timeout" if the port is blocked by the firewall "Connection refused" if the service is down/not listening on specified port, but port is reachable. "connected to server_ip" if connection is successful


4

Running things via VPN is essentially slower due to the additional network hops and encryption. If you must use a VPN, consider where the VPN is located (latency purposes) and the speed your getting from the connection.


4

When you set your default policy to DROP and ACCEPT only what you need, this is clearly more secure than allowing everything by default and selectively DROP unwanted traffic types. This at least saves you from securing the services that are not meant to be accessed remotely (from outside your machine or your LAN). Your system is more secure when you expose ...


4

Do not block all the outbound rule, it will not choose port 443 as a source to get data from other server. And I think blocking inbound rules are pretty enough to ensure your server security. Rest is all Good. You can use below rules if you want. iptables -F iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ...


3

I strongly suspect it's torrentz.eu doing the blocking. If I run traceroute on 185.87.147.3 from EC2 I get: traceroute to 185.87.147.3 (185.87.147.3), 30 hops max, 60 byte packets 1 216.182.224.228 (216.182.224.228) 1.424 ms 216.182.224.200 (216.182.224.200) 1.168 ms 216.182.224.228 (216.182.224.228) 1.403 ms 2 100.64.14.17 (100.64.14.17) 0.812 ms ...


3

The solution is not to deny all IPs (e.g. deny 0.0.0.0/0) but to allow only the specified static IPs or ranges. Then, the default action of CSF will be to DROP other traffic. This same principle applies to other firewalls like iptables -- as long as the default action is "DROP," then all you need is allow rules.


3

You could probably bend 'fail2ban' to your desires, using a custom filter to detect successful logins, and a custom action to add iptables rules for the detected source IP rather than banning them. It's a bit odd so you'd want some really good comments in your configuration for the next person coming along to be able to understand what on earth you were ...



Only top voted, non community-wiki answers of a minimum length are eligible