I want to lock down my centos box using iptables so that it can only make http connections to a valid centos mirror - my concern is that the IPs for the mirror sites is likely to change.

Any suggestions ?


iptables won't let you do hostname lookups so as the other commenter suggested, I would setup a proxy which syncs with the master servers and then create a custom repo file to access only your proxy.

Not really more secure though as you're still copying over whatever was on the master servers the proxy was syncing with.

If someone gains enough access to change your repo then you're already hosed because they probably have root or are able to redirect your traffic (arp spoofing). I'd make sure everything else is secure and keep the repos the way they are.

  • Good call. I'll heed your advice :) – Hilton D Jan 8 '10 at 1:50
  • I'll be testing Opendns' whitelist only feature to reduce the risk of my server resolving other sites. At least then I will know if it is requesting banned sites :) – Hilton D Feb 20 '10 at 10:35

My ISP provides a FTP mirror which contains GNU/Linux distributions as well as local update caches. Bandwidth from this server is not part of my monthly allowance.

Check if your ISP has a public mirror and if they have a local copy of the Centos yum cache.

NOTE: This assumes server running in your SOHO and not hosted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.