1

Let me start off by saying that I'm a Centos newby, so all info, links and suggestions are very welcome!

I recently set up a hosted server with Centos 6 and configured it as a webserver. The websites running on it are nothing special, just some low traffic projects. I tried to configure the server as default as possible, but I like it to be secure as well (no ftp, custom ssh port).

Getting my Wordpress to run as desired, I'm running into some connection problems. 2 things are not working:

  • installing plugins and updates through ssh2 (failed to connect to localhost:sshportnumber)
  • sending emails from my site using the Gmail smtp (Failed to connect to server: Permission denied (13))

I have the feeling that these are both related to the iptables configuration, because I've tried everything else (I think). I tried opening up the firewall to accept traffic for ports 465 (gmail smtp) and ssh port (lets say this port is 8000), but both the issues remain. Ssh connections from the terminal are working fine though. After each change I tried implementing I restarted the iptables service.

This is my iptables configuration (using vim):

# Generated by iptables-save v1.4.7 on Sun Jun  1 13:20:20 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 8000 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 465 -j ACCEPT
COMMIT
# Completed on Sun Jun  1 13:20:20 2014

Are there any (obvious) issues with my iptables setup considering the above mentioned issues? Saying that the firewall is doing exactly nothing in this state is also an answer...

And again, if you have any other suggestions for me to increase security (considering the basic things I do with this box), I would love hear it, also the obvious ones!

Thanks!

2 Answers 2

1

I've noticed that your default policy for the OUTPUT chain is ACCEPT. As such, in the absence of any DROP or REJECT rule at the bottom of the OUTPUT chain, your wordpress iptables rules allow all traffic to egress on any port.

So to clarify..in your above configuration, all traffic is allowed through the OUTPUT chain.

Check for selinux AVC denials in /var/log/audit/audit.log as permission denied might indicate that httpd cannot connect to the SMTP network port to send email.

In any case, you should also check /var/log/maillog to see if you're being denied permission there, and of course ensure that postfix/sendmail are actually running and available locally.

In the case of you not being able to install plugins, etc. This will almost certainly be a wordpress file permissions issue, which you can look into in the link below.

Hope this helps, while I appreciate your question is somewhat old, it does register highly in google for the subject, so perhaps this might help someone else.

0

personally I have a shell script in my root folder which I can run to add my iptables rules, I just update it as and when I need new rules adding then run the script, I also have one to open all the ports up to see if there is a firewall issue causing me problems (this is my personal server with nothing business critical on it, I don't recommend you open up all your ports for any length of time if there is anything worth stealing on there).

But if you are able to test, I would recommend you save this locally on the machine (root folder is a good place IMO as root should be the only one who can see the files and then set it's permissions to 700 (chmod 700 filename.sh - I call mine firewall.sh and firewallopen.sh)):

#!/bin/bash
#
# iptables config script
#
# Flush all current rules from iptables
#
 iptables -F
#
 iptables -P INPUT ACCEPT
 iptables -P FORWARD ACCEPT
 iptables -P OUTPUT ACCEPT
#
# Set access for localhost
#
 iptables -A INPUT -i lo -j ACCEPT
#
# Accept packets belonging to established and related connections
#
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Save settings
#
 /sbin/service iptables save
#
# List rules
#
 iptables -L -v

Then create a similar file to lock your server down (I drop all the rules at the start of the script to ensure no unexpected results - note I accept all outgoing connections from my server):

#!/bin/bash
#
# iptables config script
#
# Flush all current rules from iptables
#
echo "Clearing old rules"
 iptables -F
#
echo "Adding new rules"
# Example rules
# Allow SSH connections on tcp port 22
 iptables -A INPUT -p tcp --dport 22 -j ACCEPT -m comment --comment "SSH"

# Set default policies for INPUT, FORWARD and OUTPUT chains
#
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT
#
# Set access for localhost
#
 iptables -A INPUT -i lo -j ACCEPT
#
# Accept packets belonging to established and related connections
#
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Save settings
#
 /sbin/service iptables save
#
# List rules
#
 iptables -L -v

Any similar rules you want to set up you can add in this file, I tend to comment everything to ensure I don't have a brain fart when I return to it later.

Once you have both scripts, you can easily and quickly turn your firewall on and off and then test whether the problem continues after you have disabled the firewall. You can then easily turn it back on again afterwards.

One very important thing to consider on CentOS is Security Enhanced (SE) Linux, it's a powerful tool when used correctly, but can tend to cripple you when setting up a system for the first time, if disabling your firewall doesn't fix the issue I would try disabling selinux as well to test (if this solves your issue then you can either leave SE Linux disabled, which would be less secure, or you can look in to building your own SE linux policy with audit2allow)

To disabled SE Linux:

setenforce 0

You will probably need to restart you web host service as well at the same time (assuming you're using httpd/apache):

service httpd restart

Then you can retest, to turn back on, simply:

setenforce 1

I hope this helps :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .