• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 537
  • Last Modified:

Linux Apache Security

I'm noticing several attempts by unfriendly IP's to gain access to my server through SSH.  

Can anyone help me through the steps of configuring my server's firewall to block ALL IP's, except mine of course.

Thanks.
0
marcparillo
Asked:
marcparillo
  • 4
  • 4
1 Solution
 
ravenplCommented:
For the ssh?

iptables -I INPUT -p tcp --dport ssh -m state --state NEW -j REJECT
iptables -I INPUT -p tcp -s Your.first.IP --dport ssh -m state --state NEW -j ACCEPT
iptables -I INPUT -p tcp -s Your.second.IP --dport ssh -m state --state NEW -j ACCEPT

I used -I option (which inserts rule in the fron of chain) becouse You may already have some rules allowing ssh traffic.
If used in script, change -I to -A and reverse order of calls, and put in proper place of the chain
0
 
marcparilloAuthor Commented:
Thanks,
Do these changes require Apache to be restarted?
0
 
marcparilloAuthor Commented:
And just to double-check -- this is the file I'm updating -- correct?
I would add your lines just below :RH-Firewall-1-INPUT - [0:0]

[root@ ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
ravenplCommented:
No - they have nothing to do with apache. In fact ssh doen not require to be restarted neither.
They configuring Your local machine's firewall.

Note: if You want block access to apache www server, change -d ssh to -d http
0
 
ravenplCommented:
OK, if You prefer modifying iptables config (which is good)
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.first.ip --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.second.ip --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
0
 
marcparilloAuthor Commented:
Thanks ravenpl --

So for the best blocking, you recommend updating this iptables config file by adding the lines:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.first.ip --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.second.ip --dport 22 -j ACCEPT

with the IP addresses that are friendly?

0
 
ravenplCommented:
Yes.
0
 
marcparilloAuthor Commented:
Thank you.
0

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

  • 4
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now