Solved

Linux Apache Security

Posted on 2006-07-24
8
522 Views
Last Modified: 2012-05-05
I'm noticing several attempts by unfriendly IP's to gain access to my server through SSH.  

Can anyone help me through the steps of configuring my server's firewall to block ALL IP's, except mine of course.

Thanks.
0
Comment
Question by:marcparillo
  • 4
  • 4
8 Comments
 
LVL 43

Expert Comment

by:ravenpl
ID: 17167355
For the ssh?

iptables -I INPUT -p tcp --dport ssh -m state --state NEW -j REJECT
iptables -I INPUT -p tcp -s Your.first.IP --dport ssh -m state --state NEW -j ACCEPT
iptables -I INPUT -p tcp -s Your.second.IP --dport ssh -m state --state NEW -j ACCEPT

I used -I option (which inserts rule in the fron of chain) becouse You may already have some rules allowing ssh traffic.
If used in script, change -I to -A and reverse order of calls, and put in proper place of the chain
0
 
LVL 3

Author Comment

by:marcparillo
ID: 17167453
Thanks,
Do these changes require Apache to be restarted?
0
 
LVL 3

Author Comment

by:marcparillo
ID: 17167512
And just to double-check -- this is the file I'm updating -- correct?
I would add your lines just below :RH-Firewall-1-INPUT - [0:0]

[root@ ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
0
Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

 
LVL 43

Expert Comment

by:ravenpl
ID: 17167517
No - they have nothing to do with apache. In fact ssh doen not require to be restarted neither.
They configuring Your local machine's firewall.

Note: if You want block access to apache www server, change -d ssh to -d http
0
 
LVL 43

Accepted Solution

by:
ravenpl earned 250 total points
ID: 17167538
OK, if You prefer modifying iptables config (which is good)
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.first.ip --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.second.ip --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
0
 
LVL 3

Author Comment

by:marcparillo
ID: 17167637
Thanks ravenpl --

So for the best blocking, you recommend updating this iptables config file by adding the lines:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.first.ip --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s your.second.ip --dport 22 -j ACCEPT

with the IP addresses that are friendly?

0
 
LVL 43

Expert Comment

by:ravenpl
ID: 17167948
Yes.
0
 
LVL 3

Author Comment

by:marcparillo
ID: 17168177
Thank you.
0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question