Tag Archives: ACCEPT

iptables not logging

February 16, 2013 Bartle Doo Leave a comment

I need to log iptables to see what ports are being dropped. I followed this article and several others I looked at via Google, but it’s still not working.

Red Hat Magazine | How do I add logging for iptables using the /etc/sysconfig/iptables file for Red Hat Enterprise Linux4?

I added the following entry to my /etc/sysconfig/iptables file just before the last COMMIT line:

Code:

-A RH-Firewall-1-INPUT -p tcp --dport 443 -j ACCEPT #example# 

-A RH-Firewall-1-INPUT -j LOG

COMMIT

I’ve also tried it as shown:

Code:

-A RH-Firewall-1-INPUT -p tcp --dport 443 -j ACCEPT #example# 

#log

-A RH-Firewall-1-INPUT -j LOG

#drop all other packets

-A RH-Firewall-1-INPUT -j DROP 

COMMIT

My problem is when I got to /var/log/messages I don’t see it logging anything whatsoever from iptables.

I also added the following to /etc/syslog.conf:

Code:

kern.* /var/log/debug

Still no matter what I do no information shows up in any log files, and I’ve tried numerous ports on this host that I know aren’t opened in iptables from another test host in hopes that I would see it logging the dropped connection attempts, but nothing I’ve done will log anything whatsoever.

I’ve also tried using this article for advise, but still nothing I do works:
Example iptables firewall

Any advise would be greatly appreciated. This is on Red Hat Enterprise 5.7. Every time I make these changes I of course restart the iptables and syslog services.

Linux

Using iptables to block all ip addresses except a few

February 10, 2013 Bartle Doo Leave a comment

By Louisa Martin

Hi,

I’ve literally just started using Putty – so I’m most definitely a dummy!

I’ve been told by the people who provide our server that we need to use iptables to block bruteforce attacks!

I’ve been looking around the internet for instructions on how to do this, can I just check with somebody that I’m about to do the right thing please?

Once I’ve logged into putty for ssh access I type the following commands –

1) iptables -P INPUT DROP (in case I lock myself out – although I’m not sure what this means!)

2) iptables -P INPUT DROP (to prevent all IP addresses from getting access)

3) iptables -A INPUT -s 193.167.0.4 -j ACCEPT (to give IP address 193.167.0.4 access)

4) repeat (3) for all IP addresses who should have access.

Once I’ve done this am I right in thinking that plesk will only be able to connect to the server from one of the approved IP addresses? Or is it just Putty etc that will only be able to make a connection from approved IPs?

I’m sure I sound like a complete plonker, it’s all double dutch at the moment! Thank you in advance for any help!

Kind regards,

Louisa

Linux

How to establish site to site vpn – Linux machine and cisco asa?

January 30, 2013 Bartle Doo Leave a comment

By ashokvpp

Hi,

I am trying to establish vpn between my linux server and cisco asa at client side.

I installed openswan on my cent os.

Linux Server

Code:

eth0 - 182.2.29.10    [ I have public IP]
Gateway - 182.2.29.1 [ and gw]
eth1 - 192.9.200.75  [ Internal Lan i/f]

I have simple IPtables Like

WAN="eth0"

LAN="eth1"

 iptables -t nat -A POSTROUTING -o $WAN -j SNAT --to 182.2.29.10

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i $LAN -j ACCEPT

iptables -A INPUT -i $WAN -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT

iptables -A FORWARD -i $LAN -j ACCEPT

iptables -A FORWARD -i $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 192.9.200.0/255.255.255.0 -j ACCEPT

iptables -A FORWARD -d 192.9.200.0/255.255.255.0 -j ACCEPT

iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

Client side Cisco ASA – Device

Code:

Provided details :

BD gateway ip is 212.2.7.15 [ Public IP] Source IP :- 192.168.91.224 ESP-3DES-SHA1 Lifetime is 86400 seconds (Phase-1) & 3600 seconds (Phase-2) Authentication is pre-shared

I need advise on configuring ipsec.conf and ipsec.secrets and what IP tables rules I need to add / modify.

Thanks

Best
Ashok

Source: FULL ARTICLE at The UNIX and Linux Forums

Linux

Sol10 – OpenLDAP Auth

January 30, 2013 Bartle Doo Leave a comment

By Panzerkampfwagn

Hi,

im new to Solaris (10) and need some help please.

Situation: Actually is there a Linux (SLES11) OpenLDAP-Server and authentification of Linux-Maschines works pretty sweet. Now i want to put the SOL10 (Sparc) boxes in….

Problem: User Authentification via OpenLDAP on Sol10 doesn´t work now (SSH-Login Screen comes, but if i enter the password, “Access denied”)

Works (on Sol10-Ldap-Client):

getent passwd (lists all local and ldap-users)
ldaplist -vl (shows ou-entries)
su – ldapuser (user is only in ldap! works great…)
ldapsearch etc.. (all fine)

Configuration:

Native Client on Sol10:
- ldapclient -v manual
  -a defaultServerList=10.16.0.37
  -a domainname=example.de
  -a defaultSearchBase=dc=example,dc=de
  -a serviceSearchDescriptor=group:dc=example,dc=de?sub
  -a serviceSearchDescriptor=passwd:dc=example,dc=de?sub
  -a serviceSearchDescriptor=shadow:dc=example,dc=de
  -a enableShadowUpdate=TRUE
  -a adminDN=cn=manager,dc=example,dc=de
  -a attributeMap=group:memberuid=memberUid
  -a attributeMap=group:gidnumber=gidNumber
  -a adminPassword=blaselfasel
  -a attributeMap=passwd:gidnumber=gidNumber
  -a attributeMap=passwd:uidnumber=uidNumber
  -a attributeMap=passwd:loginshell=loginShell
  -a attributeMap=shadow:shadowflag=shadowFlag
  -a attributeMap=shadow:userpassword=userPassword

pam.conf on Sol10:
- # login service (explicit because of pam_dial_auth)
  login auth requisite pam_authtok_get.so.1
  login auth required pam_dhkeys.so.1
  login auth required pam_unix_cred.so.1
  login auth required pam_unix_auth.so.1
  login auth required pam_dial_auth.so.1

# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for #authentication
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth required pam_unix_auth.so.1

# Used when service name is not explicitly mentioned for account management

other account requisite pam_roles.so.1
other account required pam_unix_account.so.1
other session required pam_unix_session.so.1

# Default definition for Password management

# Used when service name is not explicitly mentioned for password management
#
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1 force_check
other password required pam_authtok_store.so.1

Logfile (Linux Openldap-Server):

slapd[15449]: conn=1461 op=10 SRCH base=”dc=example,dc=de” scope=2 deref=3 filter=”(&(objectClass=posixAccount)(uid=ldapuser))”
[15449]: conn=1461 op=10 SRCH attr=cn uid uidNumber gidNumber gecos description homedirectory loginShell
slapd[15449]: conn=1461 op=10 SEARCH RESULT tag=101 err=0 nentries=1 text=
slapd[15449]: conn=1473 fd=28 ACCEPT from IP=10.16.0.70:33030 (IP=0.0.0.0:389)
slapd[15449]: conn=1473 op=0 BIND dn=”” method=128
slapd[15449]: conn=1473 op=0 RESULT tag=97 err=0 text=
slapd[15449]: conn=1473 op=1 SRCH base=”dc=example,dc=de” scope=1 deref=3 filter=”(&(objectClass=shadowAccount)(uid=ldapuser))”
slapd[15449]: conn=1473 op=1 SRCH attr=uid userPassword shadowlastchange shadowmin shadowmax shadowwarning shadowinactive shadowexpire shadowFlag
slapd[15449]: conn=1473 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=
slapd[15449]: conn=1473 op=2 UNBIND
slapd[15449]: conn=1473 fd=28 closed
slapd[15449]: conn=1461 op=11 SRCH base=”dc=example,dc=de” scope=2 deref=3 filter=”(&(objectClass=posixAccount)(uid=ldapuser))”
slapd[15449]: conn=1461 op=11 SRCH attr=cn uid uidNumber gidNumber gecos description homedirectory loginShell
slapd[15449]: conn=1461 op=11 SEARCH RESULT tag=101 err=0 nentries=1 text=
slapd[15449]: conn=1474 fd=28 ACCEPT from IP=10.16.0.70:33031 (IP=0.0.0.0:389)
slapd[15449]: conn=1474 op=0 BIND dn=”” method=128
slapd[15449]: conn=1474 op=0 RESULT tag=97 err=0 text=
slapd[15449]: conn=1474 op=1 SRCH base=”dc=example,dc=de” scope=1 deref=3 filter=”(&(objectClass=shadowAccount)(uid=ldapuser))”
slapd[15449]: conn=1474 op=1 SRCH attr=uid userPassword shadowlastchange shadowmin shadowmax shadowwarning shadowinactive shadowexpire shadowFlag
slapd[15449]: conn=1474 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=
slapd[15449]: conn=1474 op=2 UNBIND
slapd[15449]: conn=1474 fd=28 closed
slapd[15449]: conn=1461 op=12 SRCH base=”dc=example,dc=de” scope=2 deref=3 filter=”(&(objectClass=posixAccount)(uid=ldapuser))”
slapd[15449]: conn=1461 op=12 SRCH attr=cn uid uidNumber gidNumber gecos description homedirectory loginShell
slapd[15449]: conn=1461 op=12 SEARCH RESULT tag=101 err=0 nentries=1 text=

Entry on LDAP-Server (Linux):

uid: ldapuser
cn: ldapuser GB
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {CRYPT}GHGf1nI9tpFRE
uidNumber: 5000
gidNumber: 1
loginShell: /usr/bin/bash
homeDirectory: /export/home/ldapuser

Slapd.conf:

include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/yast.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/sudo.schema
include /etc/openldap/schema/ldapns.schema
include /etc/openldap/schema/autofs.schema
include /etc/openldap/schema/solaris.schema
include /etc/openldap/schema/duaconf.schema

——————————————–
Any ideas? 🙁

Source: FULL ARTICLE at The UNIX and Linux Forums

Linux

OpenLDAP Server Configuration error

January 24, 2013 Bartle Doo Leave a comment

By aninmuk

I followed the guide from the below link to set up a ldap server. After everything is finished, I configured a client for ldap authentication and I can search the entries in ldap using the command
ldapsearch -x ZZ but when I am trying to login to the client using a ldap user, the prompt just keeps waiting. I found the below log from the ldap server side.

Log for successful search from client side

Jan 24 11:34:00 server3 slapd[11086]: conn=1012 fd=19 ACCEPT from IP=:22759 (IP=0.0.0.0:389)
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 op=0 BIND dn=”” method=128
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 op=0 RESULT tag=97 err=0 text=
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 op=1 SRCH base=”” scope=2 deref=0 filter=”(objectClass=*)”
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 op=1 SRCH attr=ZZ
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 op=1 SEARCH RESULT tag=101 err=0 nentries=6 text=
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 op=2 UNBIND
Jan 24 11:34:00 server3 slapd[11086]: conn=1012 fd=19 closed

Log for unsuccessful ldap user login from client side

Jan 24 11:35:23 server3 slapd[11086]: conn=1013 fd=19 ACCEPT from IP=:53501 (IP=0.0.0.0:389)
Jan 24 11:35:23 server3 slapd[11086]: conn=1013 op=0 EXT oid=1.3.6.1.4.1.1466.20037
Jan 24 11:35:23 server3 slapd[11086]: conn=1013 op=0 STARTTLS
Jan 24 11:35:23 server3 slapd[11086]: conn=1013 op=0 RESULT oid= err=0 text=

Guide Link
http://cheenu-y2k.blogspot.in/2011/0…r-configuratio

Source: FULL ARTICLE at The UNIX and Linux Forums

Linux

I have firewall rules to open ports, why telnet refuses connection?

January 10, 2013 Bartle Doo Leave a comment

By RedSpyder

Alright… this question comes from the fact that I’m trying to setup postfix to relay messages to Office 365 SMTP but its giving me connection refused… I read that if you have doubts if your port is open or not you should telnet to them so thats what I did.

This is a Red Hat 6.3 box.

My IP Table:

Code:

# Generated by iptables-save v1.4.7 on Fri Nov 16 14:20:30 2012

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [2755:248833]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT

-A INPUT -i eth0 -p tcp -m tcp --sport 21 -m state --state NEW -j ACCEPT

-A INPUT -i eth0 -p tcp -m tcp --sport 20 -m state --state NEW -j ACCEPT

-A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT

-A INPUT -m state --state NEW -p tcp --dport 23 -j ACCEPT

-P OUTPUT ACCEPT

-A OUTPUT -m state --state NEW -p tcp --dport 587 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

Output of

Code:

iptables -L -n

Code:

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0

ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:21 state NEW

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:20 state NEW

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:23

REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:587

My telnet attempts:

Code:

[root@isvahlrtk01 logs]# telnet isvahlrtk01 587

Trying 127.0.0.1...

telnet: connect to address 127.0.0.1: Connection refused

Trying 10.13.24.209...

telnet: connect to address 10.13.24.209: Connection refused

[root@isvahlrtk01 logs]# telnet isvahlrtk01 25

Trying 127.0.0.1...

telnet: connect to address 127.0.0.1: Connection refused

Trying 10.13.24.209...

telnet: connect to address 10.13.24.209: Connection refused

[root@isvahlrtk01 logs]# telnet isvahlrtk01 23

Trying 127.0.0.1...

telnet: connect to address 127.0.0.1: Connection refused

Trying 10.13.24.209...

telnet: connect to address 10.13.24.209: Connection refused

[root@isvahlrtk01 logs]# telnet isvahlrtk01 22

Trying 127.0.0.1...

Connected to isvahlrtk01.

Escape character is '^]'.

SSH-2.0-OpenSSH_5.3

Even though I have rules for ports 587,25,23… why can I only telnet succesfully only on port 22?

Arent I supposed to telnet all them correctly since I have firewall rules?
Could it be that my company is blocking those ports in THEIR firewall?

Source: FULL ARTICLE at The UNIX and Linux Forums

Bartle Doo Article Archives

Tag Archives: ACCEPT

iptables not logging

Using iptables to block all ip addresses except a few

Sol10 – OpenLDAP Auth

OpenLDAP Server Configuration error

Articles Archive