Extending Perfect Server - Debian Squeeze [ISPConfig 3] - Page 5

Want to support HowtoForge? Become a subscriber!
 
Submitted by 8omas (Contact Author) (Forums) on Fri, 2011-03-11 00:18. ::

11. Hardening you system

First of all, make sure that you have set the security level to High, in Server Config - Web (tab) of ISPConfig3 panel.

The following instructions are just a demostration. Please fully understand them (by reading documentation over the Internet), before you apply and use them.

In general, if you follow them, you can rate limit traffic on specific ports, reduce syn connections and prevent intrusions that use known bad packets. To apply them create the folder /root/scripts (if it doesn't exist) and the following 5 files. (loadfw, unloadfw, IPs, fwrules and reloadfail2ban). The first will contain the script to load the rules, the second the script to unload the rules, the third will contain the "BAD" IPs and the "BAD" networks, the fourth the custom rules and the fifth some commands to reload eveything (including fail2ban).

mkdir /root/scripts
touch /root/scripts/loadfw
touch /root/scripts/unloadfw
touch /root/scripts/IPs
touch /root/scripts/fwrules
touch /root/scripts/reloadfail2ban
cd /root/scripts
nano loadfw

Paste the following:

#!/bin/bash
# Simple iptables IP/subnet load script
# ----------------------------------------------------------

cd /root/scripts/

IPT=/sbin/iptables
DROPMSG="fwBLOCKED "
BADIPS=$(egrep -v -E "^#|^$" /root/scripts/IPs)

while read fwrule
do
$IPT -I INPUT $fwrule

done < /root/scripts/fwrules

for ipblock in $BADIPS
do
$IPT -I INPUT -s $ipblock -j DROP
$IPT -I INPUT -s $ipblock -j LOG --log-prefix "$DROPMSG"
done

Edit unloadfw:

nano unloadfw

Paste the following:

#!/bin/bash
# Simple iptables IP/subnet unload script
# ---------------------------------------------------------


cd /root/scripts/

IPT=/sbin/iptables
DROPMSG="fwBLOCKED "
BADIPS=$(egrep -v -E "^#|^$" /root/scripts/IPs)

while read fwrule
do
$IPT -D INPUT $fwrule

done < /root/scripts/fwrules
for ipblock in $BADIPS
do
$IPT -D INPUT -s $ipblock -j DROP
$IPT -D INPUT -s $ipblock -j LOG --log-prefix "$DROPMSG"done

Edit IPs:

nano IPs

Paste the annoying IPs (e.g. IPs banned multiple times by fail2ban) or whole networks. You can add here IPs or netwroks at any time, but before you make any modification (especially if you remove sth) you have to run "/root/scripts/unloadfw". Afterward you can edit the file, inserting IPs or networks and finally you have to run "/root/scripts/loadfw" (see below)

#IP
x.y.z.w
x.q.a.r

#netwroks
d.r.t.h/24

#mailservers
a.g.h.j

(You can use http://www.countryipblocks.net to see the networks that are assosiated with each country). Edit fwrules:

nano fwrules

Paste the following (and anything else that can be inserted (-I) or deleted (-D) in/from INPUT chain. The rules are for servers with a single network interface (eth0). Please change them to fit your needs (e.g. change eth0 if your network interface is different).

-p tcp --dport 50022 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw50022 -j DROP
-p tcp --dport 50022 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw50022 -j LOG --log-prefix "LMfwport50022"
-p tcp --dport 50022 -i eth0 -m state --state NEW -m recent --set --name fw50022
-p tcp --dport 50000 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw50000 -j DROP
-p tcp --dport 50000 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw50000 -j LOG --log-prefix "LMfwport50000"
-p tcp --dport 50000 -i eth0 -m state --state NEW -m recent --set --name fw50000
-p tcp --dport 10000 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw10000 -j DROP
-p tcp --dport 10000 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw10000 -j LOG --log-prefix "LMfwport10000"
-p tcp --dport 10000 -i eth0 -m state --state NEW -m recent --set --name fw10000
-p tcp --dport 25 -i eth0 -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 20 --name fw25 -j DROP
-p tcp --dport 25 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 --name fw25 -j LOG --log-prefix "LMfwport25"
-p tcp --dport 25 -i eth0 -m state --state NEW -m recent --set --name fw25
-p tcp --dport 110 -i eth0 -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 20 --name fw110 -j DROP
-p tcp --dport 110 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 --name fw110 -j LOG --log-prefix "LMfwport110"
-p tcp --dport 110 -i eth0 -m state --state NEW -m recent --set --name fw110
-p tcp --dport 50443 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw50443 -j DROP
-p tcp --dport 50443 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw50443 -j LOG --log-prefix "LMfwport50443"
-p tcp --dport 50443 -i eth0 -m state --state NEW -m recent --set --name fw7443
-p tcp --dport 22 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw22 -j DROP
-p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw22 -j LOG --log-prefix "LMfwport22"
-p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set --name fw22
-p tcp --dport 20 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw20 -j DROP
-p tcp --dport 20 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw20 -j LOG --log-prefix "LMfwport20"
-p tcp --dport 20 -i eth0 -m state --state NEW -m recent --set --name fw20
-p tcp --dport 21 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw21 -j DROP
-p tcp --dport 21 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw21 -j LOG --log-prefix "LMfwport21"
-p tcp --dport 21 -i eth0 -m state --state NEW -m recent --set --name fw21
-p tcp --dport 143 -i eth0 -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 20 --name fw143 -j DROP
-p tcp --dport 143 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 --name fw143 -j LOG --log-prefix "LMfwport143"
-p tcp --dport 143 -i eth0 -m state --state NEW -m recent --set --name fw143
-p tcp --dport 53 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw53 -j DROP
-p tcp --dport 53 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw53 -j LOG --log-prefix "LMfwport53"
-p tcp --dport 53 -i eth0 -m state --state NEW -m recent --set --name fw53
-p tcp --dport 443 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw443 -j DROP
-p tcp --dport 443 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw443 -j LOG --log-prefix "LMfwport443"
-p tcp --dport 443 -i eth0 -m state --state NEW -m recent --set --name fw443
-p tcp --dport 8081 -i eth0 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 20 --name fw8081 -j DROP
-p tcp --dport 8081 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 --name fw8081 -j LOG --log-prefix "LMfwport8081"
-p tcp --dport 8081 -i eth0 -m state --state NEW -m recent --set --name fw8081
-p icmp -j DROP
-p icmp -m limit --limit 2/s -j ACCEPT
-p tcp --syn --dport 80 -m connlimit --connlimit-above 25 -j DROP
-p tcp --syn --dport 80 -m connlimit --connlimit-above 25 -j LOG --log-prefix "BLfwsyn80"
-p tcp --syn --dport 443 -m connlimit --connlimit-above 25 -j DROP
-p tcp --syn --dport 443 -m connlimit --connlimit-above 25 -j LOG --log-prefix "BLfwsyn443"
-p tcp --syn --dport 50443 -m connlimit --connlimit-above 25 -j DROP
-p tcp --syn --dport 50443 -m connlimit --connlimit-above 25 -j LOG --log-prefix "BLfwsyn50443"
-p tcp --syn --dport 50022 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 50022 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn50022"
-p tcp --syn --dport 22 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 22 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn22"
-p tcp --syn --dport 50000 -m connlimit --connlimit-above 15 -j DROP
-p tcp --syn --dport 50000 -m connlimit --connlimit-above 15 -j LOG --log-prefix "BLfwsyn50000"
-p tcp --syn --dport 10000 -m connlimit --connlimit-above 15 -j DROP
-p tcp --syn --dport 10000 -m connlimit --connlimit-above 15 -j LOG --log-prefix "BLfwsyn10000"
-p tcp --syn --dport 25 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 25 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn25"
-p tcp --syn --dport 20 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 20 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn20"
-p tcp --syn --dport 21 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 21 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn21"
-p tcp --syn --dport 110 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 110 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn110"
-p tcp --syn --dport 143 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 143 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn143"
-p tcp --syn --dport 53 -m connlimit --connlimit-above 10 -j DROP
-p tcp --syn --dport 53 -m connlimit --connlimit-above 10 -j LOG --log-prefix "BLfwsyn53"
-i eth0 -p tcp --tcp-flags ALL ALL -j DROP
-i eth0 -p tcp --tcp-flags ALL ALL -j LOG --log-level 4 --log-prefix "FLAAfw"
-i eth0 -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-i eth0 -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-level 4 --log-prefix "FINGfw"
-i eth0 -f -j DROP
-i eth0 -f -m limit --limit 6/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "FRAGfw"
-i eth0 -p tcp --tcp-flags ALL NONE -j DROP
-i eth0 -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULLfw"
-i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMASfw"
-i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-level 4 --log-prefix "SYNRTSfw"
-i eth0 -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-i eth0 -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-level 4 --log-prefix "SYNRTSACKfw"
-i eth0 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
-i eth0 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-level 4 --log-prefix "SYNRTSYNSfw"
-i eth0 -p tcp ! --syn -m state --state NEW -j DROP
-i eth0 -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "DROSYNCfw"

Edit reloadfail2ban:

nano reloadfail2ban

Paste the following:

#!/bin/bash

/etc/init.d/fail2ban restart
sleep 2
/root/scripts/unloadfw
sleep 2
/root/scripts/loadfw

Keep in mind that the reloadfail2ban script just unloads the custom rules in fwrules, restarts fail2ban and loads the rules in fwrules again. It doesn't do a full firewall restart. So before you edit the rules in this file (or IPs file), unload them with unloadfw. The role of reloadfail2ban is to test the functionality of fail2ban

Finally execute:

chmod 700 reloadfail2ban
chmod 700 unloadfw
chmod 700 loadfw
/root/scripts/reloadfail2ban

If you want the custom rules to load after every reboot paste the line: /root/scripts/loadfw in the end of /etc/init.d/rc.local:

nano /etc/init.d/rc.local

and append:

[...]
/root/scripts/loadfw

(D)DoS Deflate is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It creates a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level.

IP addresses with over a pre-configured number of connections are automatically blocked in the server's firewall, which can be direct iptables or Advanced Policy Firewall (APF). To install (D)DoS Deflate:

cd /tmp
wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh

Edit /usr/local/ddos/ddos.conf and apply the follow changes that will disable APF firewall and use plain iptables, email events to root and block IP with more than 100 connections per minute.

[...]
APF_BAN=0
EMAIL_TO="root"
NO_OF_CONNECTIONS=100
[...]

The above are just a bunch of suggestions. You can extend them as you like.

The implementation is just one approach of many. You can use a firewall solution like APF, Shorewall etc. I would be gland to include more different approaches in companion with this one.


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by karalitani (registered user) on Mon, 2011-12-12 21:51.

just wanted to add the subject line for the cron email:

 test -x /usr/sbin/tigercron && { [ -r "$DEFAULT" ] && . "$DEFAULT" ; nice -n$NICETIGER /usr/sbin/tigercron -q ; } (failed)

Submitted by karalitani (registered user) on Mon, 2011-12-12 21:44.

hey i get this email from cron:

 /usr/lib/tiger/config: line 360: /config: No such file or directory

 how can i fix this?

 

Submitted by 8omas (registered user) on Sat, 2013-03-30 23:29.

Copy the default config from


/usr/lib/tiger/systems/default/config

or

/usr/lib/tiger/systems/Linux/2/config

to

/usr/lib/tiger/

Submitted by Stefkom (not registered) on Sun, 2013-08-25 12:11.
very simple :)

1. sudo ln -s /usr/lib/tiger/systems/Linux/2 /usr/lib/tiger/systems/Linux/3

or

2. sudo cp -a /usr/lib/tiger/systems/Linux/2 /usr/lib/tiger/systems/Linux/3
Submitted by Frederik (not registered) on Wed, 2011-06-01 15:59.

Hy, I applyed this tutorial to my Debian 6 Server.

 When i execute /root/scripts/reloadfail2ban my console tells me:

 

  • root@lvpsXXXXXXXXX:~/scripts# /root/scripts/reloadfail2ban
  • Restarting authentication failure monitor: fail2ban.
  • iptables: Bad rule (does a matching rule exist in that chain?).
  • iptables: No chain/target/match by that name.
  • iptables: Bad rule (does a matching rule exist in that chain?).
  • [...] some more stuff
  • iptables: No chain/target/match by that name.
  • iptables: Bad rule (does a matching rule exist in that chain?).
  • iptables: No chain/target/match by that name.
  • iptables: No chain/target/match by that name.
  • iptables: No chain/target/match by that name.
  • [...] some more stuff
  • iptables: No chain/target/match by that name.
  • iptables: No chain/target/match by that name.
  • iptables: No chain/target/match by that name.
  • iptables: No chain/target/match by that name.
  • iptables: No chain/target/match by that name.

 

 

 Is this okay or is this an error?

 

 

my regards.

Submitted by 8omas (registered user) on Sun, 2011-06-26 18:39.

It's OK.

You probably changed the rules before you unload the previous rules.

So the script tries to unload the new rules, but the old ones are still loaded.

Please first unload everything, after this make your changes and finally reload the rules.

The above include the part of IP addresses

To be sure that everything is ok:

Do a full restart. Unload the rules, Make the changes. Reload the rules.

Keep in mind that this is not a fully featured firewall. It's just a script with basic rules.

Submitted by Benoit Lallemand (not registered) on Thu, 2011-04-21 20:01.

On the top of this pages : 

mkdir /root/scripts
touch /root/scripts/loadfw
touch /root/scripts/unloadfw
touch /root/scripts/IPs

touch /root/scripts/fwrules  --> fwrules with "s"

touch /root/scripts/reloadfail2ban
cd /root/scripts
nano loadfw

 and in the script, here after, you read "fwrule" without "s"

# Simple iptables IP/subnet unload script
# ---------------------------------------------------------


cd /root/scripts/

IPT=/sbin/iptables
DROPMSG="fwBLOCKED "
BADIPS=$(egrep -v -E "^#|^$" /root/scripts/IPs)

while read fwrule
do
$IPT -D INPUT $fwrule

done < /root/scripts/fwrules
Submitted by 8omas (registered user) on Sun, 2011-06-26 18:32.

fwrule is the variable.

At the end of the while is the file (/root/scripts/fwrules):

 while read fwrule
do
  $IPT -D INPUT $fwrule

done < /root/scripts/fwrules

 

Submitted by erosbk (registered user) on Fri, 2011-04-22 16:56.

unloadfw and loadfw are exactly the same... it is an error, please can be those lines corrected?

Thanks in advance, awesome tutorial ;)

Submitted by Frederik (not registered) on Wed, 2011-06-01 15:25.

No they are different.

The one script calls the flag -I to init a rule, the other one -D to delete a rule.

 

:)