fail2ban is doing nothing?

[rlischer]

iptables refuses to start, no errors, even after reboot, nothing.

tried

chkconfig iptables on

service iptables start

/etc/init.d/iptables start

[gscott187]

You can start iptables firewall with the command:

system-config-securitylevel-tui

This screen is text and may not show that well on a terminal but you can Tab around well enough. Tab to where it shows Security Level and press spacebar to leave an asterisk against Enabled.

Tab to SELinux and leave as Disabled

Tab to OK and press Enter

This will start the firewall and create all of the right files etc.


To determine the run levels in which ipables will start, type:

chkconfig --list iptables

you should see:

iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off


This shows that ipables will start in run levels 2 through 5 (the default run level and what you're most likely in now is 3).

[rlischer]

Thanks. It says this now:

[root@server ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
3    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
4    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

[rlischer]

I think it is blocking my sites now. I have no idea what ports I need open, of course 80, 21 for web ftp, but email, squerrel mail and anything else I don't know how to open?

[gscott187]

So fail2ban appears to be working - good.

The iptables output shown is the default filter. This needs to be configured for your requirements. One of the things I advise you change are the default policy for INPUT and FORWARD chains from ACCEPT to DROP.

I've sent a HowTo on SquirrelMail and fail2ban to Falko that will be published here in the next few days (once it's been vetted). So if you're interested in setting up SquirrelMail with fail2ban be sure to read that. There's a few gotchas that can catch people out setting this one up.

As far as inbound ports/services to open, it all depends on what you intend running. For example:

Web - port 80 (http)
Secure Web - port 443 (https)
Plain text email - port 25, 110, 143 (smtp, POP3, IMAP4)
File transfer - port 20, 21 (ftp)
Secure Shell - port 22 (ssh)

There are several others but be very conservative and ask yourself what you REALLY need open.

[rlischer]

Originally Posted by gscott187

So fail2ban appears to be working - good.

The iptables output shown is the default filter. This needs to be configured for your requirements. One of the things I advise you change are the default policy for INPUT and FORWARD chains from ACCEPT to DROP.

I've sent a HowTo on SquirrelMail and fail2ban to Falko that will be published here in the next few days (once it's been vetted). So if you're interested in setting up SquirrelMail with fail2ban be sure to read that. There's a few gotchas that can catch people out setting this one up.

As far as inbound ports/services to open, it all depends on what you intend running. For example:

Web - port 80 (http)
Secure Web - port 443 (https)
Plain text email - port 25, 110, 143 (smtp, POP3, IMAP4)
File transfer - port 20, 21 (ftp)
Secure Shell - port 22 (ssh)

There are several others but be very conservative and ask yourself what you REALLY need open.

Thanks! I will be watching for your howto.

[discoverlinux]

I saw the same error and I had enabled (set to true) ssh-iptables and ssh-tcpwrapper. Setting ssh-tcpwrapper back to false removed the error.