Re: iptables firewall script for debian-woody, 2.4.24

From: Eugenijus Januškevičius (ejs_at_delfi.lt)
Date: 04/05/04

  • Next message: Julien Nury: "chroot & mount --bind = security ?" 
    Date: Mon, 05 Apr 2004 23:06:05 +0300
To: Gord Philpott <tech@gordphilpott.com>

    Hi,

    Gord Philpott wrote:
    >> I have used the script on other systems, and have commented out the
    >> ports that are not needed for this setup. When I nmap the server
    >> with the firewall script off, I get different results than when the
    >> firewall script is on. I am looking to have the ports needed to run
    >> DNS and SSH available regardless of the firewall status.

    >> $IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    >> $IPTABLES -A OUTPUT -p tcp --destination-port 53 -j ACCEPT # DNS
    >> $IPTABLES -A OUTPUT -p udp --destination-port 53 -j ACCEPT # DNS
    >> $IPTABLES -A OUTPUT -p tcp --destination-port 22 -j ACCEPT # SSH

    You hope, that destination port for incoming DNS queries will be 53.
    This is not true. The same is for SSH.

    Leave OUTPUT chain unfiltered and nmap once more.

    PS. Why you do not use iptables-[save|restore]? 

    -- 
  ejs
  • Next message: Julien Nury: "chroot & mount --bind = security ?"

    Relevant Pages

    • Re: Security basics
      ... Someday, Lord willing, I would like to set up a lot of standard ports ... information to the security community almost as fast as it occurs. ... can detect ssh implementations since they normally self-identify. ... eliminate the script kiddies. ...
      (Fedora)
    • Re: Security basics
      ... Someday, Lord willing, I would like to set up a lot of standard ports ... information to the security community almost as fast as it occurs. ... can detect ssh implementations since they normally self-identify. ... eliminate the script kiddies. ...
      (Fedora)
    • iptables firewall script for debian-woody, 2.4.24
      ... I've created a custom IPTables firewall script for a Debian 3.0 server ... I have used the script on other systems, and have commented out the ports ... I am looking to have the ports needed to run DNS and SSH available ... 53/tcp open domain ...
      (Focus-Linux)
    • Re: Problem with script to add printers ports, need help.
      ... >> first want to add the printer ports but I am running into a problem. ... >> Just for the heck of it I ran the template script from the script center and ... > and ports on local and remote computers. ... > Instrumentation scripts in Windows Server 2003, ...
      (microsoft.public.windows.server.scripting)
    • Re: [Full-disclosure] Brute force attack - need your advice
      ... But please state a config that someone with experience can not get into, is more of a point that security is ever evolving. ... Yup it is security by obscurity and it will help against a script kiddie that won't take the time to scan all ports, thats why I suggested move to a high non-standard port. ... I'm not talking about downloading blacklists but dynamic firewall rules and scripting to achieve a dynamic list based on ranking of attacks against the box. ...
      (Full-Disclosure)
    • Quantcast