Discuss

discuss@lists.centos.org

34753 discussions

[CENTOS ]IPTABLES - How Secure & Best Practice
by Leon Vergottini 01 Jul '16

01 Jul '16

Dear Members I hope you are all doing well. I am busy teaching myself iptables and was wondering if I may get some advise. The scenario is the following: 1. Default policy is to block all traffic 2. Allow web traffic and SSH 3. Allow other applications I have come up with the following: #!/bin/bash # RESET CURRENT RULE BASE iptables -F service iptables save # DEFAULT FIREWALL POLICY iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # ------------------------------------------------------ # INPUT CHAIN RULES # ------------------------------------------------------ # MOST COMMON ATTACKS iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP # LOOPBACK, ESTABLISHED & RELATED CONNECTIONS iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # SSH iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # WEB SERVICES iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT # EMAIL iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT # OTHER APPLICATIONS iptables -A INPUT -p tcp -m tcp --dport XXXXX -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport XXXXX -j ACCEPT # ------------------------------------------------------ # OUTPUT CHAIN RULES # ------------------------------------------------------ # UDP iptables -A OUTPUT -p udp -j DROP # LOOPBACK, ESTABLISHED & RELATED CONNECTIONS iptables -A OUTPUT -i lo -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # SSH iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # WEB SERVICES iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT # EMAIL iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT # OTHER APPLICATIONS iptables -A INPUT -p tcp -m tcp --dport 11009 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 12009 -j ACCEPT # ------------------------------------------------------ # SAVE & APPLY # ------------------------------------------------------ service iptables save service iptables restart To note: 1. The drop commands at the beginning of each chain is for increase performance. It is my understanding that file gets read from top to bottom and applied accordingly. Therefore, applying them in the beginning will increase the performance by not reading through all the rules only to apply the default policy. 2. I know the above point will not really affect the performance, so it is more of getting into a habit of structuring the rules according to best practice, or at least establishing a pattern for myself. How secure is this setup? Is there any mistakes or things that I need to look out for? Thank you in advance for your feedback. Kind Regards Leon

9 16

CentOS-announce Digest, Vol 137, Issue 1
by centos-announce-request＠centos.org 01 Jul '16

01 Jul '16

1 0

Does centos 6.8 support gstreamer 1.8?
by qw 30 Jun '16

30 Jun '16

Hi, I found gstreamer offcial have just announced 1.8.2 version. ("gstreamer.freedesktop.org") But centos 6 only support gstreamer 0.10. When will centos 6 support gstreamer 1.8? Thanks! Regards Andrew

3 2

CentOS-7 Screen black after boot
by Venkata Balaji N 30 Jun '16

30 Jun '16

Hello Community, This is my first ever email to CentOS community. Firstly, CentOS is a great open-source operating system. I have been using it for years and recommending the same for production use to our customers. I have installed CentOS-7 operating system couple of days ago and everything was working fine. Yesterday, the screen got struck and the whole system was unresponsive, after a long wait, i have restarted the system. Since, then, i can only see the black screen and GUI is not coming up. I can remotely login to the system from Putty and can operate without any issues, the only issue is that GUI is not coming up. I have installed CentOS-7 server-GUI. Any help would be appreciated here. Regards, Venkata B N

1 0

VNC server issue- Gnome - oh no! Something has gone wrong
by Hersh 29 Jun '16

29 Jun '16

Hi, I have been using VNC on CentOS 7 server from last couple of months and it was running all fine till last night. Unfortunately, there was an abrupt power failure and system got restarted. Now, when I try to login with VNCviwer, it thrown an error message- "*Gnome - oh no! Something has gone wrong "* with a logout option. When I click on logout, I see black/dark gray screen with 3 check boxes. I googled to figure out a solution and tried several solutions but could not fix the problem. Any suggestion would be very helpful. Regards Hersh

3 4

CentOS-announce Digest, Vol 136, Issue 6
by centos-announce-request＠centos.org 29 Jun '16

29 Jun '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2016:1349 CentOS 7 lvm2 BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 29 Jun 2016 00:12:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2016:1349 CentOS 7 lvm2 BugFix Update Message-ID: <20160629001211.GA46363(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2016:1349 Upstream details at : https://rhn.redhat.com/errata/RHBA-2016-1349.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 9f8f2152738415ddef6509c16881468f8abedf7488490bfe724561ee7eb582c7 cmirror-2.02.130-5.el7_2.5.x86_64.rpm e23f39c92b83682c140324b0891d426bf538fbdc68cf7f267c2a87356816d89c device-mapper-1.02.107-5.el7_2.5.x86_64.rpm 0c3dc7d9d7957e749ad019f06e0cc1c87f3db76cb500457050ce2c3e46080b8b device-mapper-devel-1.02.107-5.el7_2.5.i686.rpm 4da48171c8f599255dd47809d5ed2cdbd23afe152c44540e4e6c41bb88cf7f6b device-mapper-devel-1.02.107-5.el7_2.5.x86_64.rpm b1f004cceca52345c14d2dec35b44d989d39003d3a0e37ae14ee08210296e157 device-mapper-event-1.02.107-5.el7_2.5.x86_64.rpm 6a8203ef009bd1dae1c2575bfaa89582a5d9b402e9a450ce3a787c22ead8f4a6 device-mapper-event-devel-1.02.107-5.el7_2.5.i686.rpm a2a822a1de226771fd00b9d6bce566def68a67b5c4ef1351f7d4e756a3d23e03 device-mapper-event-devel-1.02.107-5.el7_2.5.x86_64.rpm 44d8c251698d60f8bf82d71d774652c7743515edd9077a780bb33709303188e6 device-mapper-event-libs-1.02.107-5.el7_2.5.i686.rpm 59b65674dcab344b3d219b6961722bfd40780455bc0bce6bd02edd6dd768453c device-mapper-event-libs-1.02.107-5.el7_2.5.x86_64.rpm 8475f1a20a99c5f1d041187a531b5c5406c67bf84afb926096d11810f1a53d8e device-mapper-libs-1.02.107-5.el7_2.5.i686.rpm 4d964e6a7643010f2862791e2588e08f6011e4c656540d61d3ebe937ac9ce13a device-mapper-libs-1.02.107-5.el7_2.5.x86_64.rpm b7a90ef80f4e8ddb35257802a57c07660e1ddc7e2c4a9957edf382ff67ec1567 lvm2-2.02.130-5.el7_2.5.x86_64.rpm 65a4c81480d0efba21f0da7969a2f820d69e26934af24bf4fdb8c449a2d502dc lvm2-cluster-2.02.130-5.el7_2.5.x86_64.rpm 04d6d35438ff31602702872775f9fdc758c94d1e9656319dcfa09580ef21609d lvm2-devel-2.02.130-5.el7_2.5.i686.rpm e53af702e6143a89598e64754410bbdbb079fb3e5b657091d88f44fec28fa391 lvm2-devel-2.02.130-5.el7_2.5.x86_64.rpm abafec8cbed90c9e68a796b61235bab160be70a8d0a8290041d78c155d41804e lvm2-libs-2.02.130-5.el7_2.5.i686.rpm 6c0f6537d19eecc549c1c7adf01cdee3aa6d805b30496946fbcc73cb4b3fe582 lvm2-libs-2.02.130-5.el7_2.5.x86_64.rpm 39727f939e993c9baac491080ef3901b3d18536c3c4a7e12668bf381f15f99e9 lvm2-lockd-2.02.130-5.el7_2.5.x86_64.rpm 2f3b320f5108eef429344b89416a2fcf6e15a47e014faeff5b47c6a3ebe234a3 lvm2-python-libs-2.02.130-5.el7_2.5.x86_64.rpm 53316ba2995b27f5b7a4137817a66cd811c42c4ce286e682869d565f5bae76be lvm2-sysvinit-2.02.130-5.el7_2.5.x86_64.rpm Source: 399d8210953038b445e7ac3fc91fc13b517b11dc1a849f820f17296a27477a56 lvm2-2.02.130-5.el7_2.5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 136, Issue 6 ***********************************************

1 0

Errors on yum upgrade
by henimp＠openmail.cc 28 Jun '16

28 Jun '16

During yum upgrade a couple days ago, I saw this: Cleanup : kernel-3.10.0-229.20.1.el7.x86_64 35/64 warning: file /lib/modules/3.10.0-229.20.1.el7.x86_64/modules.softdep: remove failed: No such file or directory warning: file /lib/modules/3.10.0-229.20.1.el7.x86_64/modules.devname: remove failed: No such file or directory Should I be concerned about this? What could have caused it? ------------------------------------------------- ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

2 2

Re: [CentOS] UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 28 Jun '16

28 Jun '16

On Mon, June 27, 2016 12:29, Gordon Messmer wrote: > On 06/26/2016 01:50 PM, James B. Byrne wrote: >> However, all I am seeking is knowledge on how to handle this using >> iptables. I am sure that this defect/anomaly has already been >> solved wherever it is an issue. Does anyone have an example on >> how to do this? > > > I think the bit you're missing is that you don't have to address every > detail that your auditors send you. You can label an item a false > positive. You can respond that you are aware, and that you don't > consider an item to be a security defect. Fingerprinting is an > excellent example thereof. As was already noted, the IP ID field is > just one of many aspects of IP networking that can be used to identify > Linux systems. If you don't address them all, addressing one is not a > useful exercise. I understand WRT false positive flagging. And that is exactly what I have done. However, the PCI DSS report piqued my interest in this matter and I thought to satisfy my curiosity. The other stuff flagged in the report seemed a little far-fetched to me. At least the explanation of why they were flagged did. As none of them affect our PCI status I have no interest in the rest. This one however I was previously unaware and so I wanted to discover more about it. Thank you for the information and especially for the references. Sincerely, -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Guest's Additions Virtual CD
by raving Joker 28 Jun '16

28 Jun '16

Hello to everyone I'm a new italian member so I'm sorry if my english isn't perfect. I was thinking... Why not (in CentOS 7) insert a tab in the installation phase that can permit an automatic installation of guest's additions tools (I'm using virtualbox, but it can be applied to other platforms with a menu), a little system that reveals the guest addition's cd and if isn't inserted, displays to the user a message with informations about how insert it and do the installation automatically? Thanks for all of people that want to reply, I know that this virtualization platforms are in part in discordance with the ethical free software's mindset...but why not in centos, with proper informative messages? Good afternoon Raving

1 0

Use USB2.0 Camera with KVM based VM
by Mark LaPierre 28 Jun '16

28 Jun '16

Hey All, I've been googleing this issue for hours but I can't find a workable solution. I found a reply to a bug posting that said the USB hub on the VM defaults to USB 1.1. I see this is true when I lsusb on the CentOS 7 guest. The reply to the bug post went on to say that the problem is that the USB 2.0 camera will not work with the USB 1.1 default hub and that I should change the hub from USB 1.1 to USB 2.0. I see no way to do that. Can anyone shed some light on this? Is there a way to change the USB hub from USB 1.1 to USB 2.0 inside the VM Manager? Is there a better way to get my USB 2.0 web camera to appear in my CentOS 7 guest? -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss