Discuss

discuss@lists.centos.org

5 participants
34752 discussions

RE: [CentOS] iptables rules
by Andrew Elliott 23 May '06

23 May '06

Good morning, First I would recommend using different rules for your INPUT and FORWARD chains; it's 100 times easier to troubleshoot and can make things look a lot simpler. Second, I would refrain from posting any external ip addresses on a public forum. I'm not sure about your setup, but usually when you're creating rules such as these, it's a good idea to start off with a default policy of DROP for INPUT, OUTPUT and FORWARD. From a security perspective it's better to block everything and only allow what you're looking for. Anyways, for your rules, I would replace "-A RH-Firewall-1-INPUT -i eth0 -s 82.201.195.123 -j ACCEPT" and "-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j REJECT" with: -A RH-Firewall-1-INPUT -i eth0 -p tcp -m tcp -s ! 82.201.195.123 --dport 22 -j DROP This will drop everything on eth0 going to port 22 from everywhere except the ip address specified. However, it's still easy to spoof an ip address in order to get ssh access to this box. I would really recommend to set all your default policies to DROP though. If you'd like an exhaustive tutorial: http://iptables-tutorial.frozentux.net/iptables-tutorial.html Peace. Andrew Elliott Network Services Computar Services Inc. 2191 Thurston Drive >Ottawa, Ontario K1G 6C9 >Tel: (613) 482-8374 >Fax: (613) 737-3611 >Email: andrewe(a)computar.ca -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Abd El-Hameed Ayad Sent: Tuesday, May 23, 2006 9:35 AM To: centos(a)centos.org Subject: [CentOS] iptables rules Hi, I have 2 CentOS servers 82.201.195.123 & 62.139.61.84 I want to deny all ssh logins on port 22 on (62.139.61.84) from any host except from (82.201.195.123) Can anybody tell me such iptables rules to write in /etc/sysconfig/iptables Currently, im using the following rules (on 62.139.61.84) *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] -A INPUT -j RH-Firewall-1-INPUT -A FORWARD -j RH-Firewall-1-INPUT -A RH-Firewall-1-INPUT -i lo -j ACCEPT -A RH-Firewall-1-INPUT -i eth1 -j ACCEPT -A RH-Firewall-1-INPUT -i eth0 -s 82.201.195.123 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j REJECT -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT But i found that somebody is bypassing these rules & trying to authenticate with unknown (or wrong password) accounts Thanx in advance _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

QVCS on Centos
by Marius Nicolaescu 23 May '06

23 May '06

Hello, I,installed last year qvcs on Centos 3.4 . Now I want to install on another machine and I don't know what version is the most stabile for qvcs. The last installation is working fine, but I didn't manage to resolve the autoresponder problem for name.lastname users. The accounts that had "." are not working with autoresponder. Thank you, Marius -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://linux.bitdefender.com/

1 0

ISO-8601 and LOCALEs
by James B. Byrne 23 May '06

23 May '06

We would like to set the standard date and time display on our CentOS hosts to the format "yyyy-mm-dd HH:mm:ss", where HH is the twenty-four hour clock. Does there exist a simple setting in Linux/CentOS that permits such a change for a specific LOCALE (in our case en_CA.UTF-8) or is it necessary to build a custom LOCALE LC_TIME file? If the latter case holds then can someone point me to a web site or other reference that provides somewhat more details on the process than that provided in the man pages? Sincerely, Jim -- *** e-mail is NOT a secure channel *** James B. Byrne mailto:ByrneJB.<token>@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3CE delivery <token> = hal

1 0

Kernel errors, resulting in system crashes
by Henri Cook 23 May '06

23 May '06

Hi Guys, After a chat with some helpful people on Freenode I've included as much information as I can think to about this error, if you need anything else please don't hesitate to ask. I run a webserver (remotely administered, no graphical user interface that i know of - certainly not one running all the time) - in the past few days this error has started to occur, the system dies and needs manually rebooting after each occurence: ---------------- May 21 23:08:01 testmachine kernel: Page has mapping still set. This is a serious situation. However if you May 21 23:08:01 testmachine kernel: are using the NVidia binary only module please report this bug to ----------------- The machine runs CentOS 3 and has been for ~2 Years, a technician at the datacentre ran Memtest earlier today which returned no errors. Hardware wise it's an intel 2.53Ghz Celeron, 1.5GB RAM I would really appreciate any help! Henri

3 3

ipsec and Centos3.7
by Oliver Schulze L. 23 May '06

23 May '06

Hi, I want to connect to a Cisco Pix using ipsec. In RH9 I was able to compile openswan 2.4.0 and use it, but in Centos 3.7 I can apply the openswan klips patch. I noted that the centos 3.7 kernel has a ipsec patch from redhat, does this NETKEY patch works with openswan? What ipsec solution do I have in centos 3.7? Should I use another kernel? many thanks Oliver -- Oliver Schulze L. <oliver(a)samera.com.py>

1 0

CentOS 3 and openswan > 2.2.1
by Nicole Haehnel 23 May '06

23 May '06

Hi, is there anybody running centos3 (el3) with a standard kernel 2.4.32 or newer, because it seems openswan versions > 2.21 don't run with centos3(el3) anymore. But we need the newer openswan versions. Problem arise when I try to build the ipsec.o module: /usr/src/openswan-2.4.4/linux/net/ipsec/ipsec_init.c /usr/src/openswan-2.4.4/linux/net/ipsec/ipsec_init.c: In function `openswan_inet_add_protocol': /usr/src/openswan-2.4.4/linux/net/ipsec/ipsec_init.c:162: too few arguments to function `inet_add_protocol_Rsmp_dc5483d7' /usr/src/openswan-2.4.4/linux/net/ipsec/ipsec_init.c: In function `openswan_inet_del_protocol': /usr/src/openswan-2.4.4/linux/net/ipsec/ipsec_init.c:169: too few arguments to function `inet_del_protocol_Rsmp_23842692' If I use a vanilla kernel, some other things break like iptables... Maybe a spec file for a vanilla kernel + iptables? Anybody can help? Thanks! Nicole

2 1

CD ISOs for Centos/s390x
by Giovanni P. Tirloni 22 May '06

22 May '06

Hello, Are there any CDROM ISOs for s390x ? I can only find DVD ISOs. Thank you, -- Giovanni P. Tirloni http://www.tirloni.org

3 2

System freeze on laptop: power saving daemon doing harm?
by Niki Kovacs 22 May '06

22 May '06

Hi, I have CentOS 4.3 installed on my Fujitsu Siemens Amilo D laptop (Pentium IV 2.4 GHz CPU). Everything runs just fine, but I have one problem. When I leave the machine unattended for something like an hour or two, my desktop has "frozen". Unable to recovery anything, even [Ctrl] + [Alt] + [Backspace] refuses to quit X, so I have to hard-reboot by pressing PowerOn/Off for 10 seconds. First thing I did after install, I deactivated the XScreensaver because it kept asking me for a password everytime I stopped typing for 5 minutes. There must be some other power-saving daemon there that makes the mess, but I don't know much about these. I've heard somewhere that ACPI can cause system crashes... but I don't know where to even start to look. As far as I reckon, I have an ACPI daemon running, a thing called 'irqbalance' (that produces a nice red 'FAILED' on every shutdown) and also lm_sensors. Any suggestions? Niki Kovacs

2 1

problem with ldap, sendmail, dovecot
by Myron Williams 22 May '06

22 May '06

Hi all, I have recently started to use CentOS. I have setup a mail server running centos 4.3 with dovecot, sendmail, and spamassassin. The user information is located in a openlapd database on a separate machine. I am currently seeing connection from the mail server to the ldap server left open which causes some interesting behavior. Sendmail will occasionally return email messages as user unknown when the user exists. This behavior will steadily get worse until the number of connections fill up. When ldap is restarted the process starts over again. If ldap is restarted every hour the behavior stated above is not seen. Email is delivered as would be expected. Doing tcpdump shows connections from dovecot and sendmail that have are in an open state. I find the connections that were is the open state finish their request and close. Occasionally I see connections that were doing dovecot authentication before the reset will change and do a sendmail request then close. When a load was first put to the mail server dovecot authentication would just start (authenticate < 10 people) and lockup. Upon googling I found a article that said to set dovecot to use ldap directly instead of using pam (create the dovecot-ldap.conf file). This I did and the authentication problem appeared to have gone away. I have tried to find information to help solve this problem of the open connection but without success. If someone could point me in the right direction to solve this problem it would be appreciated. Myron Williams

1 0

Folding@Home + CentOS 4.3 = success
by Chris Mauritz 22 May '06

22 May '06

The Folding@Home client seems to be a wonderful stressor of the CentOS server systems I've been burning in. I've been running two copies of the client on physical dual-core and single die dual-core machines for a few days now. Nary a whimper from the machines and only a slight elevation in temperature (they're 1RU rackmount systems with aggressive/loud fans). In contrast, I loaded the client on a few Win2K (server and workstation) and my WinXP laptop and every single one of them eventually bombed out the client (though without crashing the machines). All were running the 5.04beta client. So I guess it's time to deploy these puppies. (Darn, just when I was poised to break into the top 10 on the CentOS team...heh) Cheers,

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss