[CentOS] creating script for init.d

[Craig White]

On Thu, 2006-12-21 at 01:43 -0300, Linux Man wrote:
> This is what I found in /var/lor/messages:
> 
> Dec 21 02:02:28 Promaster firewall.light: + /sbin/iptables -t nat -A
> POSTROUTING -o eth0 -s MailScanner warning: numerical links are often
> malicious:192.168.15.50 -j SNAT --to-source MailScanner warning:
> numerical links are often malicious:192.168.1.5
> Dec 21 02:02:28 Promaster firewall.light: + echo ...done
> Dec 21 02:02:28 Promaster firewall.light: + echo ''
> Dec 21 02:02:28 Promaster firewall.light: + echo '--> IPTABLES
> firewall loaded/activated <--' 
> Dec 21 02:02:28 Promaster firewall.light: + exit 0
> Dec 21 02:02:28 Promaster rc: Iniciando  firewall.light:  succeeded
> Dec 21 02:02:28 Promaster haldaemon: Iniciación de haldaemon
> succeeded 
> Dec 21 02:02:28 Promaster fstab-sync[3722]: removed all generated
> mount points
> Dec 21 02:02:28 Promaster fstab-sync[3739]: added mount
> point /media/cdrom for /dev/hdc
> Dec 21 02:02:29 Promaster kernel: fp=INVALID:1 a=DROP IN=lo OUT=
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC= MailScanner
> warning: numerical links are often malicious:127.0.0.1 DST=MailScanner
> warning: numerical links are often malicious:127.0.0.1 LEN=16436
> TOS=0x00 PREC=0x00 TTL=64 ID=22436 DF PROTO=TCP SPT=32768 DPT=6009
> WINDOW=8192 RES=0x00 ACK URGP=0 
> Dec 21 02:02:29 Promaster kernel: fp=INVALID:1 a=DROP IN=lo OUT=
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC= MailScanner
> warning: numerical links are often malicious:127.0.0.1 DST=MailScanner
> warning: numerical links are often malicious:127.0.0.1 LEN=16436
> TOS=0x00 PREC=0x00 TTL=64 ID=22438 DF PROTO=TCP SPT=32768 DPT=6009
> WINDOW=8192 RES=0x00 ACK URGP=0 
> Dec 21 02:02:29 Promaster kernel: fp=INVALID:1 a=DROP IN=lo OUT=
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC= MailScanner
> warning: numerical links are often malicious:127.0.0.1 DST=MailScanner
> warning: numerical links are often malicious:127.0.0.1 LEN=16436
> TOS=0x00 PREC=0x00 TTL=64 ID=22440 DF PROTO=TCP SPT=32768 DPT=6009
> WINDOW=8192 RES=0x00 ACK PSH URGP=0 
> 
> As you can see, it look like the script execute good, but hangs de
> keybordad, monitor, mouse, etc. Nevertheless theres some activicty
> from lo to lo ?¿?¿?¿ 
> 
> 2006/12/20, Linux Man <linuxman.uru at gmail.com>:
>         If I hit ENTER anything hapens (even with a lots of enter's)
>         In /var/log/messages seems to compleate the scrips, I'm realy
>         comfiusing (and :( of course)
>         Can be SElinux? can I disable it to try?
>         At terminal all work smooth, I don't understand why hangs at
>         boot time
>         Thanks a lot guys for you help!!
>          
>         2006/12/20, Michael Velez <mikev777 at hotmail.com>: 
>                 
>                 
>                 
>                 > -----Original Message-----
>                 > From: centos-bounces at centos.org
>                 > [mailto:centos-bounces at centos.org] On Behalf Of
>                 Linux Man
>                 > Sent: Tuesday, December 19, 2006 11:40 PM 
>                 > To: CentOS mailing list
>                 > Subject: Re: [CentOS] creating script for init.d
>                 >
>                 > Sorry, i sent the spript to as particular adress but
>                 not for
>                 > the adress that I wanted (all centos mailing list),
>                 again, sorry
>                 >
>                 > If I execute it in a terminal as root, works,
>                 without 
>                 > problem, but if i put it to load a boot time (with
>                 chkconfig)
>                 > there isn't a visual error, just hang.
>                 >
>                 > Using "echo" I isolate, ther problematic part, this
>                 is:
>                 >
>                 > > #Flush everything, start from scratch 
>                 > > $IPTABLES -F
>                 > > $IPTABLES -F -t mangle
>                 > > $IPTABLES -F -t nat
>                 > > $IPTABLES -X
>                 > > $IPTABLES -X -t mangle
>                 > > $IPTABLES -X -t nat
>                 > >
>                 > > #Set default policies to DROP 
>                 > > $IPTABLES -P INPUT DROP
>                 > > $IPTABLES -P OUTPUT DROP
>                 > > $IPTABLES -P FORWARD DROP
>                 >
>                 > Why hangs? any idea?
>                 > Thanks a lot
----
I suppose I am missing something here but I'll offer a theory though
without looking at your code, one could only guess what your problem
might be.

iptables is a service already as part of the distribution.

/sbin/service iptables save # saves the current rules
to /etc/sysconfig/iptables

you can either edit this file, or change your rulesets in real time and
then execute a save at any time per above.

At startup, these rules are automatically loaded...no need to write your
own script for init.d where iptables are concerned

Craig