Newsgroup: it.comp.os.linux.iniziare
Titolo: Iptables, problema sicurezza

Ciao ragazzi,devo mettere(ho già messo su) una macchina pubblica, hal'IP 
configurato direttamente su una nic. Il servier dispone di eth0 (IP LAN) 
e eth1 (IP Pubblico).
Ho messo su uno scriptino, ma quando lo lancio mi blocca l'ssh in 
ingresso...come mai?
Problemi anche conl'FTP! :(
Vorrei dei consiglida voi
Grazie mille...
Michele
lo script è questo:
#!/bin/sh
### FLUSHING CHAIN ###
iptables -F
iptables -X
iptables -Z
### DEFAULT CHAIN ###
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
### SETTING IPFORWARDING ###
/bin/echo "1" > /proc/sys/net/ipv4/ip_forward
### DISABLE RESPOND TO BROADCAST ###
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
### ENABLE BAD ERROR MESSAGE PROTECTION ###
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
### DISABLE ICMP REDIRECT ACCEPTANCE ###
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
### SETTING ANTISPOOFING PROTECTION ###
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
### DON'T RESPOND TO BROADCAST PINGS ###
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
##################################################################
# ====================== LOGGIN GENERAL ===========================
iptables -I INPUT -p icmp --icmp-type echo-request -j ULOG 
--ulog-nlgroup 1 --ulog-prefix "ICMP DROP: "
iptables -I INPUT -m state --state INVALID -j ULOG --ulog-nlgroup 1 
--ulog-prefix "INVALID: "
iptables -I INPUT -p tcp ! --syn -m state --state NEW -j ULOG 
--ulog-nlgroup 1 --ulog-prefix "NEW INCORRECT: "
# ======================= LOCALHOST ================================
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT
# ======================= SSH RULE ================================
iptables -A INPUT -i eth0 -p TCP --dport ssh -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport ssh -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport ssh -j ULOG --ulog-nlgroup 1 
--log-prefix="SSH IN : "
iptables -A OUTPUT -o eth1 -p TCP --dport ssh -j ACCEPT
# ======================= DNS RULE ==========================
iptables -A INPUT  -p TCP -i eth0 --sport 53 -j ACCEPT
iptables -A INPUT  -p udp -i eth0 --sport 53 -j ACCEPT
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A OUTPUT -p TCP -o eth0 --dport 53 -j ACCEPT
# ======================= ICMP RULE ==========================
iptables -A INPUT  -p icmp -i eth0 -j ACCEPT
iptables -A INPUT  -p icmp -i eth1 -j ACCEPT
iptables -A OUTPUT -p icmp -o eth0 -j ACCEPT
iptables -A OUTPUT -p icmp -o eth1 -j ACCEPT
# ======================= NTP RULE =========================
iptables -A INPUT  -p udp --sport ntp -s 80.83.192.129 -j ACCEPT
iptables -A INPUT  -p tcp --sport ntp -s 80.83.192.129 -j ACCEPT
iptables -A OUTPUT -p udp --dport ntp -d 80.83.192.129 -j ACCEPT
iptables -A OUTPUT -p tcp --dport ntp -d 80.83.192.129 -j ACCEPT
# ================= HTTP & HTTPS ============================
iptables -A INPUT -i eth0 -p TCP --dport http -j ACCEPT
iptables -A INPUT -i eth0 -p TCP --dport https -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport http -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP --sport http -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP --sport https -j ACCEPT
iptables -A OUTPUT -o eth1 -p TCP --sport http -j ACCEPT
# ====================== WebMin =============================
iptables -A INPUT -i eth0 -p TCP --dport 9898 -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport 9898 -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport 9898 -j ULOG --ulog-nlgroup 1 
--log-prefix="WEBMIN: "
# ================= FTP =====================================
iptables -A INPUT -p TCP --dport 20:21 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 20:21 -j ACCEPT
# ================= Darwin Admin ============================
iptables -A INPUT -p TCP --dport 1220 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 1220 -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport 1220 -j ULOG --ulog-nlgroup 1 
--log-prefix="DARWIN: "
# ================= Streaming ================================
iptables -A INPUT -p TCP --dport 80 -j ACCEPT
iptables -A INPUT -p TCP --dport 554 -j ACCEPT
iptables -A INPUT -p UDP -dport 1024:65356 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 80 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 554 -j ACCEPT
iptables -A OUTPUT -p UDP -sport 1024:65356 -j ACCEPT

prova così
#!/bin/sh
### FLUSHING CHAIN ###
iptables -F
iptables -X
iptables -Z
### DEFAULT CHAIN ###
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
### SETTING IPFORWARDING ###
/bin/echo "1" > /proc/sys/net/ipv4/ip_forward
### DISABLE RESPOND TO BROADCAST ###
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
### ENABLE BAD ERROR MESSAGE PROTECTION ###
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
### DISABLE ICMP REDIRECT ACCEPTANCE ###
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
### SETTING ANTISPOOFING PROTECTION ###
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
### DON'T RESPOND TO BROADCAST PINGS ###
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
##################################################################
# ====================== LOGGIN GENERAL ===========================
iptables -I INPUT -p icmp --icmp-type echo-request -j ULOG --ulog-nlgroup 1 --ulog-prefix "ICMP_DROP:"
iptables -I INPUT -m state --state INVALID -j ULOG --ulog-nlgroup 1 --ulog-prefix "INVALID: "
iptables -I INPUT -p tcp ! --syn -m state --state NEW -j ULOG --ulog-nlgroup 1 --ulog-prefix "NEW_INCORRECT:"
# ======================= LOCALHOST ================================
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT
# ======================= SSH RULE ================================
iptables -A INPUT -i eth0 -p TCP --dport ssh -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport ssh -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport ssh -j ULOG --ulog-nlgroup 1 --ulog-prefix="SSH_IN:"









# ====================== WebMin =============================

iptables -A INPUT -i eth1 -p TCP --dport 9898 -j ULOG --ulog-nlgroup 1 --ulog-prefix="WEBMIN:"
# ================= FTP =====================================
iptables -A INPUT -p TCP --dport 20:21 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 20:21 -j ACCEPT
# ================= Darwin Admin ============================
iptables -A INPUT -p TCP --dport 1220 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 1220 -j ACCEPT
iptables -A INPUT -i eth1 -p TCP --dport 1220 -j ULOG --ulog-nlgroup 1 --ulog-prefix="DARWIN:"
# ================= Streaming ================================
iptables -A INPUT -p TCP --dport 80 -j ACCEPT
iptables -A INPUT -p TCP --dport 554 -j ACCEPT
iptables -A INPUT -p UDP --dport 1024:65533 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 80 -j ACCEPT
iptables -A OUTPUT -p TCP --sport 554 -j ACCEPT
iptables -A OUTPUT -p UDP --sport 1024:65533 -j ACCEPT

 iptables -A OUTPUT -o eth1 -p TCP --dport ssh -j ACCEPT
Ciao,
 se non sbaglio hai abilitato solo i pacchetti TCP in ingresso, ma non 
quelli in uscita ... e non parlo dei pacchetti diretti alla porta ssh, ma 
di quelli _provenienti_ dalla porta ssh del tuo sistema.
PS: la riga con ULOG mi sembra inutile, perche' quei pacchetti sono gia' 
stati accettati.
 Ciao
 Federico

 
Si, ma vorrei tenere traccia di chi accede in ssh...

Federico Zema ha scritto:

OK, ho risolto perl'ssh, il problema era qui:
iptables -A OUTPUT -o eth1 -p TCP --dport ssh -j ACCEPT
Adesso mi rimane l'FTP, per non avere problemi su Passive Mode, ho letto 
che andrebbero attivate le regole NEW, RELATED, ESTABLIS...
Qualche ideada suggerirmi??
Grazie ancora...
Michele

 Si, ma vorrei tenere traccia di chi accede in ssh...
La devi spostare sopra ... cosi' com'e' adesso, nessun pacchetto viene 
passato a ULOG perche' sono gia' stati accettati.
 Ciao
 Federico