NOT just another WordPress site

Month: November 2011

IPTABLES complete cheatlist

Please note that the iptables rules are stored in the /etc/sysconfig/iptables file. If you view this file, you’ll see all the default rules.

1. Delete Existing Rules

Before you start building new set of rules, you might want to clean-up all the default rules, and existing rules. Use the iptables flush command as shown below to do this.

iptables -F
(or)
iptables –flush
service iptables save

2. Set Default Chain Policies

The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming andone for outgoing.
Change default policy for INPUT/OUTPUT/FORWARD to ACCEPT. All inbound connections will be allowed

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

3.Block an IP for inbound connection

iptables -A INPUT -s 192.168.1.5 -j DROP
iptables -A INPUT -i eth0 -p tcp -s “$BLOCK_THIS_IP” -j DROP
4.Allow an IP for inbound connection

iptables -A INPUT -s 192.168.1.5 -j ACCEPT

5.Block outbound IP address

iptables -A OUTPUT -d <IP> -j DROP

6.Block outbound PORT

iptables -A OUTPUT -p tcp –dport <PORT> -j DROP

7.Block outbound IP:PORT

iptables -A OUTPUT -p tcp -d <IP> –dport <PORT> -j DROP

8.Allow port 2222 for inbound tcp connections

iptables -A INPUT -p tcp –dport 2222 -j ACCEPT

9.White list an IP

iptables -A INPUT -i eth0 -s <IP> -j ACCEPT

10.Open port 5666

iptables -I INPUT -p tcp -m tcp –dport 5666 -j ACCEPT
11.Allow ALL Incoming SSH

The following rules allow ALL incoming ssh connections on eth0 interface.

iptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

12.Allow Incoming SSH only from a Sepcific Network

The following rules allow incoming ssh connections only from 192.168.100.X network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0″.

13. Allow Incoming HTTP and HTTPS

The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.

iptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT

The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.

iptables -A INPUT -i eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPT

14.Combine Multiple Rules Together using MultiPorts

When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.

The following example allows all incoming SSH, HTTP and HTTPS traffic.

iptables -A INPUT -i eth0 -p tcp -m multiport –dports 22,80,443 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport –sports 22,80,443 -m state –state ESTABLISHED -j ACCEPT

15.Allow Outgoing SSH

The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.

iptables -A OUTPUT -o eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on  the INPUT chain. For the incoming rule, it is vice versa.

16.Allow Outgoing SSH only to a Specific Network

The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.

iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

17.Allow Ping from Outside to Inside

The following rules allow outside users to be able to ping your servers.
iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT
19.Allow Loopback Access

You should allow full loopback access on your servers. i.e access using 127.0.0.1

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

20. Allow MySQL connection only from a specific network

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 3306 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 3306 -m state –state ESTABLISHED -j ACCEPT

21.Prevent DoS Attack

The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.

iptables -A INPUT -p tcp –dport 80 -m limit –limit 25/minute –limit-burst 1000 -j ACCEPT
In the above example:
-m limit: This uses the limit iptables extension

–limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
–limit-burst 1000: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.

22.Port forwarding using IPTables

Forward port 80 from IP address to another IP

iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to <DESTIP>:80
iptables -t nat -A POSTROUTING -p tcp –dst <DESTIP> –dport 80 -j SNAT –to <SRCIP>
iptables -t nat -A OUTPUT –dst <SRC> -p tcp –dport 80 -j DNAT –to <DESTIP>:80

Removing the above rules
iptables -t nat -D PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to <DESTIP>:80
iptables -t nat -D POSTROUTING -p tcp –dst <DESTIP> –dport 80 -j SNAT –to <SRCIP>
iptables -t nat -d OUTPUT –dst <SRC> -p tcp –dport 80 -j DNAT –to <DESTIP>:80

23.List all the rules in the iptables

iptables  -L

24.Check an IP in the rule

iptables -nL | grep <IP>

25.Save the current iptables rules

iptables-save >  File_name

26.Restore iptable rules from the file

iptables-restore <  File_name

MSSQL support to PHP in cpanel server

To use the MSSQL extension on Unix/Linux, you first need to build and install the FreeTDS library. FreeTDS is a set of libraries for Unix and Linux that allows your programs to natively talk to Microsoft SQL Server and Sybase databases.

You can refer to the following url to get informations about mssql extension and  the functions supported with it.
http://www.php.net/manual/en/book.mssql.php

To get these functions to work, you have to compile PHP with –with-mssql[=DIR] , where DIR is the FreeTDS install prefix. And FreeTDS should be compiled using
–enable-msdblib

Installation instruction:-

(This is not specific to cpanel servers, you can recompile php directly without easyapache in any normal linux servers with ‘–with-mssql=/usr/local/freetds’)

1-. Download freetds source -> www.freetds.org
2-. tar -zxvf freetds-stable-tgz
3-. cd freetds-*
4-. ./configure –prefix=/usr/local/freetds –with-tdsver=8.0 –enable-msdblib  –with-gnu-ld

Note: If you use SQL 2000, 2005, 2008 then tds version = 8.0
if you use SQL 7.0 then tds version = 7.0

5-. make
6-. make install
7-. To check freetds working, run from terminal
7.1 /usr/local/freetds/bin/tsql -S <ip of the server> -U <User SQL>
7.2 If the connection parameters are correct you will be connected to a prompt.
8-. Add the following text in freetds.conf ( /usr/local/freetds/etc )
[TDS]
host = <ip of the Server with Sql>
port = 1433
tds version = 8.0

9-. Add the following line in the file /etc/ld.so.conf and run ldconfig -v:
include /usr/local/freetds/lib

10-. Recompile PHP with –with-mssql=/usr/local/freetds flag.
Create a file called all_php4 or all_php5 in:

‘/var/cpanel/easy/apache/rawopts/’

The file doesnt exist by default, just create it and add this line to the file:
–with-mssql=/usr/local/freetds
Easy apache will check this file ‘/var/cpanel/easy/apache/rawopts/all_php5’ for any additional php configuration option during recompilation.

11-. Run ‘/scripts/easyapache’

Notes:-

1-. If you are running a 64bit OS and get an error about configure: error: ‘Could not find /usr/local/freetds/lib64/libsybdb.a|so’
then you need to do the following:
1.1 Make sure libsybdb.so is available on the server,then
1.2 ln -s /usr/local/freetds/lib/libsybdb.so.5 /usr/lib64/libsybdb.so.5
1.3 ln -s /usr/local/freetds/lib/libsybdb.so.5 /usr/local/freetds/lib64/libsybdb.so
1.4 Run   ldconfig -v

2-. If you are getting an error about configure:’ error: Directory /usr/local/freetds is not a FreeTDS installation directory’
2.1 cp [tds source]/include/tds.h /usr/local/freetds/include
2.2 cp [tds source]src/tds/.libs/libtds.a /usr/local/freetds/lib
2.3 Recompile again.

Reference:-

http://www.freetds.org/userguide/
http://www.php.net/manual/en/book.mssql.php
http://forums.cpanel.net

Powered by WordPress & Theme by Anders Norén