Delete iptables Rule - The Easy Way

Iptables is the name of the basic firewall installed in linux servers.

Check if iptables has listed your IP.
----
root@server1 [~]# iptables -nL | grep 115.248.152.21
DROP all -- 115.248.152.21 0.0.0.0/0
DROP all -- 0.0.0.0/0 115.248.152.21
----

Run iptables-save | grep 115.248.152.21 to get the exact rule command used to enabled the block. You will get output similar to this:
----
root@server1 [~]# iptables-save | grep 115.248.152.21
-A LOCALINPUT -s 115.248.152.21/32 ! -i lo -j DROP
-A LOCALOUTPUT -d 115.248.152.21/32 ! -o lo -j DROP
----
Take this command, replace the -A with -D and run it through iptables.
----
root@server1 [~]# iptables -D LOCALINPUT -s 115.248.152.21/32 ! -i lo -j DROP
root@server1 [~]# iptables -D LOCALOUTPUT -d 115.248.152.21/32 ! -o lo -j DROP
----
Thats It. :)

Read more »

Installing GeoIP / How to install GeoIP

GeoIP can be used in your server to locate and track visitors visiting your webpage. GeoIP provide valuable knowledge about your Internet visitors seamlessly and in real-time.GeoIP is a package used to determine the geographical location and other information like client’s region, city, longitude/latitude, connection speed, ISP, as well as company name.

Given below are the steps to install GeoIP:

[hari]$ sudo apt-get install geoip-bin
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
geoip-bin
0 upgraded, 1 newly installed, 0 to remove and 131 not upgraded.
Need to get 15.3 kB of archives.
After this operation, 119 kB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
geoip-bin
Install these packages without verification [y/N]? y
Get:1 http://archive.ubuntu.com/ubuntu/ natty/universe geoip-bin i386 1.4.7~beta6+dfsg-1 [15.3 kB]
Fetched 15.3 kB in 1s (11.3 kB/s)
Selecting previously deselected package geoip-bin.
(Reading database ... 538222 files and directories currently installed.)
Unpacking geoip-bin (from .../geoip-bin_1.4.7~beta6+dfsg-1_i386.deb) ...
Processing triggers for man-db ...
Setting up geoip-bin (1.4.7~beta6+dfsg-1) ...

When we install wordpress we get a sample wp-config file. Similarly we get a geoip sample configuration file at the following location.
/etc/GeoIP.conf.default
Rename it to make it your configuration file.

[hari]$ mv /etc/GeoIP.conf.default /etc/GeoIP.conf

Now open the file  /etc/GeoIP.conf using your favorite editor to enter the user_id and license information.
[hari]$ vim  /etc/GeoIP.conf
# If you purchase a subscription to the GeoIP database,
# then you will obtain a license key which you can
# use to automatically obtain updates.
# for more details, please go to
# http://www.maxmind.com/app/products

# see https://www.maxmind.com/app/license_key_login to obtain License Key,
# UserId, and available ProductIds

# Enter your license key here
LicenseKey

# Enter your User ID here
UserId

# Enter the Product ID(s) of the database(s) you would like to update
# By default 106 (MaxMind GeoIP Country) is listed below

You can also use GeoIP without purchasing license from the maxmind but it provides only limited support.

Sample Output

[hari]$ geoiplookup 8.8.4.4
GeoIP Country Edition: US, United States

Read more »

Basic steps to secure the server

To prevent exploits in our server, we can do some simple yet effective steps to secure our linux server. Its better late than never :)

Disable SUID
Change ssh port
Disable root login
Disable unneeded services and check open ports.
Install a good firewall
Apply TCP wrappers
Install root kit detection
Install mod_security
Disable dangerous / unused PHP functions / harden your PHP

Regularly update you packages
Disable shell access to unwanted users.
Use only command line access.
Most important use long passwords for root (preferably 14-20 digits)
It is advisable to configure a backup on a weekly basis to a remote server or our local system.

Read more »

How to Block an IP in Windows

I did this in windows server 2003 not sure if these steps will work in other versions of windows.

Take Start menu and take Run else you can press windows key and R in your keyboard.
Type MMC in the box and press OK or hit enter.

Now a console windows will open up. Navigate through  'File' > 'Add/Remove Snap in'.
In the 'Standalone Tab' click The 'add' button.
Seclect 'IP Security Policy Managment' > 'ADD' > 'Local Computer' > 'finish' > 'close' > 'ok'.

After this you will be back to the console.
In the left frame right click 'IP security policies on local computer' > 'Create IP security policy'

Click Next and then name your policy 'Block IP' and type a description.

Click 'Next' then leave 'activate' ticked then click 'Next'

leave the 'edit properties ticked and click 'Finish'

You should now have the properties window open.

Click 'ADD' then click 'Next' to continue.

Leave 'This rule does not specify a tunnel' selected and click 'next'

Leave 'all network connections' selected and click 'next'

You should now be on the IP filter list. You need to create a new filter, so don't select any of the default ones. Click 'ADD'

Type a Name for your list, call it 'IP block list'
Type a description in, can be same as name.
Click 'ADD' then click 'Next' to continue.

In the description box type a description. As its the first IP you are blocking call it 'IP1' or 'IP Range 1'
Leave ticked the 'Mirrored. Match packets with the exact opposite source and destination addresses'
Click 'Next'
The 'Source address' should be left as 'My IP address' click 'Next'

You can now select 'A Specific IP address' or 'A Specific Subnet' for the Destination address.
Type in the IP address you want to block and if blocking a subnet type in the subnet block. Click 'next'

Leave the protocol type as 'Any' and click 'Next' and then 'Finish'

Read more »

TCP Wrapper

TCP Wrapper is used to filter network access to Internet and it can also be used to GRANT or DENY access to various services on your machine to the outside network or other machines on the same network.

You must note that the wrappers do not work with RPC services over TCP. Common services such as pop3, ftp, sshd, telnet, r-services are supported by TCP Wrappers. In linux its actually done by writing simple rules to two files:
1.  /etc/hosts.allow
2. /etc/hosts.deny
When the request for ssh comes it first checks the /etc/hosts.allow file if any rule for the sshd daemon is set in it else it will check for the same in /etc/hosts.deny file.

Examples:

/etc/hosts.allow file

[root@dedico ~]# cat /etc/hosts.allow
#
# hosts.allow    This file contains access rules which are used to
#        allow or deny connections to network services that
#        either use the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
#
ALL : .example.com

telnetd : 192.168.0.0/255.255.255.0 EXCEPT 192.168.0.79
sshd, in.tftpd : 192.168.1.10

The first line is a comment, the next line is to define the host example.com that can access to all services. The next line is to show that the telnet service can only be accessed from any host from the 192.168.0.0/24 segment except the IP address 192.168.0.79.

/etc/hosts.deny file

[root@dedico ~]# cat /etc/hosts.deny
#
# hosts.deny    This file contains access rules which are used to
#        deny connections to network services that either use
#        the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        The rules in this file can also be set up in
#        /etc/hosts.allow with a 'deny' option instead.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
#
ALL EXCEPT in.tftpd : .example.org
telnetd : ALL EXCEPT 192.168.1.10
ALL:ALL

The first line is to deny all tftp services from all hosts except for example.com. The next line is to deny all traffic to the telnet service from all hosts except from ip address 192.168.1.10.

Read more »