Archive

Articles taggués ‘fail2ban’

Linux Security Basics

16/01/2019 Comments off

One of the most daunting prospects of administering your own server on a public network is dealing with your server’s security. While security threats in a networked world are real and it is always important to be mindful of security issues, protecting against possible attacks is often a matter of exercising basic common sense and adhering to some general best practices.

This guide takes a broad overview of common security concerns and provides a number of possible solutions to common security problems. You are encouraged to consider deploying some of these measures to “harden” your server against possible attacks.

It’s important to remember that all of the solutions we present in this document are targeted at specific kinds of attacks, which themselves may be relevant only in specific configurations. Security solutions need to be tailored to the kind of services that you’re providing and the software you’re running, and the decision whether or not to deploy a specific security solution is often a matter of personal discretion and cost-benefit analysis.

Perhaps most importantly, it should be understood that security is a process, not a product (credit to Bruce Schneier.) There is no “magic bullet” set of guidelines that can be followed to ensure the security of any system. Threats are constantly evolving, so vigilance is required on the part of network administrators to prevent unauthorized access to systems.

Keep Systems and Software Up To Date

One of the most significant sources of security vulnerabilities are systems running out of date software with known security holes. Make a point of using your system’s package management tools to keep your software up to date; this will greatly assist in avoiding easily preventable security intrusions.

Running system updates with the package management tool, using apt-get update && apt-get upgrade (for Debian and Ubuntu Systems) or yum update (for CentOS and Fedora systems) is simple and straightforward. This practice ensures that if your distribution maintains active security updates, your system will be guarded against many security holes in commonly used software packages.

System update tools will, however, not keep software up to date that you’ve installed outside of package management. This includes software that you’ve compiled and installed “by hand” (e.g. with ./configure && make && make install) and web-based applications that you’ve installed from a software developer’s site, as is often the case with applications like WordPress and Drupal. Also excluded from protection will be libraries and packages you’ve installed with supplementary package management tools like Ruby’s Gems, Perl’s CPAN tool, Python easy_install, and Haskell Cabal. You will have to manage the process of keeping these files up to date yourself.

The method you use to make sure that your entire system is kept up to date is a matter of personal preference, and depends on the nature of your workflow. We would recommend trying very hard to use the versions of software provided by your operating system or other programming platform-specific package management tools. If you must install from “source,” we would recommend that you save the tarballs and source files for all such software in /src/ or ~/src/ so that you can keep track of what software you’ve installed in this manner. Often, you can remove a manually compiled application by issuing make uninstall in the source repository (directory). Additionally, it may be helpful to maintain a list of manually installed software, with version numbers and download locations. You may also want to investigate packaging your own software so that you can install it with apt, yum or pacman.

Because of the complexity of maintaining software outside of the system’s package management tools we strongly recommend avoiding manually installing software unless absolutely necessary. Your choice in a Linux distribution should be heavily biased by the availability of software in that distro’s repositories for the systems you need to run on your server.

Lire la suite…

Basic iptables Rulesets for IPv4 and IPv6

13/01/2019 Comments off

iptables ipv4Appropriate firewall rules heavily depend on the services being run. Below are iptables rulesets to secure your Linode if you’re running a web server. These are given as an example! A real production web server may want or require more or less configuration and these rules would not be appropriate for a file or database server, Minecraft or VPN server, etc.

iptables rules can always be modified or reset later, but these basic rulesets serve only as a beginning demonstration.

IPv4

/tmp/v4
*filter

# Allow all loopback (lo0) traffic and reject traffic
# to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

# Allow ping and traceroute.
-A INPUT -p icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp --icmp-type 11 -j ACCEPT

# Allow SSH connections.
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow HTTP and HTTPS connections from anywhere
# (the normal ports for web servers).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Accept inbound traffic from established connections.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log what was incoming but denied (optional but useful).
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 7

# Reject all other inbound.
-A INPUT -j REJECT

# Log any traffic which was sent to you
# for forwarding (optional but useful).
-A FORWARD -m limit --limit 5/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 7

# Reject all traffic forwarding.
-A FORWARD -j REJECT

COMMIT


Optional: If you plan to use Linode Longview, add this additional rule below the section for allowing HTTP and HTTPS connections:
# Allow incoming Longview connections 
-A INPUT -s longview.linode.com -m state --state NEW -j ACCEPT

 

Lire la suite…

Block WordPress xmlprc.php DDOS attacks using Fail2Ban

11/01/2019 Comments off

Few days ago, my friend’s WordPress website went down. After investigation, I have figured out that it was receiving massive amount of posts requests to the xmlrpc.php file, which brings the apache and mysql to eat up all the system resources and the website crashed. Fortunately, I have figured out the way to mitigate this attack using Fail2Ban, which I’ll share in this post.

Install the Fail2Ban package using the following command:

apt-get install fail2ban iptables

1Make a local copy of jail.conf file for configuration change:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

2

Lire la suite…

Linux Iptables Avoid IP Spoofing And Bad Addresses Attacks

25/12/2018 Comments off

Source: nixCraft

Spoofing and bad address attack tries to fool the server and try to claim that packets had come from local address/network.

Following IP/netwok address are know to open this kind of attack:

Incoming source IP address is your servers IP address

Bad incoming address from following ranges:

  • 0.0.0.0/8
  • 127.0.0.0/8
  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16
  • 192.168.0.0/16
  • 224.0.0.0/3
  • Your own internal server/network ip address/ranges.

Lire la suite…

Configuration d’un serveur dédié de A à Z

15/12/2018 Comments off

Installation, configuration et administration d’un serveur dédié

debianCes tutoriaux ont été réalisés sous Debian (versions Etch 4.0 et Lenny 5.0) mais peuvent être transposés à d’autres distributions Linux, notamment Ubuntu. Ils sont applicables aux serveurs dédiés 1&1, Dedibox, OVH, Amen, et bien d’autres.

warning Tous les tutoriaux sont basés sur un serveur nommé test.alsacreations.com pour lequel nous disposons d’un utilisateur dew et d’un accès root (super-administrateur), chacun avec leur propre mot de passe.

Nous partons de l’idée d’obtenir un serveur web avec tout ce qu’il faut pour héberger plusieurs domaines et sites. Vous pouvez tout configurer à la main ou bien faire confiance à un panel d’administration.

Liste complète sans panel web

idee Ces tutoriaux conviennent à l’installation complète d’un serveur

  1. Première connexion : SSH, accès root et bases
  2. Apache et PHP : le serveur web
  3. MySQL : les bases de données
  4. Proftpd : le serveur FTP
  5. Postfix : le serveur mail POP3 et SMTP
  6. Sauvegarde automatique : avec backup-manager et export FTP
  7. Sécurisation : les règles de base, un firewall avec iptables, fail2ban…
  8. Bind : exécuter le serveur DNS en chroot
  9. Monitoring : garder un oeil sur son serveur grâce à monit et logwatch
  10. Roundcube : un webmail léger et rapide

Liste complète avec panel d’administration DTC

dtclogo

idee Si vous choisissez d’installer le panel d’administration DTC, suivez ces tutoriels. DTC se chargera de la configuration du reste des services.

  1. Première connexion : SSH, accès root et bases
  2. Bind : exécuter le serveur DNS en chroot
  3. Sécurisation : les règles de base, un firewall avec iptables, fail2ban…
  4. Panel DTC : pour installer et gérer les services web, ftp, mysql, e-mail, dns…
  5. Monitoring : garder un oeil sur son serveur grâce à monit et logwatch
  6. Sauvegarde automatique : backup-manager et export FTP
  7. Roundcube : un webmail léger et rapide

Attention : nous préconisons désormais l’utilisation du panel ISPConfig, en lieu et place du panel DTC. Il est tout aussi simple à installer et à utiliser. Veuillez vous référer à sa documentation.