LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-05-2007, 11:03 PM   #1
brave heart
Member
 
Registered: Mar 2007
Distribution: Fedora-14
Posts: 155
Blog Entries: 8

Rep: Reputation: 15
Unhappy Use SSH must stop the iptables.


Dear all:

I want to SSH an RH(kernel-2.4.20-8). I can access it if iptables is stop.
Otherwise, I can't access it.

The "/etc/sysconfig/iptables" as below:
#ll configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68
-i eth0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68
-i eth1 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
#-A RH-Lokkit-0-50-INPUT -p tcp --dport 22 -j ACCEPT
#-A RH-Lokkit-0-50-OUTPUT -p tcp --dport 22 -j ACCEPT
COMMIT

If I delete the"#"in the last 2 rows, restart the iptables will fail.

Any help will be appreciated.

Thanks,
 
Old 04-06-2007, 07:57 AM   #2
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 416Reputation: 416Reputation: 416Reputation: 416Reputation: 416
Actually you don't have a firewall at all, even when it is running:

Quote:
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
By having your defaults set to ACCEPT, absolutely EVERYTHING not explicitly dropped is being allowed. It should be the other way around. You should drop everything and only allow the traffic you want.

Now with that said, its really not clear which combination of rules is causing the trouble. Certainly allowing port 22 on the INPUT chain is required, but this line:
Quote:
#-A RH-Lokkit-0-50-OUTPUT -p tcp --dport 22 -j ACCEPT
Is likely to be useless. The SSH server is listening on port 22, but you really have no idea what port the SSH client is using. It may very well not be port 22. I'm guessing that all the other stuff your dropping is causing the problem. I'm guessing that since you're dropping all sorts of syn packets, that is preventing SSH from working properly. Believe it or not, syn packets are required for TCP/IP to work, so dropping random port ranges is probably not a good idea.
 
Old 04-09-2007, 03:35 AM   #3
brave heart
Member
 
Registered: Mar 2007
Distribution: Fedora-14
Posts: 155
Blog Entries: 8

Original Poster
Rep: Reputation: 15
Thanks, Hangdog42.



This time I modified my "/etc/sysconfig/iptables" like below:

#ll configuration written by lokkit

# Manual customization of this file is not recommended.

# Note: ifup-post will punch the current nameservers through the

# firewall; such entries will *not* be listed here.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Lokkit-0-50-INPUT - [0:0]

-A INPUT -j RH-Lokkit-0-50-INPUT

-A FORWARD -j RH-Lokkit-0-50-INPUT

-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68

-i eth0 -j ACCEPT

-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68

-i eth1 -j ACCEPT

-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT

#-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT

#-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT

-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp --dport 22 -j ACCEPT

COMMIT


and after I restart iptables, I got following results:
# service iptables restart
Flushing all current rules and user defined chains: [ OK ]
Clearing all current rules and user defined chains: [ OK ]
Applying iptables firewall rules: iptables-restore v1.2.7a: no command specified
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
 
Old 04-09-2007, 09:19 AM   #4
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 416Reputation: 416Reputation: 416Reputation: 416Reputation: 416
I'm not sure what tool you would use to modify your firewall (posting your distro might help) but you're probably looking for a firewall that looks something like this:

Code:
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
This firewall is oversimplified, but maybe it will help you see where to go. Notice that the table defaults are all set to DROP. Then I've allowed ESTABLISHED and RELATED packets in. That allows returned packets from any process originating on my machine to come back. The OUTPUT chain is pretty wide open.

The port 22 rule should let in SSH traffic (it would be NEW, so it would fail the ESTABLISHED and RELATED input rule) and the existing OUTPUT would let the traffic back out.

I really think that your existing firewall is a mess, and it is likely causing problems. If I were in your shoes, I would ditch it entirely and get one in place that you do understand.
 
Old 04-10-2007, 03:17 AM   #5
brave heart
Member
 
Registered: Mar 2007
Distribution: Fedora-14
Posts: 155
Blog Entries: 8

Original Poster
Rep: Reputation: 15
Thanks, man.

Quote:
I really think that your existing firewall is a mess, and it is likely causing problems. If I were in your shoes, I would ditch it entirely and get one in place that you do understand.
Ok, man. I agree with you. Could you please teach how to ditch it out and patch a new one?

Thanks,
 
Old 04-10-2007, 08:07 AM   #6
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 416Reputation: 416Reputation: 416Reputation: 416Reputation: 416
I gather that you're using some flavor of Red Hat/Fedora and I believe that their firewall is controlled by some GUI tool. How did you get your existing firewall? It doesn't look like a default set of rules, so the same way you created this one should let you create a better set of rules. Knowing what distro you're actually using might help us point you in the right direction.
 
Old 04-10-2007, 10:45 PM   #7
brave heart
Member
 
Registered: Mar 2007
Distribution: Fedora-14
Posts: 155
Blog Entries: 8

Original Poster
Rep: Reputation: 15
I used RH9 and the firewall settings as default.

:-)
 
Old 04-11-2007, 08:24 AM   #8
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 416Reputation: 416Reputation: 416Reputation: 416Reputation: 416
Quote:
I used RH9
And you're trying to use this as a server exposed to the Internet???????????

A piece of friendly advice: Ditch this distro NOW if not sooner. RH9 has not had any support for a number of years, and there are many, many, many security holes in it. All you're doing with this box is making some botnet owner very happy because they will have another easy-to-crack machine available.

Seriously, you need a newer distro.
 
Old 04-11-2007, 11:25 PM   #9
brave heart
Member
 
Registered: Mar 2007
Distribution: Fedora-14
Posts: 155
Blog Entries: 8

Original Poster
Rep: Reputation: 15
I just use this RH for internal learning purpose. And it's not exposed to the internet!

Anyway, thanks for reminding!
 
Old 04-12-2007, 07:42 AM   #10
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 416Reputation: 416Reputation: 416Reputation: 416Reputation: 416
Ah, good. As a learning tool, RH9 is probably OK. I'd still give some thought to grabbing a newer distro as RH9 is pretty dated.

If you don't know or can't find the RH9 firewall GUI tool, you could always write your own firewall script and then run that. As long as you run it at the end of the RH9 boot, it should replace the default firewall.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to stop Iptables service? Infernal211283 Slackware 5 08-03-2006 12:35 AM
iptables: how to stop any logging? gjhicks Linux - Networking 3 05-17-2006 08:18 AM
iptables refusing to stop kg4ysy Linux - Software 2 01-25-2006 09:28 AM
A small program to stop iptables satimis Linux - Newbie 6 09-15-2003 01:04 AM
Stop SSH... connecting from outside SchwipSchwap Linux - Newbie 10 08-21-2002 07:00 AM


All times are GMT -5. The time now is 06:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration