LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 07-17-2008, 04:58 PM   #1
s.naing
LQ Newbie
 
Registered: Jul 2008
Posts: 3

Rep: Reputation: 0
Lightbulb Installing iptables on DS-106j from Synology


I've been searching for a solution to be able to tewak iptables that I installed on the NAS DS-106j from Synology www.synology.com. It is (as far as I know) running on BusyBox linux. This NAS has openSSH pre-installed and I just want to install iptables or pam abl to protect against SSH brute force. I did the same thing with Ubuntu openSSH and there was no problem installing them. But this time, I am using ipkg to install iptables and when I try to set the firewall to my needs, it gave out errors. Please see the following.

SynoBox> ipkg install iptables
Installing iptables (1.2.11-2) to /opt/...
Downloading http://ipkg.nslu2-linux.org/feeds/optwa ... owerpc.ipk
Configuring iptables
Successfully terminated.

Then I run the following just to see if there is an update already available for iptables
SynoBox> ipkg install update

When I try to configure iptables on the box with the same script I used for my openssh running on Ubuntu, it spits out the error message.

-------------------------------------------------------------------------
SynoBox> iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH

iptables v1.2.11: Couldn't load match `recent':/opt/lib/iptables/libipt_recent.so: cannot open shared object file: No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
-------------------------------------------------------------------------

So I tried again with a small step just to create a new rule.

SynoBox>iptables -N recent_rule
iptables v1.2.11: can't initialize iptables table `filter': iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

I tried the following to see if there is any rule already exists and it gave out the same error message as before:
---------------------------------------------------------------------
SynoBox>iptables -L
iptables v1.2.11: can't initialize iptables table `filter': iptables who? (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
---------------------------------------------------------------------
Any idea how to proceed?

Thanks.

Last edited by s.naing; 07-17-2008 at 05:02 PM.
 
Old 07-17-2008, 05:57 PM   #2
jomen
Senior Member
 
Registered: May 2004
Location: Leipzig/Germany
Distribution: Arch
Posts: 1,687

Rep: Reputation: 55
just some commands - you will get the meaning:
ipkg update (update the database of available packages)
ipkg list (what is available)
ipkg status (what is installed)
ls -al /lib/modules/`uname -r`/ | grep recent
lsmod | grep recent
(is this module loaded?)
insmod ipt_recent (load it)
or
modprobe ipt_recent
should you have "modprobe" available
 
Old 07-19-2008, 03:23 AM   #3
s.naing
LQ Newbie
 
Registered: Jul 2008
Posts: 3

Original Poster
Rep: Reputation: 0
I got the following very long list (I had to cut list by 3/4 to post it on this forum) when I run ipkg list:

GhostDrive> ipkg list
ipac-ng - 1.31-3 - iptables/ipchains based IP accounting package for Linux.
ipcalc - 0.41-1 - Calculator for IPv4 addresses.
iperf - 2.0.4-1 - A tool for measuring TCP and UDP bandwidth performance.
ipkg-opt - 0.99.163-10 - The Itsy Package Manager
ipkg-web - 7-7 - A web frontend for ipkg
iptables - 1.2.11-2 - Userland utilities for controlling firewalling rules
iptraf - 3.0.0-1 - IPTraf is a console-based network statistics utility for Linux.
iputils-arping - 20070202-1 - The arping command acts like the standard ping command except it pings a machine by its ARP address instead of its IP address.
ipython-common - 0.8.4-1 - An enhanced interactive Python shell
ircd-hybrid - 7.2.2-1 - IRCD Hybrid
irssi - 0.8.12-3 - A terminal based IRC client for UNIX systems.
ivorbis-tools - 1.0-6 - Tools to allow you to play, encode, and manage Ogg Vorbis files. This version is hacked to use the Tremor integer decoder.
jabberd - 1.6.1.1-1 - Jabber is an open-source IM platform designed to be open, fast, and easy to use and extend.
jamvm - 1.5.1-1 - VM spec version 2 conformant. Extremely small with stripped executable
jed - 0.99.18-1 - A powerful yet friendly text editor.
jikes - 1.22-1 - IBM java compiler
joe - 3.5-1 - Joe's own editor. A text editor with wordstar-like and emacs-like keybindings.
jove - 4.16.0.70-2 - A tiny, fast editor with emacs keybindings
kernel-module-audio - 2.4.22-6 - DS-101G+ kernel module audio
kernel-module-cdrom - 2.4.22-6 - DS-101G+ kernel module cdrom
kernel-module-dss1-divert - 2.4.22-6 - DS-101G+ kernel module dss1_divert
kernel-module-ethertap - 2.4.22-6 - DS-101G+ kernel module ethertap
kernel-module-fuse - 2.5.3-3 - With FUSE it is possible to implement a fully functional filesystem in a userspace program
kernel-module-hfc-usb - 2.4.22-6 - DS-101G+ kernel module hfc_usb
kernel-module-hisax - 2.4.22-6 - DS-101G+ kernel module hisax
kernel-module-isdn - 2.4.22-6 - DS-101G+ kernel module isdn
kernel-module-isdn-bsdcomp - 2.4.22-6 - DS-101G+ kernel module isdn_bsdcomp
kernel-module-isofs - 2.4.22-6 - DS-101G+ kernel module isofs
kernel-module-loop - 2.4.22-6 - DS-101G+ kernel module loop
kernel-module-nfsd - 2.4.22-6 - DS-101G+ kernel module nfsd
kernel-module-pwc - 2.4.22-6 - DS-101G+ kernel module pwc
kernel-module-rtl8150 - 2.4.22-6 - DS-101G+ kernel module rtl8150
kernel-module-slhc - 2.4.22-6 - DS-101G+ kernel module slhc
kernel-module-soundcore - 2.4.22-6 - DS-101G+ kernel module soundcore
kernel-module-sr-mod - 2.4.22-6 - DS-101G+ kernel module sr_mod
kernel-module-tun - 2.4.22-6 - DS-101G+ kernel module tun
kernel-module-videodev - 2.4.22-6 - DS-101G+ kernel module videodev
keychain - 2.6.8-1 - Key manager for OpenSSH.
kismet - 2007-01-R1b-2 - An 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.
kissdx - 0.13-10a-2 - kissdx is a PC-Link clone for KiSS media players with added features for DVD, video and picture playback.
knock - 0.5-2 - knockd is a port-knock server. It listens to all traffic on an ethernet (or PPP) interface, looking for special knock sequences
lame - 3.97-1 - LAME is an LGPL MP3 encoder.


I got the following when I run ipkg status:
Package: iptables
Version: 1.2.11-2
Status: install user installed
Architecture: powerpc
Installed-Time: 1215903227

Package: openssl
Version: 0.9.7m-4
Status: install user installed
Architecture: powerpc

Package: wget-ssl
Version: 1.11.4-1
Depends: openssl
Conflicts: wget
Status: install user installed
Architecture: powerpc

Successfully terminated.

I did not get anything when I run lsmod |grep recent.

But I got this when I enter lsmod grep recent:
Module Size Used by Tainted: P
hid 18308 0
printer 8048 0
usb-storage 29828 1
usb-ohci 20020 0 (unused)
ehci-hcd 19716 0 (unused)
synobios 8176 4
sk98lin 148944 1
snd-pcm-oss 45532 0 (unused)
snd-mixer-oss 15256 0 [snd-pcm-oss]
snd-usb-audio 51048 0 (unused)
snd-pcm 63700 0 [snd-pcm-oss snd-usb-audio]
snd-timer 17480 0 [snd-pcm]
snd-hwdep 5768 0 [snd-usb-audio]
snd-usb-lib 11092 0 [snd-usb-audio]
snd-rawmidi 16308 0 [snd-usb-lib]
snd-seq-device 4664 0 [snd-rawmidi]
snd 38488 0 [snd-pcm-oss snd-mixer-oss snd-usb-audio snd-pcm snd-timer snd-hwdep snd-usb-lib snd-rawmidi snd-seq-device]
snd-page-alloc 5488 0 [snd-mixer-oss snd-usb-audio snd-pcm snd-timer snd-hwdep snd-rawmidi snd-seq-device snd]
soundcore 3952 0 [snd]
nfsd 71248 0 (unused)
ppp_async 8204 0 (unused)
ppp_generic 20316 0 [ppp_async]
slhc 4224 0 [ppp_generic]
quota_v2 8160 2
usbcore 69520 1 [hid printer usb-storage usb-ohci ehci-hcd snd-usb-audio snd-usb-lib]
sg 33804 0 (unused)
sd_mod 16212 2 [printer usb-storage]
scsi_mod 90016 3 [usb-storage sg sd_mod]
ntfs 94080 0 (unused)
vfat 11308 0 (unused)
reiserfs 243776 0 (unused)
netlink_dev 2016 0 (unused)
fat 40176 0 [vfat]
appletalk 23440 12

I got error message when I enter ls -al /lib/modules/'uname -r' / | grep recent:

ls: /lib/modules/uname -r: No such file or directory

I got this when I run insmod ipt_recent:
insmod: /lib/modules/2.4.22-uc0: No such file or directory
insmod: ipt_recent.o: no module by that name found

I got this when I run modprobe ipt_recent:
modprobe: could not parse modules.dep

I have no idea what's going on.
 
Old 07-19-2008, 04:18 AM   #4
jomen
Senior Member
 
Registered: May 2004
Location: Leipzig/Germany
Distribution: Arch
Posts: 1,687

Rep: Reputation: 55
You want to use an iptables rule which makes use of the "recent" match.
This is not part of your installation - not yet.

The commands I posted where to:
- show what software is available to you,
- show what software is already installed,
- show what modules are available to you,
- show what modules are already loaded,
- try to load the module - had it been available to you

Quote:
I got error message when I enter ls -al /lib/modules/'uname -r' / | grep recent:
ls: /lib/modules/uname -r: No such file or directory
There is a difference between:
Code:
ls -al /lib/modules/'uname -r' / | grep recent
and
ls -al /lib/modules/`uname -r`/ | grep recent
the latter is what I wrote - and which will work.

It lists the contents of the directory named after your kernel-version, where all modules are stored - and filters the list for the module you want.
Code:
ls -al /lib/modules/2.4.22-uc0/ | grep recent
will also do.
Or look at:
ls -al /lib/modules/2.4.22-uc0/
for all installed modules.

You will need to install some software to to get support for the "recent" match.
I don't know exactly which and if it is even called the same name for you.
I can only tell you what I have installed here ("recent" match is working):

Code:
root@112-2:~# ls -al /lib/modules/`uname -r`/ | grep recent
-rw-rw-r--    1 root     root        14292 Feb 26 20:52 ipt_recent.o
Kernel is 2.4.30

ipkg install iptables-mod-filter
ipkg install tc
ipkg install iptables-mod-conntrack
ipkg install iptables-mod-ipopt
ipkg install iptables-extra
ipkg install freifunk-openwrt-compat
The last one is most definitely not available to you - the second one (tc) is one you will not need.
In one of the others is the module and library you need to use the "recent" match.

I'm talking an example here - the example is OpenWRT on a MIPS based system - and the software available to it.

Again: I don't know your system or what software is available for it - you will need to read through the packets descriptions - or go to the manufacturers website and look there for descriptions.

Last edited by jomen; 07-19-2008 at 04:22 AM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables 1.27a still loading rules after installing iptables 1.3.0 yawe_frek Linux - Software 1 06-07-2007 09:50 PM
Synology with BusyBox, want compiler and downloader t3ch Linux - Newbie 1 02-13-2007 07:17 PM
Error While Installing IpTables winxlinx Linux - Networking 8 05-03-2006 07:37 AM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 08:20 PM
Installing iptables 1.2.4 phil1076 Linux - General 0 10-25-2001 10:51 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:52 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration