LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 02-23-2010, 01:23 AM   #1
paranoid times
Member
 
Registered: Jan 2005
Distribution: Fedora Core 3, 4
Posts: 135

Rep: Reputation: 16
Add rule to iptables on login.


I'm looking for a way to add a rule that would whitelist my ip address when I login with SSH. I can grab the IP out of the SSH_CONNECTION variable, however I'm not sure how I could add it into iptables with my non-root privileged user. I've got root access, but I want the process to be automatic. I considered sudo, however I don't want normal users to be able to modify anything about iptables, though perhaps there is a trick about it that I don't know which would only allow it in the /etc/profile or the like.

Any ideas on how I could do this?

Thanks,
Michael
 
Old 02-23-2010, 07:56 AM   #2
centosboy
Senior Member
 
Registered: May 2009
Location: london
Distribution: centos5
Posts: 1,137

Rep: Reputation: 116Reputation: 116
Quote:
Originally Posted by paranoid times View Post
I'm looking for a way to add a rule that would whitelist my ip address when I login with SSH. I can grab the IP out of the SSH_CONNECTION variable, however I'm not sure how I could add it into iptables with my non-root privileged user. I've got root access, but I want the process to be automatic. I considered sudo, however I don't want normal users to be able to modify anything about iptables, though perhaps there is a trick about it that I don't know which would only allow it in the /etc/profile or the like.

Any ideas on how I could do this?

Thanks,
Michael

use sudo.
just make sure only you have access to /sbin/iptables as a sudo user.
yes, the command can be added in your .bash_profile



sudo file

Code:
# Cmnd alias specification
Cmnd_Alias IP = IPTABLES /sbin/iptables

# User privilege specification
username ALL=IPTABLES, NOPASSWD: IPTABLES

then just add the relevant command to .bash_profile or start up file of your choice
 
Old 02-23-2010, 12:36 PM   #3
paranoid times
Member
 
Registered: Jan 2005
Distribution: Fedora Core 3, 4
Posts: 135

Original Poster
Rep: Reputation: 16
Well that could work. The only thing is I was hoping to have all users who successfully login be whitelisted. I can't think of a not ugly way to do that without giving everyone iptables access.

Unless there is some way to have sshd run a command after a successful login. That should be run as root and potentially would only happen during a ssh login. Knowing ssh it would be viewed as a major security flaw and is probably denied.

Well still looking around for that perfect solution. But for now I think I'll go with iptables restricted to me with sudo. Thank you for the suggestion.
 
Old 02-23-2010, 07:04 PM   #4
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.5, Centos 5.10
Posts: 16,225

Rep: Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021Reputation: 2021
I'd look at ForceCommand http://www.openbsd.org/cgi-bin/man.c...nfig&sektion=5 and possibly Subsystem.
Quote:
ForceCommand
Forces the execution of the command specified by ForceCommand,
ignoring any command supplied by the client and ~/.ssh/rc if pre-
sent. The command is invoked by using the user's login shell
with the -c option. This applies to shell, command, or subsystem
execution. It is most useful inside a Match block. The command
originally supplied by the client is available in the
SSH_ORIGINAL_COMMAND environment variable. Specifying a command
of ``internal-sftp'' will force the use of an in-process sftp
server that requires no support files when used with
ChrootDirectory.
Hopefully 'user's login shell' means their shell eg bash, but run as sshd and give sshd sudo access to iptables.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables(marking) + ip rule add fwmark 1 table 200 + ip route add via GW table 200 ?? amitsharma_26 Linux - Networking 9 05-26-2010 06:42 AM
how can i add rtp protocol to my iptables rule of netfilter hdinn Linux - Newbie 1 07-30-2009 07:12 PM
how can i add the rtp protocol to my iptables rule hdinn Linux - Networking 1 07-29-2009 12:29 PM
iptables problem after del add a rule oknets10 Linux - Networking 4 03-24-2008 04:13 AM
Add temporary rule to Iptables rickh Linux - Security 3 03-04-2008 10:10 AM


All times are GMT -5. The time now is 05:36 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration