The Proftp server is set only to allow certain login user and from only certain IP addresses.

<Limit LOGIN>
Order Allow,Deny
Allow 104.235.22.123, 123.123.123.123, etc,
DenyAll
</Limit>

Question 1:
Is there a way to use xxx.noip.com, yyy.noip.com addressing vs. IP's?

Question 2:
If a NO on question 1 then how to I break the very long line of IP addresses into multiple lines.

I tried the usual backslash \ and no luck.

(What I am attempting is to create host look up and put only those IP addresses into the "Allow" line for all my clients. As is now that is going to be a nightmare.)

Thanks to all in advances.

I have not played with ProFTP but looks like you have to setup a class. It appears that you can use names with each one being on a separate line.

http://www.proftpd.org/docs/howto/Limit.html
www.proftpd.org/docs/howto/Classes.html

1 members found this post helpful.

Each IP address on one line is a good fix.

Allow 123.123.123.123
Allow 11.11.1.11
etc.

I can easily make a program to replace those who are on dynamic ISP connections when IP's change.


Thanks.

You could also program the iptables firewall to allow incoming connections to the port that proftpd is listening on only from specific IP addresses. I'm not sure, if you can get it to work on a dynamic dns service, but if you're paranoid you could try setting up a technique called port knocking.

1 members found this post helpful.

thanks. The "denyall" works nicely for all the others now that I can limit this down to a specific IP vs. ISP IP range for those dynamic users.

I would also suggest to double up on this security with the /etc/hosts.deny /etc/hosts.deny capabilities. This way if an update allows one function to be exploited, it will have a second layer of security.

using /etc/hosts.allow and /etc/hosts.deny to secure unix
https://jamalahmed.wordpress.com/201...o-secure-unix/

1 members found this post helpful.

Agreed; plus 3 other programs in use already... gotta keep those RIPE network hackers out.

Proper hardening should always consist of multiple layers but please don't present tcp_wrappers as a cure-all (note).

2 members found this post helpful.

Your correct, it is a bad habit by itself. I need to remember to state specifically that I have a preference to work with dynamic firewalls and tend to use hosts.deny for specific ports. Interesting though, did not know the part about the software requirements of libwrap.

1 members found this post helpful.

I never knew this till I read your note.

Our new servers are going to use both ways. But if you could be so kind or someone else, what would be the IPTABLES rule to stop all but 2 single IP addresses on EHT0 from getting in.


What I tried stops both WAN ETH0 & LAN ETH1 side which is nice once in a while but not always.

Say port 21 for the example & 123.123.123.124/30

Thanks to you experts.

25 Most Frequently Used Linux IPTables Rules Examples
http://www.thegeekstuff.com/2011/06/...ules-examples/

Take a look at example #5

I did this and I could still get in from the outside world on a different IP address on at least our servers.

You are getting a lot of different iptables information from a lot of different people, so I am guessing you might have a chained tables setup. Some people run a flat table which is easier to understand but very limited. For more advanced tables they run a chained tables to which I am not the most suited person to answer your question. I would though suggest to read up specifically on chained tables.

Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals
http://www.thegeekstuff.com/2011/01/...-fundamentals/

1 members found this post helpful.