How safe is linux? need help with a server

Capt_Caveman · 01-31-2006, 06:13 AM

Could you post the ouput of iptables -vnL?

stormrider_may · 01-31-2006, 07:53 PM

Here it is...

Code:

Chain INPUT (policy ACCEPT 5414 packets, 494K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0        state INVALID
    0     0 ACCEPT     tcp  --  ppp0   *       0.0.0.0/0            0.0.0.0/0        tcp dpt:81
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0        tcp dpt:2121
  781 46980 DROP       tcp  --  ppp0   *       0.0.0.0/0            0.0.0.0/0        tcp dpts:0:65500

Chain FORWARD (policy ACCEPT 10066 packets, 7581K bytes)
 pkts bytes target     prot opt in     out     source               destination
   37  2220 TCPMSS     tcp  --  *      ppp0    0.0.0.0/0            0.0.0.0/0        tcp flags:0x06/0x02 tcpmss match 1400:1536 TCPMSS clamp to PMTU
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0        icmp type 8 limit: avg 1/sec burst 5
    5   200 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0        tcp flags:0x17/0x04 limit: avg 1/sec burst 5

Chain OUTPUT (policy ACCEPT 7284 packets, 9155K bytes)
 pkts bytes target     prot opt in     out     source               destination

Capt_Caveman · 01-31-2006, 09:03 PM

I'd recommend adding a rule to allow traffic that is in the ESTABLISHED or RELATED states. When you are using your web browser like lynx, the outgoing traffic will use destination port 80 and a semi-random source port >1023. Therefore the reply packets from the webserver will be returned on the same random destination port >1023 with source port 80 (so just the reverse of the outgoing packets). This also explains why opening ports 1024-65500 helps the problem.

The easiest and most secure way of solving this problem is to use iptables state tracking mechanism to accept these reply packets. Something like this should work:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Note that this will only accept incoming traffic that is in reply to connections that *you* initiate.