I using OS: CentOS Linux 4.4
CP+ : ver. 3.4 and use freelancers for technical projects, this means
I,m giving some 2 much access to my server.

The result being, I have just had work completed by a programmer I trust
and he tells, that some of the errors on my website are caused due to changes
made to my cgi-bin, by someone.

Does anyone know how to block entire countries from my server and website,
as work carried out by some freelancers who I suspect come from pakistan and india.

My solution is a brush stroke, to ensure I get it right.

Any help, would be a god send

Thanks in advance

Seriously, what? How about you don't give logins to people you don't trust?

Blocking regional IPs is a non-starter anyway - there's plenty of free shell account providers all over the place to proxy through.

Dave

so what's the solution?

You can block out countries with the GeoIP extension for netfilter/iptables. I haven't used this as it requires patching the kernel.

I wrote a program to search either the webnet77 or geoip csv list of allocated ips by various criteria (such as country code) and generate iptables configuration file lines or an iptables script to add rules.

Example to generate rules to exclude Pakistan:

ipfind -c PK -IPK

outputs:

#!/bin/bash

iptables -N PK_CHAIN
iptables -N PK_DROP

iptables -A PK_CHAIN -s 58.27.128.0/17 -j PK_DROP
iptables -A PK_CHAIN -s 58.65.128.0/18 -j PK_DROP
iptables -A PK_CHAIN -s 58.65.192.0/19 -j PK_DROP
...
iptables -A PK_CHAIN -s 217.74.231.0/24 -j PK_DROP
iptables -A PK_CHAIN -s 221.120.192.0/18 -j PK_DROP
iptables -A PK_CHAIN -s 221.132.112.0/21 -j PK_DROP

iptables -A PK_CHAIN -j ACCEPT

iptables -A PK_DROP -j LOG --log-prefix "PK_CHAIN: " --log-level 3 --log-tcp-options --log-ip-options
iptables -A PK_DROP -j DROP

iptables -A INPUT -p tcp -m state --state NEW -j PK_CHAIN

Don't give logins to people you don't trust. If you give someone a login with access to sensitive stuff and they want to do something nasty, you're screwed.
Blocking by IP-block is a five minute job to get around, so while it may provide a level of nuisance to those who would do you harm, it's not going to keep them out for long.

You could log their shell histories, by 'chattr +a ~/.bash_history' etc for all the shells you have on system. That way all commands are logged, but the users can't remove lines. Wouldn't stop them messing with the system, but at least you'd know who'd done it.
Even that's not a reliable method though, as a user could scp a new shell onto the system which doesn't log.

Dave

Can you share it with us?

How about when a contractor is finished with his work, you disable his account. Crazy, I know.

I routinely block countries from my websites, though I am a bit selective about the portions of the site I block them from. Proscribed countries can't access message boards, for instance. It actually has been very successful as one technique for stopping spam. I have completely stopped spam on my message boards by a combination of country blocking and some custom things I have done (which I won't describe).

I use the ip2nation database to match IP ranges with countries.

WRT shell access to my servers, I am with everyone else. Get rid of shell accounts for people who are no longer allowed access to the server. Keep an eye on anyone who is allowed to access the server to make sure they aren't doing bad things.

Right after I made my last post, I clicked on a referer link in my website logs to see where it took me. Took me right to a directory structure; the site that was in the referer was misconfigured so that I could get direct access to its cgi scripts.

Now isn't that interesting.

OP might want to look at how his server is organized and make sure this capability is blocked.

Yes I am willing to share it. Unfortunately I am not allowed to post attachments on this list.

On a related issue: I have also added some functionality to Karl Hammar's "ipnumber.c" if anybody is interested in that; I've added two switches: one to print the cidr(s) given a dotted quad range and a switch to do the converse (calculate all the ranges for a cidr).

The prior program is working though I am going to add some more functionality to it. Here is the program's syntax. Where might I upload/send it for distribution?

USAGE: ipfind (-r REGISTRY... | -c CODE... | -C CODE...) [-m | -M] [-i] [-I[CHAIN_NAME]] [-pCHAIN_NAME ] [-nCHAIN_NAME] [-aACTION]] [-f DOTTED_QUAD...] [-v]
-c, --ctry filter using 2 character country codes
-C, --cntry filter using 3 character country codes (webnet77)
-r, --registry filter using registry name
-m, --cidr print cidr instead of netmask (default)
-M, --netmask print netmask instead of cidr
-i, --iptables output iptables startup file format
-I, --iptables_cmd output iptables configuration script using CHAIN_NAME prefix
-p, --prior iptables configuration script prior chain name (default "INPUT")
-n, --next iptables configuration script next chain name (default "ACCEPT")
-a, --action iptables configuration script action (default "DROP")
-L, --nolog iptables configuration script no logging
-f, --find find IP's range block
--maxmind use the maxmind csv file (default)
--webnet77 use the webnet77 csv file
-v, --verbose display verbose output

Some of the replys a bit over my head, I have found that database table have been re-routed, however no major harm done.

I have change the root user details and removed all.
It's the best I can do at the moment with my little knowledge, thanks again