(rpm -Vva 2>&1|grep -v '^\.\{8\}'; /sbin/iptables-save; grep -v ^# /etc/vsftpd/vsftpd.conf|grep .; grep -v ^# /etc/httpd/conf/httpd.conf | grep .; netstat -antlpe 2>&1|sed -e "s|[0-9]\{1,3\}\.|n.|g"; /bin/ps axfwwwe 2>&1; top -bn1 2>&1; /sbin/sysctl -a | egrep -vie "(host|random|cdrom|fs\.|parp)"; who; last; lastlog; ) > /tmp/output.txt

#!/bin/bash --
# Flush all rules
iptables -F; iptables -X
# Setting default filter policy
iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT

# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT; iptables -A OUTPUT -o lo -j ACCEPT

# Allow inbound existing connections first as this is the majority of traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow FTP and FTP data
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 20,21,22 -j ACCEPT

# Allow SSH
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

# Allow HTTP and flood-limit access to max 30 requests per minute
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -m limit --limit 10/minute --limit-burst 30 -j ACCEPT

# Allow Grand Theft Auto (guessed port assignment)
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 5554,8888 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p udp --dport 7777 -j ACCEPT

# Drop ICMP frags but allow some ICMP diagnostic messages:
iptables -A INPUT -p icmp --fragment -j DROP
for ICMPTYPE in echo-reply time-exceeded fragmentation-needed; do
iptables -A INPUT -p icmp --icmp-type ${ICMPTYPE} -j ACCEPT; done

# Catchall rules to log and reject anything else (dropping remote RPC, SMTP, MySQL):
iptables -A INPUT -m state --state NEW -m limit --limit 10/minute --limit-burst 30 -j LOG --log-prefix "INREJ "
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

# Log outbound traffic initiation
iptables -A OUTPUT -m state --state NEW -m limit --limit 10/minute --limit-burst 30 -j LOG --log-prefix "OUTNEW "

# End
exit 0

iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 4500:21474 -j ACCEPT

#!/bin/bash --
# Flush all rules
iptables -F; iptables -X
# Setting default filter policy
iptables -P INPUT ACCEPT; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT

# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT; iptables -A OUTPUT -o lo -j ACCEPT

# Allow inbound existing connections first as this is the majority of traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH: ideally this should be limited to a set of IP addresses or ranges or be dealt with by fail2ban
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 22 -j ACCEPT

# Allow Grand Theft Auto (guessed port assignment)
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 4500:21474 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p udp --dport 7777 -j ACCEPT

# Allow FTP and FTP data and flood-limit access to max 30 requests per minute
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 20,21 -m limit --limit 10/minute --limit-burst 30 -j ACCEPT

# Allow HTTP and flood-limit access to max 30 requests per minute
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -m limit --limit 10/minute --limit-burst 30 -j ACCEPT

# Drop ICMP frags but allow some ICMP diagnostic messages:
iptables -A INPUT -p icmp --fragment -j DROP
for ICMPTYPE in echo-reply time-exceeded fragmentation-needed; do
iptables -A INPUT -p icmp --icmp-type ${ICMPTYPE} -j ACCEPT; done

# Catchall rules to log and reject anything else (dropping remote RPC, SMTP, MySQL):
iptables -A INPUT -m state --state NEW -m limit --limit 10/minute --limit-burst 30 -j LOG --log-prefix "INREJ "
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

# Log outbound traffic initiation
iptables -A OUTPUT -m state --state NEW -m limit --limit 10/minute --limit-burst 30 -j LOG --log-prefix "OUTNEW "

# End
exit 0

#!/bin/bash --
# Flush all rules
iptables -F; iptables -X
# Setting default filter policy
iptables -P INPUT ACCEPT; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT
# Own IP address
EXTERNAL=$(hostname -i 2>/dev/null|| { echo "IP lookup error, exiting."; exit 1; })

# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT; iptables -A OUTPUT -o lo -j ACCEPT

# Allow inbound existing connections first as this is the majority of traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow MySQL TCP for samp03svr until you figure out how to make samp03svr use local UNIX socket
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s ${EXTERNAL}/32 -d ${EXTERNAL}/32 --dport 3306 -j ACCEPT
# Drop specific services only
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 111,730,3306 -j LOG --log-prefix "INREJ "
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 111,730,3306 -j REJECT --reject-with icmp-host-prohibited
# Remove this rule if GTA doesn't use it:
iptables -A INPUT -m state --state NEW -m tcp -p udp ! --dport 7777 -j LOG --log-prefix "INREJ "
iptables -A INPUT -m state --state NEW -m tcp -p udp ! --dport 7777 -j REJECT --reject-with icmp-host-prohibited

# Drop ICMP frags but allow some ICMP diagnostic messages:
iptables -A INPUT -p icmp --fragment -j DROP
for ICMPTYPE in echo-reply time-exceeded fragmentation-needed; do
iptables -A INPUT -p icmp --icmp-type ${ICMPTYPE} -j ACCEPT; done

# End
exit 0

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=003
file_open_mode=0777
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=YES
pam_service_name=vsftpd
tcp_wrappers=YES
passwd_chroot_enable=YES
chroot_local_user=YES
force_dot_files=YES
hide_ids=YES
userlist_deny=YES
# Confine PASV mode to a higher range (easier for firewalling later on)
pasv_min_port=50000
pasv_max_port=60000
# Drop idle sessions after 1 minute and data after 2 minutes
idle_session_timeout=60
data_connection_timeout=120
# Allow a maximum of 10 clients to connect
max_clients=10
# Allow a maximum of 2 sessions per IP address
max_per_ip=2
# Set a 128kbyte/sec rate for authenticated users
local_max_rate=128000

for TABLE in $(cat /proc/net/ip_tables_names); do /sbin/iptables -t ${TABLE} -n -v -x -L --line-numbers; done

top -b -n 1 | awk '{if (NR <=7) print; else if ($8 == "D") {print; count++} } END {print "Total status D: "count}'