IP drop question

IP drop question

[Philip Rhoades]

People,

My config does not appear to be dropping unauthorised IPs - in my
logwatch file I am still getting lines like:

 Failed logins from:
    211.238.253.248: 54 times
 
 Illegal users from:
    202.110.131.27: 1 time
    211.238.253.248: 164 times
 
 **Unmatched Entries**
 pam_succeed_if(sshd:auth): error retrieving information about user
administrator : 1 time(s)

My config is this:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# -A INPUT -p tcp -i eth0 --dport 22 --sport 1024:65535 -j LOG
--log-prefix "ssh connect:"
-A INPUT -p tcp -m tcp -s 149.171.173.169 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -s 203.166.81.114 --dport 22 -j ACCEPT
# -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22 -j
ACCEPT 
-A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25 --syn
-j ACCEPT
-A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 53 --syn
-j ACCEPT
-A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 80 -j
ACCEPT
-A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3128
--syn -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -p udp -m udp -s 149.171.173.169 --sport 53 -d 0/0 -j ACCEPT
-A INPUT -p udp -m udp -s 203.166.81.114 --sport 53 -d 0/0 -j ACCEPT
-A INPUT -p tcp -m tcp --syn -j REJECT
-A INPUT -p udp -m udp -j REJECT
-A INPUT -j LOG --log-level alert
-A INPUT -j LOG --log-prefix "Dropped: "
COMMIT


Can someone point out what I am doing wrong?

Thanks,

Phil.
-- 
Philip Rhoades

Pricom Pty Limited  (ACN 003 252 275  ABN 91 003 252 275)
GPO Box 3411
Sydney NSW      2001
Australia
Mobile:  +61:(0)411-185-652
Fax:     +61:(0)2-8221-9599
E-mail:  phil@pricom.com.au

Re: IP drop question

[angico]

if i can understand it well, it doesn't make sense you have your INPUT
policy set to DROP if you have matches that say to -j ACCEPT if -i eth0
and eth1 (unless you have other interfaces that actualy connects you to
the outside world and eth0/1 are tied to your intranet).
regards,
angico.


--- Philip Rhoades <phil@pricom.com.au> wrote:

> People,
> 
> My config does not appear to be dropping unauthorised IPs - in my
> logwatch file I am still getting lines like:
> 
>  Failed logins from:
>     211.238.253.248: 54 times
>  
>  Illegal users from:
>     202.110.131.27: 1 time
>     211.238.253.248: 164 times
>  
>  **Unmatched Entries**
>  pam_succeed_if(sshd:auth): error retrieving information about user
> administrator : 1 time(s)
> 
> My config is this:
> 
> *filter
> :INPUT DROP [0:0]
> :FORWARD DROP [0:0]
> :OUTPUT DROP [0:0]
> -A INPUT -i lo -j ACCEPT
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> # -A INPUT -p tcp -i eth0 --dport 22 --sport 1024:65535 -j LOG
> --log-prefix "ssh connect:"
> -A INPUT -p tcp -m tcp -s 149.171.173.169 --dport 22 -j ACCEPT
> -A INPUT -p tcp -m tcp -s 203.166.81.114 --dport 22 -j ACCEPT
> # -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22
> -j
> ACCEPT 
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25
> --syn
> -j ACCEPT
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 53
> --syn
> -j ACCEPT
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 80 -j
> ACCEPT
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3128
> --syn -j ACCEPT
> -A OUTPUT -o lo -j ACCEPT
> -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -i eth0 -j ACCEPT
> -A INPUT -i eth1 -j ACCEPT
> -A INPUT -p udp -m udp -s 149.171.173.169 --sport 53 -d 0/0 -j ACCEPT
> -A INPUT -p udp -m udp -s 203.166.81.114 --sport 53 -d 0/0 -j ACCEPT
> -A INPUT -p tcp -m tcp --syn -j REJECT
> -A INPUT -p udp -m udp -j REJECT
> -A INPUT -j LOG --log-level alert
> -A INPUT -j LOG --log-prefix "Dropped: "
> COMMIT
> 
> 
> Can someone point out what I am doing wrong?
> 
> Thanks,
> 
> Phil.
> -- 
> Philip Rhoades
> 
> Pricom Pty Limited  (ACN 003 252 275  ABN 91 003 252 275)
> GPO Box 3411
> Sydney NSW      2001
> Australia
> Mobile:  +61:(0)411-185-652
> Fax:     +61:(0)2-8221-9599
> E-mail:  phil@pricom.com.au
> 
> 
> 
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: IP drop question

[Drew Leske]

Hi Philip,

> My config does not appear to be dropping unauthorised IPs - in my
> logwatch file I am still getting lines like:
> 
>  Failed logins from:
>     211.238.253.248: 54 times
>  
>  Illegal users from:
>     202.110.131.27: 1 time
>     211.238.253.248: 164 times

I'm not familiar with logwatch.  Are these SSH, telnet, other?  I assume
SSH, because new telnet connections are allowed in with this rule:

> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25 --syn
> -j ACCEPT

Going through the iptables you provided, let's say with 211.238.253.248,
coming in on a new connection for SSH on port 22, the first rule matched
would be this one (assuming eth0 and/or eth1 are external interfaces):

> -A INPUT -i eth0 -j ACCEPT
> -A INPUT -i eth1 -j ACCEPT

So they'd get through.

As an aside, I'd recommend you 'tail -f /var/log/messages' or wherever
you've got your kernel messages going in a separate window while you tune
your iptables configuration.  This will allow you to catch these attempts
and make rules for them faster than waiting to see them show up in a log the
next day.

Cheers,
Drew.


> *filter
> :INPUT DROP [0:0]
> :FORWARD DROP [0:0]
> :OUTPUT DROP [0:0]
> -A INPUT -i lo -j ACCEPT
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> # -A INPUT -p tcp -i eth0 --dport 22 --sport 1024:65535 -j LOG
> --log-prefix "ssh connect:"
> -A INPUT -p tcp -m tcp -s 149.171.173.169 --dport 22 -j ACCEPT
> -A INPUT -p tcp -m tcp -s 203.166.81.114 --dport 22 -j ACCEPT
> # -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22 -j
> ACCEPT 
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25 --syn
> -j ACCEPT
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 53 --syn
> -j ACCEPT
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 80 -j
> ACCEPT
> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3128
> --syn -j ACCEPT
> -A OUTPUT -o lo -j ACCEPT
> -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -i eth0 -j ACCEPT
> -A INPUT -i eth1 -j ACCEPT
> -A INPUT -p udp -m udp -s 149.171.173.169 --sport 53 -d 0/0 -j ACCEPT
> -A INPUT -p udp -m udp -s 203.166.81.114 --sport 53 -d 0/0 -j ACCEPT
> -A INPUT -p tcp -m tcp --syn -j REJECT
> -A INPUT -p udp -m udp -j REJECT
> -A INPUT -j LOG --log-level alert
> -A INPUT -j LOG --log-prefix "Dropped: "
> COMMIT

-- 
Drew Leske :: Systems Group/Unix, Computing Services, University of Victoria
  dleske@uvic.ca / +1250 472 5055 (office) / +1250 588 4311 (cel)

RE: IP drop question

[Rob Sterenborg]

>> My config does not appear to be dropping unauthorised IPs - in my
>> logwatch file I am still getting lines like:
>> 
>>  Failed logins from:
>>     211.238.253.248: 54 times
>> 
>>  Illegal users from:
>>     202.110.131.27: 1 time
>>     211.238.253.248: 164 times
> 
> I'm not familiar with logwatch.  Are these SSH, telnet, other?  I 
> assume SSH, because new telnet connections are allowed in with 
> this rule:
> 
>> -A INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25
>> --syn -j ACCEPT

Huh..? Not to nitpick or anything, but dport 25 is smtp and dport 23 is
telnet. IMHO this rule will not allow telnet.


Gr,
Rob

Re: IP drop question

[Drew Leske]

> Huh..? Not to nitpick or anything, but dport 25 is smtp and dport 23 is
> telnet. IMHO this rule will not allow telnet.

Hah--you're right.  I thought something was off as I typed that.

Chrs,
Drew.

-- 
Drew Leske :: Systems Group/Unix, Computing Services, University of Victoria
  dleske@uvic.ca / +1250 472 5055 (office) / +1250 588 4311 (cel)