From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Daniel Sercaianu" Subject: ssh Date: Mon, 24 Jun 2002 15:23:46 +0300 Sender: netfilter-admin@lists.samba.org Message-ID: <001101c21b79$fcb15cb0$0803020a@daniel> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01C21B93.21F545E0" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C21B93.21F545E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, How can I drop ssh packets for destination hosts to which destination = port is unknown and different from 22/tc?. Daniel ------=_NextPart_000_000E_01C21B93.21F545E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello,

How can I drop ssh packets for = destination=20 hosts to which destination port is unknown and different from=20 22/tc?.

Daniel

------=_NextPart_000_000E_01C21B93.21F545E0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ssh Date: Mon, 24 Jun 2002 14:31:28 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <200206241331.OAA15709@slate.rockstone.co.uk> References: <001101c21b79$fcb15cb0$0803020a@daniel> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <001101c21b79$fcb15cb0$0803020a@daniel> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Monday 24 June 2002 1:23 pm, Daniel Sercaianu wrote: > Hello, > > How can I drop ssh packets for destination hosts to which destination port > is unknown and different from 22/tc?. I can think of two answers to this: 1. You can't. Netfilter / IPtables works by port number, not by content, so you can only filter by port number. 2. You allow through the traffic on the port numbers you want, and you block everything else. Doesn't stop someone running an SSH server on port 80, though, if you're trying to allow web access. Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Maciej Soltysiak Subject: Re: ssh Date: Mon, 24 Jun 2002 15:47:49 +0200 (CEST) Sender: netfilter-admin@lists.samba.org Message-ID: References: <200206241331.OAA15709@slate.rockstone.co.uk> Mime-Version: 1.0 Return-path: In-Reply-To: <200206241331.OAA15709@slate.rockstone.co.uk> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Antony Stone Cc: netfilter@lists.samba.org > 1. You can't. Netfilter / IPtables works by port number, not by content, so > you can only filter by port number. Hmm, maybe you could... Look: 1. look for a openingpacket with ssh connection characteristics, say a version string and mark packets, use recent module, put them to a seperate chain. something like that. 2. filter by port number. What do you think? Maciej From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ramin Alidousti Subject: Re: ssh Date: Mon, 24 Jun 2002 09:56:30 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <20020624135630.GC26150@cannon.eng.us.uu.net> References: <200206241331.OAA15709@slate.rockstone.co.uk> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Maciej Soltysiak Cc: Antony Stone , netfilter@lists.samba.org On Mon, Jun 24, 2002 at 03:47:49PM +0200, Maciej Soltysiak wrote: > > 1. You can't. Netfilter / IPtables works by port number, not by content, so > > you can only filter by port number. > Hmm, maybe you could... > Look: > 1. look for a openingpacket with ssh connection characteristics, say a > version string and mark packets, use recent module, put them to a > seperate chain. something like that. Yes. Very expensive though and not full-proof in case of fragments. Ramin > 2. filter by port number. > > What do you think? > > Maciej > From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Simpson, Doug" Subject: ssh Date: Tue, 14 Jan 2003 13:59:04 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20ED00AA0BC135449469D6EF0AE79C971042@ozlan.fcdomain.net> Mime-Version: 1.0 Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: "'netfilter@lists.netfilter.org'" I have acomputer I want to ssh to from the internet. What is the IPTABLES command to open this port? Thanks, Doug From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Simpson, Doug" Subject: RE: ssh Date: Tue, 14 Jan 2003 15:28:24 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20ED00AA0BC135449469D6EF0AE79C971046@ozlan.fcdomain.net> Mime-Version: 1.0 Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: "'netfilter@lists.netfilter.org'" whoops - forgot this is a dual homed computer and I am opening the eth0 to the outside world for ssh. I did find this - iptables -A INPUT -p tcp --syn --destination-port 22 -j ACCEPT iptables -A INPUT -p tcp --syn -j DROP this confuses me because of the "DROP" and the "--syn" Thanks, Doug -----Original Message----- From: Simpson, Doug Sent: Tuesday, January 14, 2003 1:59 PM To: 'netfilter@lists.netfilter.org' Subject: ssh I have acomputer I want to ssh to from the internet. What is the IPTABLES command to open this port? Thanks, Doug From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Zander" Subject: Re: ssh Date: Wed, 15 Jan 2003 12:09:55 -0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <012101c2bc8f$04264f80$96ae6f83@classics.cam.ac.uk> References: <20ED00AA0BC135449469D6EF0AE79C971046@ozlan.fcdomain.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: "Simpson, Doug" , netfilter@lists.netfilter.org > whoops - forgot this is a dual homed computer and I am opening the eth0 to > the outside world for ssh. > I did find this - > iptables -A INPUT -p tcp --syn --destination-port 22 -j ACCEPT > iptables -A INPUT -p tcp --syn -j DROP > this confuses me because of the "DROP" and the "--syn" > Thanks, > Doug > > -----Original Message----- > From: Simpson, Doug > Sent: Tuesday, January 14, 2003 1:59 PM > To: 'netfilter@lists.netfilter.org' > Subject: ssh > > > I have acomputer I want to ssh to from the internet. What is the IPTABLES > command to open this port? > Thanks, > Doug > if you're opening ssh to the machine itself then: /sbin/iptables -A INPUT -p tcp -i eth0 -d --dport 22 -j ACCEPT /sbin/iptables -A OUTPUT -p all -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT if for a host behind the firewall: /sbin/iptables -A FORWARD -p tcp -i eth0 -o ethx -d --dport 22 -j ACCEPT /sbin/iptables -A FORWARD -p all -m state --state RELATED,ESTABLISHED -j ACCEPT some of those interface settings aren't compulsary like in the forward chain but I like to put them in. I would suggest them though for the INPUT and OUTPUT chains as you have more than one interface. Oh and maybe set the default policy of all to DROP. HTH Zz From mboxrd@z Thu Jan 1 00:00:00 1970 From: MAB Subject: Re: ssh Date: Wed, 15 Jan 2003 18:44:09 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200301151844.10222.mabaeyens@eresmas.com> References: <20ED00AA0BC135449469D6EF0AE79C971046@ozlan.fcdomain.net> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <20ED00AA0BC135449469D6EF0AE79C971046@ozlan.fcdomain.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: "Simpson, Doug" , "'netfilter@lists.netfilter.org'" El Mar 14 Ene 2003 21:28, Simpson, Doug escribi=F3: > whoops - forgot this is a dual homed computer and I am opening the eth0= to > the outside world for ssh. > I did find this - > iptables -A INPUT -p tcp --syn --destination-port 22 -j ACCEPT With this rule you mean you accept every incoming packet from the interne= t=20 through the por 22, and specially packets with the SYN,RST,ACK bit sets t= o 1=20 (you accept people should establish a connection to the 22 port) > iptables -A INPUT -p tcp --syn -j DROP And, out of that, every incoming TCP packet, DROPs -Miguel Angel Baeyens KeyID: 0x6FB7A511 en rediris.es From mboxrd@z Thu Jan 1 00:00:00 1970 From: "IT Clown" Subject: ssh Date: Wed, 14 Jul 2004 16:15:22 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hi All How do i allow ssh in from the internet, thanks? Regards _____________________________________________________________________ For super low premiums ,click here http://www.dialdirect.co.za/quote From mboxrd@z Thu Jan 1 00:00:00 1970 From: Koyama Mituru Subject: Re: ssh Date: Wed, 14 Jul 2004 23:25:44 +0900 (JST) Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040714.232544.78703338.netfilter@gvelo.ddnn.jp> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: Text/Plain; charset="us-ascii" To: netfilter@lists.netfilter.org From: "IT Clown" Subject: ssh Date: Wed, 14 Jul 2004 16:15:22 +0200 > How do i allow ssh in from the internet, thanks? iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT -- Koyama Mituru netfilter@gvelo.ddnn.jp From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Piszcz, Justin Michael" Subject: RE: ssh Date: Wed, 14 Jul 2004 11:26:10 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <2E314DE03538984BA5634F12115B3A4E62E89F@email1.mitretek.org> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Koyama Mituru , netfilter@lists.netfilter.org Should all incoming ports that relate to a service such as SSH, FTP use -m state --state NEW?=20 I have never used this with iptables; but I remember using it with ipfilter. What are the security implications (if any) of not using -m state --state NEW? -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Koyama Mituru Sent: Wednesday, July 14, 2004 10:26 AM To: netfilter@lists.netfilter.org Subject: Re: ssh From: "IT Clown" Subject: ssh Date: Wed, 14 Jul 2004 16:15:22 +0200 > How do i allow ssh in from the internet, thanks? iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT --=20 Koyama Mituru netfilter@gvelo.ddnn.jp From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ssh Date: Wed, 14 Jul 2004 16:42:31 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200407141642.31591.Antony@Soft-Solutions.co.uk> References: <2E314DE03538984BA5634F12115B3A4E62E89F@email1.mitretek.org> Reply-To: netfilter Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <2E314DE03538984BA5634F12115B3A4E62E89F@email1.mitretek.org> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter On Wednesday 14 July 2004 4:26 pm, Piszcz, Justin Michael wrote: > Should all incoming ports that relate to a service such as SSH, FTP use > -m state --state NEW? It doesn't really matter, IMHO. > What are the security implications (if any) of not using -m state > --state NEW? Well, there are two types of packets - ones that are NEW, and ones that aren't. If you use "-m state --state NEW" as a match on the rule to allow the first packet in (because it's only the first one which will be NEW anyway), then you must have some other rule which allows the second and subsequent packets in (which are no longer NEW; they are ESTABLISHED). In my opinion it makes no difference whether the rule for the first packet would *only* let in the NEW packet, or if it would let in the later ones as well. Remember that the efficient order to place your rules in the FORWARD chain is: 1. Allow ESTABLISHED & RELATED packets through the firewall. 2. Allow the first packets of selected connection types. Therefore any ESTABLISHED packets aren't going to get beyond rule 1 anyway, so it dosn't much matter whether the rules at (2) allow them or not. The only other type of packet which you might want to think about is INVALID packets, however whether you consider these to be a security risk or not is moot, I think. Even if an INVALID packet were to be allowed through your firewall to an internal host, any response would not get back out again because it's not part of an ESTABLISHED connection, so unless the INVALID packet can actually do some harm all on its own, it seems to me that allowing NEW, or allowing all, packets in makes little difference (for a given service and destination). If someone wants to send you an INVALID packet anyway, all they need to do is send you a SYN packet to a listening port/address first - that will set up an ESTABLISHED connection tracking table entry, and then any further packets from the same source IP/port will be FORWARDED through the traditional Rule 1. Just my 2c - I will be interested to see any other opinions on the topic. Regards, Antony. > -----Original Message----- > From: netfilter-admin@lists.netfilter.org > [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Koyama Mituru > Sent: Wednesday, July 14, 2004 10:26 AM > To: netfilter@lists.netfilter.org > Subject: Re: ssh > > From: "IT Clown" > Subject: ssh > Date: Wed, 14 Jul 2004 16:15:22 +0200 > > > How do i allow ssh in from the internet, thanks? > > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT -- It is also possible that putting the birds in a laboratory setting inadvertently renders them relatively incompetent. - Daniel C Dennet Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Koyama Mituru Subject: Re: ssh Date: Thu, 15 Jul 2004 00:57:59 +0900 (JST) Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040715.005759.28779742.netfilter@gvelo.ddnn.jp> References: <2E314DE03538984BA5634F12115B3A4E62E89F@email1.mitretek.org> Mime-Version: 1.0 Content-Type: Multipart/Signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="--Security_Multipart(Thu_Jul_15_00_57_59_2004_817)--" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <2E314DE03538984BA5634F12115B3A4E62E89F@email1.mitretek.org> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org ----Security_Multipart(Thu_Jul_15_00_57_59_2004_817)-- Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit From: "Piszcz, Justin Michael" Subject: RE: ssh Date: Wed, 14 Jul 2004 11:26:10 -0400 > Should all incoming ports that relate to a service such as SSH, FTP use > -m state --state NEW? > > I have never used this with iptables; but I remember using it with > ipfilter. > > What are the security implications (if any) of not using -m state > --state NEW? iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT I don't want other packets. -- Koyama Mituru netfilter@gvelo.ddnn.jp ----Security_Multipart(Thu_Jul_15_00_57_59_2004_817)-- Content-Type: application/pgp-signature Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQBA9VgdRDRWsqe74JwRAqpMAKC6q7LU5kb1BCa3dQyPY9j7KdNQvwCgnjlP 6W+BfeCEDQtoLbna8bjKRz4= =Di8w -----END PGP SIGNATURE----- ----Security_Multipart(Thu_Jul_15_00_57_59_2004_817)---- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: ssh Date: Wed, 14 Jul 2004 17:07:46 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200407141707.46159.Antony@Soft-Solutions.co.uk> References: <2E314DE03538984BA5634F12115B3A4E62E89F@email1.mitretek.org> <20040715.005759.28779742.netfilter@gvelo.ddnn.jp> Reply-To: netfilter@lists.netfilter.org Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <20040715.005759.28779742.netfilter@gvelo.ddnn.jp> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Wednesday 14 July 2004 4:57 pm, Koyama Mituru wrote: > > Should all incoming ports that relate to a service such as SSH, FTP use > > -m state --state NEW? > > > > What are the security implications (if any) of not using -m state > > --state NEW? > > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT > > I don't want other packets. That's a good security attitude. Antony. -- "Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS Blaster]. However, these products are no longer supported. Users of these products are strongly encouraged to upgrade to later versions." (which *are* affected by MS Blaster...) http://www.microsoft.com/security/security_bulletins/ms03-026.asp Please reply to the list; please don't CC me.