|
OK, i have completed installing these on a new server
There can be many variations and permutations, but this is a basic one.
If I erred let us know. Its just that too many people are getting stung, maybe this will help
============= I P C H A I N S ================
1) wget http://netfilter.samba.org/ipchains/ipchains-1.3.10.tar.gz
2) tar -zxvf ipchains-1.3.10.tar.gz
3) cd ipchains-1.3.10
4) make all (does nothing, as its compiled)
5) make install
============ P M F I R E W A L L ==========
1) wget http://www.pointman.org/PMFirewall/download/pmfirewall-1.1.4.tar.gz
2) tar -zxvf pmfirewall-1.1.4.tar.gz
3) cd pmfirewall-1.1.4
4) edit /etc/host.allow
in.telnetd : <my.ip.add.res>
5) edit /etc/host.deny
in.tellnetd : ALL
6) Insure telnet is enabled
7) ./install.sh (note in most cases you will 'hit' Enter see *)
Directory to place config files [/usr/local/pmfirewall]:
External Interface [eth0]:
Are there any IP ranges which require unrestricted access? (y/N):
Are there any IP ranges which should be blocked completely? (y/N):
Is your IP address assigned via DHCP? (y/N):
*Are you running a FTP Server on ports: 20/21 (y/N):y
*Are you running a SSH Server on port: 22 (y/N):y
Enter the IP Range or press ENTER for any IP address:
*Are you running a Telnet Server on port: 23 (y/N):y
Are you running a SMTP Server on port: 25 (y/N):
*Are you running a DNS Server on port: 53 (y/N):y
Enter the IP Range or press ENTER for any IP address:
Are you running a Finger Server on port: 79 (y/N):
*Are you running a Web Server on port: 80 (y/N):y
Enter the IP Range or press ENTER for any IP address:
*Are you running a POP Server on port: 110 (y/N):y
Enter the IP Range or press ENTER for any IP address:
Allow IDENT connections on port: 113 (y/N):
Are you running a NNTP Server port: 119 (y/N):
*Are you using NTP, it requires port: 123 (y/N):y
Do you wish to open NetBIOS/SAMBA ports 137-139 (not recommended)? (y/N):
? Are you running an IMAP Server on port: 143 (y/N):
*Are you running a SSL Web Server on port: 443 (y/N):y
Enter the IP Range or press ENTER for any IP address:
Are you running Routed (RIP) on port: 520 (y/N):
Do you wish to open NFS port 2049 (not recommended)? (y/N):
Do you wish to open X-Server ports 5999-6003 (not recommended)? (y/N):
*Are there any other ports you wish to open to the outside? (y/N):y
Port number: 81
tcp, udp or both: tcp
Enter the IP Range or press ENTER for any IP address:
*Do you wish to add others? (y/N): y
Port number: 444
tcp, udp or both: tcp
Enter the IP Range or press ENTER for any IP address:
Do you wish to add others? (y/N):
Start PMFirewall on bootup? (Y/n):
Do you want pmfirewall to autodetect your IP address? (Y/n)
Will this box Masquerade connections for other PC's (y/N):
8) ipchains -L -n shows rules
9) review your rules (not necessary but you might look)
vi /usr/local/pmfirewall/pmfirewall.rules.local
If you are using any of the following ip address comment out the one you use
# Block Nonroutable IP's from entering on the External Interface
$IPCHAINS -A input -j DENY -s 10.0.0.0/8 -d $OUTERNET -i $OUTERIF
$IPCHAINS -A input -j DENY -s 127.0.0.0/8 -d $OUTERNET -i $OUTERIF
$IPCHAINS -A input -j DENY -s 172.16.0.0/12 -d $OUTERNET -i $OUTERIF
#$IPCHAINS -A input -j DENY -s 192.168.0.0/16 -d $OUTERNET -i $OUTERIF
Make sure tlenet port 23 is at accept
9) /etc/rc.d/init.d/pmfirewall start (don't exit your shell until you test)
Enter a new SSH and telnet shell from your PC, make sure it works!!!
10) ipchains -L -n (shows rules)
This setsup a basic firewall.
Add - subtract rules from /usr/local/pmfirewall/pmfirewall.rules.local
read up on ipchains
============ P O R T S E N T R Y ===========
1) wget http://www.psionic.com/downloads/portsentry-1.1.tar.gz
2) tar -zxvf portsentry-1.1.tar.gz
3) cd portsentry-1.1
4) vi portsentry.conf
find:
# Use these if you just want to be aware:
remove "143" tcp/udp from list of ports, if you use IMAP
find:
# Newer versions of Linux support the reject flag now. This
# is cleaner than the above option. [ uncomment this line ]
#KILL_ROUTE="/sbin/route add -host $TARGET$ reject"
uncomment the above line.
If you are using ipfwadm (RaQ2) do the following instead
# ipfwadm support for Linux
#KILL_ROUTE="/sbin/ipfwadm -I -i deny -S $TARGET$ -o"
5) save the portsentry.conf file
6) make linux
7) make install
8) vi /etc/rc.d/rc.local
at the end of the fiel insert
/usr/local/psionic/portsentry/portsentry -udp
/usr/local/psionic/portsentry/portsentry -tcp
9) there are more advanced methods and are left as an exercise for the user
============== L O G C H E C K =============
1) wget http://www.psionic.com/downloads/logsentry-1.1.1.tar.gz
2) tar -zxvf logsentry-1.1.1.tar.gz
3) cd logsentry-1.1.1
4) make linux
5) vi /usr/local/etc/logcheck.sh
# Person to send log activity to.
SYSADMIN="<email address>"
6) vi /usr/local/etc/logcheck.cron
# my logcheck cron job
0,15,30,45 * * * * root /usr/local/etc/logcheck.sh
7) save the file
8) crontab /usr/local/etc/logcheck.cron
9) crontab -l (see if it loaded)
10) /etc/rc.d/init.d/crond restart
These instructions are as of July 5, 2002.
|
