#—————————————————————
# Initialize all the chains by removing all the rules
# tied to them
#—————————————————————

iptables –flush
iptables -t nat –flush
iptables -t mangle –flush

#—————————————————————
# The loopback interface should accept all traffic
# Necessary for X-Windows and other socket based services
#—————————————————————

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#—————————————————————
# Allow outbound DNS queries from the FW and the replies too
#
# – Interface eth0 is the internet interface
#
# Zone transfers use TCP and not UDP. Most home networks
# websites using a single DNS server won’t require TCP statements
#
#—————————————————————

iptables -A OUTPUT -p udp -o eth0 –dport 53 –sport 1024:65535 \
-j ACCEPT
iptables -A INPUT -p udp -i eth0 –sport 53 –dport 1024:65535 \
-j ACCEPT

#—————————————————————
# Allow previously established connections
# – Interface eth0 is the internet interface
#—————————————————————

iptables -A OUTPUT -o eth0 -m state –state ESTABLISHED,RELATED \
-j ACCEPT

#—————————————————————
# Allow port 80 (www) and 22 (SSH) connections to the firewall
#—————————————————————

iptables -A INPUT -p tcp -i eth0 –dport 22 –sport 1024:65535 \
-m state –state NEW -j ACCEPT

iptables -A INPUT -p tcp -i eth0 –dport 80 –sport 1024:65535 \
-m state –state NEW -j ACCEPT

#—————————————————————
# Allow port 80 (www) and 443 (https) connections from the firewall
#—————————————————————

iptables -A OUTPUT -j ACCEPT -m state \
–state NEW,ESTABLISHED,RELATED -o eth0 -p tcp \
-m multiport –dport 80,443 -m multiport –sport 1024:65535

#—————————————————————
# Allow previously established connections
# – Interface eth0 is the internet interface
#—————————————————————

iptables -A INPUT -j ACCEPT -m state –state ESTABLISHED,RELATED \
-i eth0 -p tcp

#—————————————————————
# If a packet doesn’t match one of the built in chains, then
# The policy should be to drop it
#—————————————————————

iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP

Bookmark It

I always have people asking me for a dummies guide to IPtables, and in all reality their isn’t one it takes time, reading, and understanding to use it properly. If IPtables is used properly and effectively it can save you hundreds of dollars in networking equipment and time. Here is a collection of several IPtables how-to’s and links I have collected for people through the years.

• Basic IPtables Commands
• Using iptables to limit bruteforce attacks
• Configuring IPtables on ubuntu server
• Basic IPtables Configuration example

Bookmark It

The file /etc/sudoers, has the rules that users have to follow when using sudo command it is typically debian based.

If you want someone to be able to use sudo you would need to add them here.

Bookmark It

I guess I really haven’t made LAMP tutorial…..they are everywhere. But by google analytics begs me to do so as I am getting keyword traffic for this. So by combining several tutorials we will have a secure Lamp Stack.

First off I assume you are logged in as root. so if not add sudo in front of your commands.

Step One:

install Apache and PHP5 with MySQL support

Step Two:

If you are hosting multiple domains consider this: Configure apache to use virtual hosts on ubuntu server

Step Three:

Configure IPtables for firewall purposes

Step Four:

Secure Apache

Step Five:

Optimize Apache and MySQL

Setting up a secure lamp stack really wasn’t that hard now was it!

Bookmark It

You can use the IPtables “recent” module to effectively limit your connections, here’s how:

To make this work, you need to have this commonly used rule (this allows previously established connections and is a normal rule in most firewalls):

iptables -A INPUT -j ACCEPT -p tcp ! –syn -s 0/0 -d (outer ip/net)

Now, set the limit:

iptables -A INPUT -p tcp -i eth0 -m state –state NEW –dport 22 -m recent –update –seconds 15 -j DROP
iptables -A INPUT -p tcp -i eth0 -m state –state NEW –dport 22 -m recent –set -j ACCEPT

Another way of limiting dictionary attacks is to limit using -m limit –limit like this:

iptables -A INPUT -p tcp –dport ssh -m limit –limit 3/minute –limit-burst 2 -j ACCEPT

Pick your poison, both great ways to slow down those annoying attempts.

You may want to read this guide for more info on SSH

Done!

Bookmark It