HydroSan
l33t
Joined: 04 Mar 2004
Posts: 764
Location: The Kremlin (aka Canada)
|
 Posted: Sat Jul 10, 2004 9:36 pm Post subject: Trying to use Gentoo as a GOAT-server... |
 |
|
(GOAT = Gentoo Of All Trades  )
I've currently got two boxes that are basically free. One of them is acting like a Router, and the other is sitting there doing nothing.
Now, what I want to do is this. I'm currently paying $20 a month for a hosting service. So far, the service has been good, but I want to try out different things with my site, and it's kind of limited since I don't have much or any access to the box.
My current router is:
PentiumII 400MHz
256MB PC-133
7GB Hard Drive
I know it's not much, but I've stripped it down to command-line only with a bunch of servers. It seems to run very well under a lot of stress. I've also Hardened it (e.g: tightened SAMBA, MySQL, Apache, CUPS, etc.), and is quite stable and secure. (Using Hardened-Dev-Sources.)
I was wondering. Does this box have what it takes to be a full-fledged server, with:
SAMBA 3.0.4, Apache 2.0.50, CUPS 1.2.10, RSYNC 2.6, MySQL 4.x, Webmin 1.15, SSH 2.x, Hardened-PHP 4.x, IPTables 2.x, and a bunch of other stuff?
If not, I do have a muchly more powerful box:
AthlonXP 2000+
512MB DDR-333
60GB Hard Drive
... that is spare.
Please give your opinions. This will be running three small sites, two of which use PHP and MySQL, and the other which is just HTML.
And would the following IPTables script suffice, and which things should I put in to harden it further against attackers.
| Code: | #!/bin/sh
INTERNET=ppp0
SUBNET_1=eth1
iptables -t filter --flush
iptables -t nat --flush
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT DROP
#=====================#
# LOCALHOST interface #
#---------------------#
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#================#
# All interfaces #
#================#
# Specify which ICMP-packets to allow
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp -j DROP
#=====================#
# INTERNET interface #
#---------------------#
# Refuse forwarding from the internet
iptables -A FORWARD -i $INTERNET -s 192.168.0.0/24 -j DROP
# Block all calls pretending being from the internal network
iptables -A INPUT -i $INTERNET -s 192.168.0.0/24 -j DROP
# Accept all already set up connections
iptables -A INPUT -i $INTERNET -p tcp ! --syn -j ACCEPT
# Allow everything to go out of the networking card to the internet
iptables -A OUTPUT -o $INTERNET -j ACCEPT
#Block NetBIOS output (!!!)
iptables -A INPUT -i $INTERNET -p tcp --dport 139 -j DROP
#Block ServerMessageBlock (a.k.a: SAMBA)
iptables -A INPUT -i $INTERNET -p tcp --dport 445 -j DROP
#Block Telnet
iptables -A INPUT -i $INTERNET -p tcp --dport 23 -j DROP
#Block SSH (???)
iptables -A INPUT -i $INTERNET -p tcp --dport 22 -j DROP
#block RSYNC *just in case*
iptables -A INPUT -i $INTERNET -p tcp --dport 873 -j DROP
#Block Webmin (for now)
iptables -A INPUT -i $INTERNET -p tcp --dport 10000 -j DROP
# Services to allow:
# DNS
iptables -A INPUT -i $INTERNET -p udp --sport 53 -j ACCEPT
iptables -A INPUT -i $INTERNET -p tcp --sport 53 -j ACCEPT
# WWW
iptables -A INPUT -i $INTERNET -p tcp --dport 80 -j ACCEPT
# BT
iptables -A INPUT -i $INTERNET -p tcp --dport 6881:6999 -j ACCEPT
# Deny identd instead of dropping it, for speed increase
iptables -A INPUT -i $INTERNET -p tcp --dport 113 -j REJECT
#=====================#
# SUBNET_1 interface #
#---------------------#
# Refuse everybody who have an illegal IP-address
#iptables -A INPUT -i $SUBNET_1 ! -s 192.168.0.0/24 -j DROP
# Accept all already set up connections
iptables -A INPUT -i $SUBNET_1 -p tcp ! --syn -j ACCEPT
iptables -A INPUT -i $SUBNET_1 -p tcp ! --syn -j ACCEPT
# Allow everything to go out of the computer
iptables -A OUTPUT -o $SUBNET_1 -j ACCEPT
# Don't allow forwarding from incorrect IPs.
#iptables -A FORWARD -i $SUBNET_1 ! -s 192.168.0.0/24 -j DROP
# Services to allow:
# DNS
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 53 -j ACCEPT
# DHCP (Not needed anymore) (OBSOLETE)
# iptables -A INPUT -i $SUBNET_1 -p udp --dport 67:68 -j ACCEPT
# iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 67:68 -j ACCEPT
# SSH
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 22 -j ACCEPT
# WWW
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 80 -j ACCEPT
# SMTP
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 465 -j ACCEPT
# IMAP
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 993 -j ACCEPT
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 143 -j ACCEPT
# Samba
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p udp --dport 137 -j ACCEPT
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p udp --dport 138 -j ACCEPT
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 139 -j ACCEPT
#Webmin
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 10000 -j ACCEPT
#RSYNC
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 873 -j ACCEPT
#BitTorrent
iptables -A INPUT -i $SUBNET_1 -s 192.168.0.0/24 -p tcp --dport 6881:6999 -j ACCEPT
#Fix something with net.ppp0
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmt
iptables -I OUTPUT -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmt
#============#
# Forwarding #
#------------#
#THIS IS TESTING - Seems to work; BitTorrent forwarding.
for i in `seq 6881 6889`; do
iptables -A PREROUTING -s ! 192.168.0.0/24 -t nat -p tcp --dport $i -j DNAT --to-destination 192.168.0.2:$i
iptables -A PREROUTING -s ! 192.168.0.0/24 -t nat -p udp --dport $i -j DNAT --to-destination 192.168.0.2:$i
done
#===========#
# NAT setup #
#-----------#
iptables -t nat -A POSTROUTING -o $INTERNET -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward |
Any suggestions are appreciated.
_________________
I was a Gangster for Capitalism, by Major General Smedley Butler.
Server status: Currently down, being replaced with fresh install - 20% completed. |
|
Networking & Security
