Security :: Errors: Jan 24 04:15:03 Servername Kernel: Iptables: Loop Hook 1 Pos 464080 00000022

Jan 24, 2011

I have a few mail servers (CentOS 5.5) that are running OSSEC Active Response (2.5.1) on Iptables (1.3.5-5.3.el5_4.1). We are currently having a problem where we get loop hook errors:Jan 24 04:15:03 servername kernel: iptables: loop hook 1 pos 464080 00000022 this is the firewall-drop.sh we are currently using:

Code:
#!/bin/sh
# Adds an IP to the iptables drop list (if linux)
# Adds an IP to the ipfilter drop list (if solaris, freebsd or netbsd)
# Adds an IP to the ipsec drop list (if aix)

[Code]...

View 4 Replies


ADVERTISEMENT

Security :: Netfilter Hook - Kernel Module - Skb_transport_header - Tcphdr Fields Wrong Values

Apr 1, 2010

We are trying to implement a firewall as kernel module through netfilter hooking (in C). In the following code we are allowing only TCP traffic. Source port number and destination port number are printed for every TCP packet. On execution, this code prints wrong port numbers. This is the first time we are using skb_transport_header function for accessing tcp headers.

We verified port numbers being printed by firewall through NFS traffic. On the same machine where firewall is running, we hosted an NFS server. An NFS client (from a different system) puts a file in exported mount. Firewall is able to capture packets for this file transfer but port numbers printed are wrong. It prints '69' for source portnumber (whereas ethereal capture shows it as 790) and prints '553231' for destination port (whereas for nfs version 4 it has to be 2049).

[Code]....

View 1 Replies View Related

Ubuntu Security :: Exploits In Kernel - Possible To Bypass IPTables Firewall

Jul 4, 2010

When there is an exploit in the kernal, can the iptables firewall get bypass? If yes,how do you know? Otherwise how can you find out.

View 9 Replies View Related

Fedora Security :: SELinux Is Preventing /usr/libexec/abrt-hook-ccpp From Using The Sys_ptrace Capability?

Jul 15, 2011

This is the "alert" I've received from SElinux Alert Browser after closing "rythmbox" application that opened my CreativeZen mediaplayer:

Code:
SELinux is preventing /usr/libexec/abrt-hook-ccpp from using the sys_ptrace capability
in dmesg it has:

[code]....

View 3 Replies View Related

Ubuntu Security :: Hardened Baseline - Hook The Logins Into Either Enterprise Kerberos Or Active Directory (yuck)

Dec 14, 2010

I'm tasked with creating a base image of ubuntu (one for server, one for workstation) that is locked down and has all the fluff taken out (naturally workstation will have more fluff left in it than server). Task list looks about like this:

1. Create list of deb packages "allowed", write script to list/uninstall everything else.

2. Hook the logins into either enterprise kerberos or Active Directory (yuck).

3. Write scripts to check things like setuid/setguid, disabling su, checking sudo permissions, configure iptables, etc.

4. Use a scanner to scan the system from outside the system (was thinking of using backtrace).

5. Custom-compile the kernel to strip out all the unneeded modules.

Before embarking on this awesome task I figured I'd check with you guys to see if you know of some resources that would make this task easier/quicker. I'm sure someone out there has already headed down this branch.

PS My boss *loves* ubuntu and isn't to keen on going with a deb (or other) distro that is already "security trimmed" without some serious convincing. I'm sure there are some out there, and if you want to pass along a couple for consideration, I'll check them out, but no guarantees he'll let me use it.

View 4 Replies View Related

Fedora Installation :: Errors For VirtualBox / Kernel Source For Kernel 2.6.32.11-99.fc Cannot Be Found?

Apr 21, 2010

Trying to install virtualbox in F12 but fails when recompiling kernel module. Output of vbox-install log is:

Attempting to install using DKMS
removing old DKMS module vboxdrv version 3.1.6
Deleting module version: 3.1.6
completely from the DKMS tree.
Creating symlink /var/lib/dkms/vboxdrv/3.1.6/source ->
/usr/src/vboxdrv-3.1.6

DKMS: add Completed.

Error! Your kernel source for kernel 2.6.32.11-99.fc12.i686.PAE cannot be found
at
/lib/modules/2.6.32.11-99.fc12.i686.PAE/build or /lib/modules/2.6.32.11-99.fc12.
code....

View 6 Replies View Related

Security :: Bash: Can't Su Within While Loop

Jul 18, 2010

I have a while loop in a file that looks like:

Code:

while IFS=":" read name script
do
su
exit

[code]....

Where I redirect the file into the loop, for some reason, I can't do an su when I redirect a file like that. I get the error, "su: must be run from a terminal." Why is this? How can I fix it?

View 7 Replies View Related

Ubuntu Servers :: Iptables Causing Slow Ssh And Name Lookup Errors

Jan 24, 2010

Why would this iptables cause this mail delivery error? I think it's to do with dns lookups not being routed properly... if remove the last rule, mail works fine.

ssh is also very slow to connect when the last rule is enabled.

postfix mail error:

Code:
Jan 24 11:32:18 xxxx postfix/smtp[15065]: 9F2162C519: to=<xxxxx@hotmail.com>, relay=none, delay=1005, delays=965/0.01/40/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=hotmail.com type=MX: Host not found, try again) iptables

[Code]....

View 1 Replies View Related

Debian :: Script - Iptables Not Finding Shared Object - Get A Bunch Of Errors

Feb 12, 2010

Today I was installing a new system and tried to run an iptables script I have on another machine, in which works flawlessly, and get a bunch of errors:

Looking into /lib there isn't an iptables directory but there's one named xtables. I tried creating a sybolic link:

But, still doesn't work don't know if is a bug or what but have other systems running without problems.

I running this on Lenny 5.0.4 and iptables was installed with apt-get install iptables.

View 1 Replies View Related

Ubuntu Security :: Loop Hole In Encrypted Home?

Jun 11, 2010

I'm using 10.04 with encrypted home dir. I think the behavior below is wrong:

I can log in as root and change user's password. After that the user can log in using new password, which is normal, but it can also decrypt its home dir using the new password, which is dangerous. Assume I lost my computer. This encrypted home dir will not protect my private data because whoever gets the computer can boot it up with a livecd and chroot to change my user's password and then boot up my system and log in using new password.

View 3 Replies View Related

Ubuntu Installation :: Wubi Kernel Update Reboot Loop?

Nov 26, 2010

I updated wubi kernel(ubuntu 10.04) After restart, i selected ubuntu then my system reboots. Then i select ubuntu then my system reboots. I dont know what to do now,

View 4 Replies View Related

General :: Ssh <servername>, Scp Some Files To A Server Get =true Prompt And Nothing Happens?

May 6, 2011

whenever i try to do any ssh related activity like.ssh <servername>, scp some files to a server i get =true prompt and nothing happens.For example:

Code:
# scp file1.txt SERVERIP/HOSTNAME:/usr/local/sbin/
root@SERVERIP/HOSTNAME's password:

[code]....

View 6 Replies View Related

Ubuntu Servers :: Virtualhost - Within The Vps That Servername Is Directed To The Directory /var/www/the_directory

Jul 10, 2011

I'm sure it's a minor mistake; these are the steps I've taken currentdomain: domain i already have, and works. newdomain: domain i newly bought.

[Code]....

This is to make sure the files are actually there, this subdomain works... simply pointing to the same folder

[Code]...

- all ipadresses in the hosting service of the domain thing is pointing to the vps.
- Within the vps that servername is directed to the directory /var/www/the_directory
- That directory holds the actual website files. This is proven with the subdomain method.

View 3 Replies View Related

General :: For Loop Or While Loop To Read The Fields Of A File?

Sep 1, 2010

I have a mytext file with month and year as two separate fields. likemytext fil

08 2010
09 2010
10 2010
........
........
........

I want to read the values of each field i.e., month and year into an awk script.

View 10 Replies View Related

Fedora Security :: Allow DNS In Iptables

Feb 1, 2009

I have been struggling with this for a very long time now. I have installed Fedora Core 9 on my computer. I have set it up as a caching-nameserver and this is working.

Then I wanted to secure my server with iptables, and I have so far made this script:

# Load the connection tracker kernel module
modprobe ip_conntrack
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP

[Code]....

I can reach the dns server with ping. When trying Nslookup it says that it got SERVFAIL from 127.0.0.1 trying next server, and then it times out.

My resolv.conf file lists:

nameserver 127.0.0.1
nameserver DNS-server

View 13 Replies View Related

Fedora Security :: Can't Get FTP Through Iptables

Dec 14, 2009

Im pulling my hair out trying to get ftp to work through iptables.Im using vsftpd

Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

[code].....

View 3 Replies View Related

Security :: Can't Zero Out Counters In Iptables

Feb 25, 2010

I have a problem with iptables, when I execute

[code]....

View 5 Replies View Related

Security :: Configure IPtables To Only Allow VNC Over SSH

Apr 4, 2010

I am trying to figure out how I can configure IPtables to only allow VNC traffic to an internal server over SSH.

My configuration is WAN < --- > Gateway (Ubuntu 9.10 Server) < --- > Internal Server (that I want to control with VNC over SSH)

View 12 Replies View Related

Security :: How To Keep Safe PC Using Iptables

Dec 5, 2010

I am using Fedora on my desktop pc. I want to know how can i protact my PC from outside world. What firewall policy should i implement in iptables to keep it more secure.

View 5 Replies View Related

Security :: Incorporate Into Iptables

Jan 5, 2010

I'm following an openvpn installtion how to and it says to add this to the iptables:

Quote:
# External Interface for VPN
# VPN Interface
VPNIF="tun0"
VPNNET="172.16.0.0/24"
VPNIP="172.16.0.1"
### OpenVPN
[Code]....

Any thoughts as the whole formatting is separate and has the addition of FORWARD rules, etc. I need the VPN running on the .199 address

View 16 Replies View Related

Security :: Iptables :everything Works Except Ftp

Jun 3, 2010

i set up a dmz to have a internet web server and ftp server, and ssh only from local network, so i wrote a iptables script to load during boot :

[Code]...

The problem is that everything works fine ( i have the same rules for other services such as samba, nfs, mysql on another server) BUT ftp there is no way to make it work. not even locally.when i try to connect, i log in, but while listing the directory i get MLSD ... and it hangs like this for a moment, then i get error message "connection time out" , "impossible to list directory". if i turn off the iptables script no problem,ftp works fine.. but why all services work and ftp no?

how do i have to modify the rules? what is strange also is that if i set as OUTPUT policy "accept", the server seems to be offline."host unknown" error message. I was thinking the rule INPUT is fine cause at least i can login, but the dir list is not going out, so gotta modify output rules. or state?

View 7 Replies View Related

Security :: IPTables - How To Set Default Allow

Mar 19, 2010

I've started a new job and have inherited a couple of RHEL4 64-bit servers. The firewall on them is currently disabled. I'm struggling to get them up and running as iptables is not the most user-friendly application. This lead me to downloading and trying a GUI front-end: Guarddog. Great app! But it doesn't have the default behavior I'm looking for. Here is what I need:

Default behavior: Firewall should be wide open, allowing ALL ports/IP's/TCP/UDP in and out of the server.
Blacklist: Oracle TCP port 1521 needs to be blocked in/out of the server.

This will help get us passed our company's security vulnerability scan. (We aren't able to patch/upgrade Oracle at this time because we'd lose vedor support with a legacy app). I will use these settings as a starting point, and then once I learn more and get more comfortable with iptables (or a GUI app) then I can fine tune things to make them more secure. As far as I know (correct me if I'm wrong) once I get a script I just copy it into /etc/rc.firewall and it will load when iptables starts.

View 14 Replies View Related

Security :: Iptables To Block Ip From Ftp?

Mar 6, 2010

Is this how I would do that?

iptables -A INPUT -p tcp --destination-port 21 -d ! 168.192.1.2 -j DROP

This should block all incoming connections on port 21 from 192.168.1.2, correct? Thus preventing that IP from logging into my FTP.

View 1 Replies View Related

General :: Configure Iptables In Kernel?

Oct 8, 2010

I have configured iptables in my system and is working. But I cant find iptables kernel folders such as iptables/extensions/Makefile to make a utility Where to locate them? or how to download and install?

View 11 Replies View Related

Fedora Security :: Iptables - Block Everything From Getting In My Pc

Mar 17, 2009

What i wanted to do was block everything from getting in my pc but still be able to surf the web and still use instant messenger.

View 2 Replies View Related

Ubuntu Security :: How To Reset The Iptables

Jan 14, 2010

i ran this

Code:

iptables -N rate-limit
iptables -A rate-limit -p tcp -m conntrack --ctstate NEW -m limit --limit 3/min --limit-burst 3 -j RETURN
iptables -A rate-limit -j DROP
iptables -I INPUT 1 -p tcp --dport 22 -j rate-limit

i am no longer able to ssh in to the machine , how can i reset iptables and firestarted back to default?

View 3 Replies View Related

Ubuntu Security :: Use Address Not Ip In Iptables?

Jul 24, 2010

i need to open this address ftp.nai.com, is there a way to use address not ip in iptables?

View 7 Replies View Related

Ubuntu Security :: Iptables Configured By UFW ?

Sep 17, 2010

I've recently moved from Firestarter to UFW/GUFW, and I wonder if someone could confirm if my iptables configuration is secure.

When I enter sudo iptables -L i get:

Code:

View 3 Replies View Related

Ubuntu Security :: Iptables Allow Via Spesific NIC?

Dec 29, 2010

eth1 has connection to the net via gateway ..eth0 on the same machine has users on a intranet and needs access to the internet, i need to allow internet connection and prevent packets which logically originate from the internet getting into the intranet

View 1 Replies View Related

Ubuntu Security :: How To Clear Iptables

Apr 21, 2011

Installing a router, and I need to completely "wipe" iptables (flush I mean) on both computers, and I think I run ufw/gufw on both, so that would need to be uninstalled. The router is very secure, has NAT, etc, etc, and I'd rather setup all that side of things in one point, rather than on each computer.

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved