Ubuntu Security :: Reject Versus Drop For Outbound Traffic

Apr 15, 2011

I understand the difference between Reject vs Drop for incoming traffic, but are there any differences between reject and drop for Outbound Traffic? Are there reasons to pick one over the other or are they functionally identical when talking about Outbound traffic?

View 6 Replies


Security :: Drop Inbound Traffic To Port 80 (http) From Source Ports Less Than 1024?

Feb 1, 2011

I'm simply trying to make a little restriction on www packets under two rules:

1. Allow inbound/outbound www packets (works!)

2. DROP inbound traffic to port 80 from source ports less than 1024. (DOES NOT WORK!)

Now, technically, when i use hping to test my rules, hping3 -S -p80 -s 1023 I should NOT receive any packets. However, i still receive packets, which means my rule that says less than 1024 does not work. (see below)

And this is my iptables rules in shell-script so far:



View 1 Replies View Related

General :: Iptables - Use DROP Instead Of REJECT And Vice Versa?

Jan 13, 2011

When deleting a rule, when is better to use DROP instead of REJECT and vice versa? Also, please provide some basic info. for the use of MASQUERADE??

View 3 Replies View Related

General :: Logging Outbound Ssh Traffic

Dec 8, 2009

I need to log outbound (server -> remote) ssh traffic, but am unsure of the best way to do this.

I added this to iptables, but nothing is being written to the logs when I ssh from the server to another system.

iptables -A OUTPUT -m state --state NEW -j LOG --log-uid iptables-save

View 2 Replies View Related

General :: Is There Interactive Firewall For Outbound Traffic On Ubuntu?

Aug 24, 2010

I wish to prevent some programs from "phoning home", and to allow other programs to access only specific web servers.Is there any way to interactively allow or decline outbound communication from individual programs on Ubuntu?

View 4 Replies View Related

Debian Configuration :: IPTABLES Protocol To Reject All Incoming Ssh Traffic

Apr 4, 2010

a good IPTABLES protocol to reject all incoming ssh trafiic except for a single IP or IP range?

View 4 Replies View Related

Networking :: Blocking Outbound Traffic In Promisc Mode?

Aug 17, 2010

Is there a way to configure my interface to promisc mode and also make it not capture the "transmitted" packets. ?I mean, i want the interface in Promisc mode but only for inbound traffic.If there isnt any using ifconfig, can it be by configuring eth0 to promisc using ifconfig , and filtering outbound traffic from being captured using sockets or something ?

View 4 Replies View Related

Networking :: Unix Command Line Tool For Monitoring Outbound Traffic?

May 19, 2010

I've read up some of the posts on this forum, but can't seem to find an answer. I have a web service within an Apache Tomcat instance installed on a Redhat linux server. I only have shell access to the server, and need to monitor outbound network traffic from my web service. Is there a unix command that will allow me to monitor all outbound traffic? I'm thinking fiddler, but a unix version? I've heard of things like ntop and iptraf, but I don't think those will help me in this instance.

View 2 Replies View Related

Networking :: Slow Outbound - Fast Outbound Cross Country Connection

Jun 2, 2011

I'm having an issue where a server in CA (1000/full) and in VA (100/full) have very lopsided data transfer.

CA -> VA with iperf shows ~20Mbps
VA -> CA with iperf shows ~93Mbps

If we change the CA server to 100/FULL, transfer speed is 93Mbps both ways.

Some tuning was done to TCP window scaling parameters, but it won't correct the issue, just improve the CA -> VA numbers to what is listed above. I will say, turning TCP window scaling OFF will lower the transfer speed both ways to < 20Mbps.

The only clue I have when looking at wireshark dumps is that the window scale going OUT would never go past 10240 (scale is 8, so 2^8 x 40bytes). In the opposite direction, the window size will go above 3MB (scaled).

It is not a bandwidth problem as iperf with UDP shows 93Mbps both ways. Local transfers (CA 1000/full to CA 100/full) show full speed both ways, so I feel it is strictly related to TCP window scaling.

RedHat 5 64-bit on both sides. Any ideas why it won't scale above 10240?

View 7 Replies View Related

Networking :: IPTables - Setting Output To Drop And Add Traffic

Feb 21, 2011

I need to set OUTPUT to DROP, and add the outgoing traffic one by one, but I couldn't do it. My current config is as follows:

:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
:RH-Firewall-1-OUTPUT - [0:0]
-A INPUT -j RH-Firewall-1-OUTPUT
#previously ESTABLISHED,RELATED comm is ok
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#80 is ok from all
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

If I change OUTPUT to DROP in :OUTPUT ACCEPT [0:0], I don't get any response from a server running in that box. I am using RHEL 5.5. Now, asking Red Hat is not an option: I have the license but I don't have support license.

View 3 Replies View Related

Ubuntu Security :: Outbound Firewall To Keep My Files From Appearing On The Internet?

Jul 23, 2011

What should I do to keep important files on my computer from being uploaded to the internet? Don't I need an outbound firewall to prevent this?

What causes my computer to send an outbound request to the internet that would result in files being uploaded from my computer onto the internet? I'm afraid to put anything of importance (like reports that I've written for work) onto a computer with internet access because I don't want them to be uploaded to the internet. I wouldn't upload them on purpose obviously, but I'm afraid it would happen without my knowledge because I don't know what I'm doing.

View 4 Replies View Related

Ubuntu Security :: Outbound Firewall Protection (permissive Vs. Restrictive) - What's Setup?

Dec 18, 2010

Using Windows, I always set a Restrictive firewall policy with a third party firewall. But I also had all ports set to Stealth, something that appears to not offer any security benefits (as I've learned from reading Ubuntu forums). I'd like to learn about best security practices (under Ubuntu) for outgoing firewall protection. I will be using the built-in Ubuntu firewall that is configured via Firestarter. Outgoing filtering offers privacy as well as security benefits. But I thought I needed my ports stealthed to be safe too, so I'm open to learning new things.

I wanted to start a poll to find out how many folks use permissive/restrictive, but no polls allowed here apparently.Could Ubuntu users knowledgeable about firewalls enlighten me on whether I should go Outbound-Restrictive and what applications I will need to allow so Ubuntu "housekeeping" is not affected negatively? I basically just use the internet for software updates, web-surfing and e-mail. One question I have is whether there is something comparable in Ubuntu to Window's "DNS Client" service? I always disabled Window's "DNS Client" and forced each application to request port 53 DNS lookups itself.I only had to allow four programs to accomplish all internet traffic that I engage in. I set all other programs/applications to be either Blocked or to have to Ask for an outgoing connection as needed.Here is my former Windows XP setup:

svchost.exe: allow UDP for ports 53, 67, 68, 123 (time) and TCP for ports 80, 443
Avast: allow UDP for port 53 and TCP for port 80
firefox: allow UDP for port 53 and TCP for ports 80, 443
IE: allow UDP for port 53 and TCP for ports 80, 443

View 9 Replies View Related

Fedora Security :: Selinux Policy Blocking Outbound Ports For Sshd

May 25, 2011

Tried google and searching this forum to no avail. Under Fedora 14, there is an selinux policy which blocks sshd from making outbound connections on port 80 or 443. This can occur when a client box tries to tunnel through the ssh connection for encrypted access to the web.

While I did manage to allow this happen by creating a permissive domain for sshd with this command:


The preferred way would be to allow sshd to make connection on other ports with a similar command that does not seem to work:


Is this the correct way of allowing an outbound port connection for the sshd daemon?

View 2 Replies View Related

General :: Security Versus Windows Security

Sep 10, 2009

As Linux gains in popularity, (as I believe it will), do you think that Linux will ever become the target of as many virus and worm threats as Windows has faced? If so, do you think that the threats will have much success?

View 2 Replies View Related

Security :: "Outbound" Messages And Checksecurity.log Setuid Changes

Aug 11, 2010

I am using ubuntu 10.04 on an iMac 7.1. What do the following log entries mean? I recently had a "sbin/init infected" alarm with chkrootkit (or rkhunter, I forget which) and reinstalled, and I thought I was rid of the problem, whatever it was (could have been a kernel panic), but now the checksecurity setuid stuff reappeared (the checksecurity.log only appears in the log file viewer after resetting it with gconftool-2 --recursive-unset /apps/gnome-system-log, which seems suspicious; why is the log hidden by default?); also there are "outbound" messages that I don't understand. I have another ubuntu install on another Mac which seems to be unaffected (and also has checksecurity installed; I just ran it manually and also got setuid stuff, but there is no "outbound" and ufw.log is empty). I can't really think I have a rootkit (I don't notice any effects except these anomalous logfiles, and my browsing habits don't include sleazy websites). And what exactly are bound sockets? There is a lot of information about sockets on the net but it's all rather technical. I continue to look of course. I ran chkrootkit and rkhunter again, and they read clean (if I can trust them).

Is it possible that the trouble is related to the Mac's BIOS emulation? (Apple does not seem to take security very seriously; Snow Leopard does not even ask for a password for Software Update - I asked my premium reseller and he confirmed it. I should not be surprised to find out that the iMac's BIOS emulation is unsafe. I'll need to get a real computer). The MacBook Pro 5.1 has a newer firmware (for instance, it will boot ubuntu from external disks which the iMac will not), and as I said that install seems to be unaffected (The setuid stuff is probably normal, but I'm not sure the "outbound" messages are). I use grub legacy, which seems to install to the Mac's EFI partition as /dev/sda (GParted shows 18.1 MB of 200MB used on both computers with ubuntu on them, whereas an HFS+ disk without ubuntu, or with GRUB in a partition, will show 3.09 MB used).

Does it make sense to reconfigure checksecurity to check for setuid changes daily (change CHECK_WEEKLY="SETUID" in /etc/checksecurity.conf to CHECK_DAILY="SETUID")?


messages (part):

There also was a lot of terminal output similar to the iMac's which I forgot to save, and when I ran checksecurity again it was blank. (Incidentally, the list of setuid programs on Mac OS is a lot longer)

View 3 Replies View Related

Ubuntu Security :: Sudo Versus SU And Superuser Privileges

Jul 19, 2011

So, I'm not quite sure what the difference is? Is it that sudo allows you to "borrow" superuser privileges, whilst su allows you to actually log in as superuser? Also, when I sudo [command] and get prompted for a password, after I input it, things work just fine, but if I su, and then get prompted for a password, I can't log in as superuser... Why is this?

View 9 Replies View Related

Security :: Kerberos Versus LDAP SSL

Apr 21, 2011

I am integrating my Unix box to the Windows AD using PAM_LDAP and Kerberos enabled. I was wondering, since Kerberos is enabled is there any point to enable SSL on my LDAP.conf? My understanding is that since Kerberos is enabled, therefore the username/password is sent securely there isn't any benefit of enabling SSL on the LDAP.conf? It's one of or another.

View 1 Replies View Related

Server :: PPTP Traffic - Gre Traffic Is Being Generated During The Browsing / Reduce Traffic

Sep 27, 2009

Recently I notice that when I'm connected to an vpn server (pptpd) and I'm using it as a default gateway my download and upload speed decreases almost to the half of the usual speed. I made a test using iptables in order to count how much GRE packets are generated (except the real traffic itself) in that way:

iptables -I INPUT -p gre -j ACCEPT
iptables -I OUTPUT -p gre -j ACCEPT

iptables -I FORWARD -s -j ACCEPT
iptables -I FORWARD -d -j ACCEPT
The first 2 rules match all GRE packets between the pptpd server and client, and the next rules - the traffic between the server and the client.

When I turn the counters to zero and begin to generate traffic (to browse, to download etc.) I see that the GRE packets are even more than these in the FORWARD chain.

So, my question is first of all is my test correct and is it true that so much gre traffic is being generated during the browsing (it becames clear that the traffic is double than if the pptpd wasn't used as a gateway) and if yes - can that traffic be reduced?

View 3 Replies View Related

Security :: Chkrootkit Versus Rootkit Hunter

Jun 8, 2010

I am going through the motions of testing the checkrootkit and rootkit hunter applications on one of our servers. I wanted to get feedback from those who know both as to which of the two is better at 'sniffing' out rootkits. Alternatively, can both be installed without their interfering with the other?

View 4 Replies View Related

Ubuntu Security :: Drop Elevated Privileges Through Terminal

May 2, 2011

How to Drop all elevated privileges through terminal?

View 7 Replies View Related

Ubuntu Security :: Configure Ufw To Drop Icmp Echo Requests?

Jul 12, 2010

I've been trying to configure ufw to drop ping requests for a couple days now, and I can't figure it out. I've tried a couple different methods in some different guides, still nothing. Anyone know how to do this?

View 4 Replies View Related

Ubuntu Security :: IPTables - Setting Default Rules To All Chains As DROP

Jun 30, 2010

I've read the instruction about setting up the iptables rules to filter all port except HTTP, SSH, FTP. I require first remove all default iptables rules and set default rules to all chains as DROP:
# Set default-deny policies for all three default chains

Then allow only some ports:
#Accept inbound packets that are part of previously-OK'ed sessions
# Accept inbound packets which initiate SSH sessions
$IPTABLES -A INPUT -p tcp -j ACCEPT --dport 22 -m state --state NEW
# Accept inbound packets which initiate FTP sessions
$IPTABLES -A INPUT -p tcp -j ACCEPT --dport 21 -m state --state NEW
# Accept inbound packets which initiate HTTP sessions
$IPTABLES -A INPUT -p tcp -j ACCEPT --dport 80 -m state --state NEW
# Log anything not accepted above $IPTABLES -A INPUT -j LOG --log-prefix "Dropped by default:"

But I hired a VPS from other country so the only mean I can manage it is via SSH. If I setup the default rule to DROP first, I afraid that I can no longer connect via SSH to tell iptables allow SSH
So my question is:
- Does the IP tables take effect immediately after I input a rule?
- Is there any mean to run this as a batch job (create a script and run all these rules one time).
- My VPS has a web control panel which have a terminal via web. Is this a native terminal or just a connection via port 80 or 22?

View 9 Replies View Related

Ubuntu Security :: Drop Igmp Port 0 Packets With Iptables Rule?

Jan 3, 2011

how can i drop igmp port 0 packets with iptables rule? my log file is full of this router advertisement.

View 2 Replies View Related

Security :: UDP Traffic Unauthorized On Ubuntu 10.04?

Mar 11, 2011

has my Ubuntu machine been cracked?

machine on home lan
it is the DMZ from router
ufw on (ports open for aMule)
sshd installed


View 2 Replies View Related

Security :: How To Write Iptables Rules To Control Drop All Connection

Feb 23, 2010

I have setup my linux fedora server and i want to restrict access to my server.Basically i control using iptables.I'm not sure how to write an iptables rules to control drop all connection to port 8080 and allow only certain ip can access the instance on port 8080 example ip=,

View 3 Replies View Related

Security :: Only Allow Traffic Between 2 Interfaces?

Jun 13, 2010

what rules I need to use to only allow traffic between 2 interfaces (which are part of a linux bridge) using ebtables?

So let's say I have if0, if1, if2. I want if1 to communicate with if0. I also want if2 to be able to communicate with if0. But I don't want if1 and if2 to communicate with each other.

View 2 Replies View Related

Ubuntu Security :: Program - Network Traffic Monitoring

Jan 31, 2010

Is there a program that monitors and displays 'who' is on your wireless Internet signal that one may not be aware of? Like, the ability to see when someone that you don't know is accessing your locked wireless?

View 9 Replies View Related

Ubuntu Security :: Traffic To Specific Sites Throttled?

Sep 14, 2010

I want to check if traffic to a specific URL is being throttled by a hospital acting as an ISP. A client is having great trouble accessing a hosted web-app from inside the hospital, but access is fine from outside. The hospital IT dept are not interested as the rest of the Internet is fine. I need to trace where the latency is creeping in or where the throttling is happening, if I can do that, the hospital will remove it. Traffic is standard http to a specific URL.

View 9 Replies View Related

Security :: Encrypting All Traffic By Squid

Jun 24, 2010

We use a squid proxy server for all http traffic. Is there any way to configure squid so that all traffic which squid and workstation communicates is SSL and encrypted ?

View 2 Replies View Related

Security :: Logging/Blocking LAN Traffic?

Apr 26, 2010

Where I work we have a lan, it is almost 100% windows machines except for 2 CentOS machines in which some clients connect to, via VPN. (very small network, <50 ip's used)

I would like to know if there is a way to block access from that machines to others in the network. I'm already logging traffic (with IPTraff) to see if they're accessing other machines in the network others than the ones they should connect.

View 7 Replies View Related

Copyrights 2005-15 www.BigResource.com, All rights reserved