Subject: [LON-CAPA-dev] ipchains configuration

From: Martin Siegert <[email-masked]>
Date: Thu, 23 May 2002 10:18:33 -0700

Hi there,

our loncapa server (dalton.chem.sfu.ca) is pounded for more than a week
now by port scans, etc., from one particular ip address.
In order to solve this problem once and for all I like to switch on
ipchains on dalton. Is there a "standard" ipchains configuration file
that works with loncapa?
If not, which ports are needed for loncapa besides 80?

The list I came upwith so far:

ssh: port 22 tcp from everywhere
ntp: port 123 udp from timeservers
http: port 80 tcp from everywhere
dns: port 53 tcp and udp from nameservers
nfs: all ports tcp and udp from nfs servers

anything else?

Thus would the following /etc/sysconfig/ipchains file break anything?

===</etc/sysconfig/ipchains>============================================
:input ACCEPT
:forward ACCEPT
:output ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT
-A input -s <time.sfu.ca> -d 0/0 123 -p udp -j ACCEPT
-A input -s <name1.sfu.ca> 53 -d 0/0 -p udp -j ACCEPT
-A input -s <name2.sfu.ca> 53 -d 0/0 -p udp -j ACCEPT
-A input -s <nfs.sfu.ca> -d 0/0 -p udp -j ACCEPT
-A input -s <nfs.sfu.ca> -d 0/0 -p tcp -j ACCEPT
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 -p tcp -y -j REJECT
-A input -s 0/0 -d 0/0 -p udp -j REJECT
=======================================================================

where <time.sfu.ca> is the ip address of time.sfu.ca, <name1.sfu.ca> the
ip address of name1.sfu.ca, etc.

Thanks for the help.

Cheers,
Martin

========================================================================
Martin Siegert
Academic Computing Services                        phone: (604) 291-4691
Simon Fraser University                            fax:   (604) 291-4242
Burnaby, British Columbia                          email: [email-masked]
Canada  V5A 1S6
========================================================================

---

From: Guy Albertelli II <[email-masked]>
Date: Thu, 23 May 2002 13:27:04 -0400 (EDT)

Hi Martin,

> If not, which ports are needed for loncapa besides 80?

Tcp Port 5663 (lonc/d connections)

Tcp Port 1150 (My SFU ckid port) (only needs out connection to ckid.sfu.ca)

> Thus would the following /etc/sysconfig/ipchains file break anything?

Note that for Kernel version 2.4+ ipchains doesn't exist and iptables
is the netfilter scheme.

-- 
[email-masked]        BM: n^20 t20 z20 qS 
Guy Albertelli -7-8-5-  O-
    I will strive to be godlike.  I will start by condemning my enemies
    to an eternal hell.

---

From: Martin Siegert <[email-masked]>
Date: Thu, 23 May 2002 10:37:53 -0700

Hi Guy,

> Tcp Port 1150 (My SFU ckid port) (only needs out connection to ckid.sfu.ca)

Thanks. I guess I should have known this ...
> Note that for Kernel version 2.4+ ipchains doesn't exist and iptables

Yes and no. When you configure the 2.4.x kernel you have the choice of
selecting ipchains compatability, which I always do. RH 7.2 seems to 
do this as well, at least under RH7.2 you do set your firewall rules in
/etc/sysconfig/ipchains. Don't know about RH 7.3.

Martin