dwfreed wrote:
Code:
Interesting ports on kriskrehart.com (97.107.128.171):
Not shown: 65525 filtered ports
PORT STATE SERVICE
22/tcp closed ssh
53/tcp open domain
80/tcp open http
143/tcp closed imap
443/tcp closed https
465/tcp closed smtps
587/tcp closed submission
993/tcp open imaps
6667/tcp open irc
8080/tcp open http-proxy
No 554 and no 7070 open.
Thanks.
dwfreed wrote:
Piki wrote:
I don't trust what I can't configure myself.
By that logic, you shouldn't be connecting to the Internet. Sarcasm aside, HE tunnels are easy to set up, and are no more of a security risk than connecting to the Internet in the first place. They're quite useful when you're not sure how to use your own Linode for this purpose.
There's only so far paranoia can go without restricting freedom, so one does have to be reasonable
I'd rather either use my Linode, or wait for my ISP to gain support
dwfreed wrote:
iptables should be thought of a supplement to your main security measures, not a replacement. You should focus on securing your applications at the application level first (key-only auth for SSH, something like fwknop to reduce logspam from brute force attempts, secure passwords for things that only accept password auth, keeping up with system and kernel updates, etc), and use iptables only when your application does not allow you to restrict access as flexibly as you'd like, and there's no other suitable alternative.
I'd never use it as a replacement. Before chewing me out for that, please be certain that's what I'm doing.
I believe in security at every level, including (but not only) the firewall.
dwfreed wrote:
As an example of my previous point that your outbound rules do not provide increased security, based on your current rules, I see 3 ways that a malicious user that has taken advantage of a security hole in software you run or a misconfiguration of software could use your Linode for malicious purposes that would get you in trouble.
Please tell. Aside from IRC, I'm unaware of any other issues in my iptables rules.
dwfreed wrote:
Further evaluation of your ruleset shows that you're blocking all inbound ICMP not associated with existing traffic, and all outbound ICMP, unless it's an echo request. ICMP is a completely harmless protocol, and by blocking it you only cause yourself more pain and suffering (most monitoring tools would report your Linode as down, for example, and we have no way of verifying whether your Linode is down or if there's a legitimate issue within our network, or just a problem with the return route from your Linode to you).
Sure, blocking ICMP
can make troubleshooting harder, however it also makes it hard for hackers and DoS'ers to see my Linode. Sure, it can be argued that a determined hacker will try anyways, but any hacker that has no reason to target me specifically won't bother if my server appears offline.
That, plus I can easily check if my Linode is online using a service that is allowed, e.g. http or ssh. And, if I need to ask for help from Linode support, I can use Lish to temporarily enable ICMP.
dwfreed wrote:
One example of a way to simplify your iptables rules would be to condense your 10 state related, established rules into 1 that doesn't have a port specified, thus catching all of them at once. Leave out protocol as well, for maximum effectiveness.
Meh, I'd feel safer keep my iptables as they are.
FAQ
Search
Members
Register
Login [ Anonymous ]
)
