Tag Info

New answers tagged

0

Might this be better handled by spam software? 670 hosts per day is not a huge number of hosts. At that size, you might also consider just rate-limiting hosts, so that you allow everyone, but if someone repeatedly connects and tries to send spam, you block them. This can be accomplished by means of connection tracking. Mind you, connection tracking can ...


0

Adding to the previous answer (sorry not enough rep to add a comment) you can certainly block those ports (either on the machine or on a firewall on the way out)... but what if the connection is attempted using a non-standard port? If you want to be truly paranoid, you can go the route of blocking all outbound traffic, and then taking the laborious path of ...


0

Using iptables iptables -A OUTPUT -p 21 -j REJECT # FTP iptables -A OUTPUT -p 22 -j REJECT # SFTP et.al. Do be aware that sftp uses port 22, which is also used by ssh. If you want the process to be unaware then change the REJECT to DROP. The rule above is obviously on the machine that you want to block. If you are configuring the rules on a ...


0

I'm guessing, but it looks like you want to block connections to port 21 and port 22 . This can be done on the host itself for ftp iptables -I OUTPUT -p tcp --dport 21 \ -d the.rem.ote.ip \ -m comment --comment "blocked as per ticket##" \ -j REJECT SFTP, though, is tricky: it shares a port with ssh. If you are okay with blocking the outgoing ssh ...


2

Would it be a bad idea to unblock all the ports in my router? Yes. tl;dr I would not think of opening ports on a router that did not serve a legitimate purpose in my network, and even then I will want to filter the traffic on those ports. Reasoning For discussion purposes, 'ports' are not usually where a specific vulnerability lies, its rather what ...


3

Yes, is a very bad idea, its true that Linux is more secure than others OS but nothing is 100% secure. For example many Linux distribution has running the sshd by default, if you allow connections from internet to this port (22 by default) a hacker or a worm can do a brute force attack and get access to your Linux.


1

At first check, what rules are really loaded in your firewall: iptables -L -n -v It may happen that: rules are not loaded at all, no matter what you write into mentioned file rules are loaded from different file your firewall uses eg. custom chains and your rules are loaded into such chain instead in INPUT you can't connect because of any other problem, ...


3

debug1: Connection established. [...] debug1: identity file /root/.ssh/id_ecdsa-cert type -1 ^C When a client connects to an SSH server, the first data exchange is that the server and client send their version strings to each other. The OpenSSH client normally logs this immediately after the list of identity files, for example from my system: [...] ...


1

Check the permissions on your ~/.ssh/authorized_keys file. They should be 0600. Check the permissions on the home (~) directory, and not just the ~/.ssh directory. Alternatively you can create a new set of keys and try : ssh-keygen -t rsa Enter file in which to save the key (/home/demo/.ssh/id_rsa): Press Enter Enter passphrase (empty for no ...


0

Perhaps there is something wrong with your key? You can try and login with a username and password just to make sure its not the key. This wont work if sshd is setup to only accept keys though. Here is an example ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -p 2221 username@my-server


3

The correct way to do this is to add a profile for SNMP to firewalld. Using UDP 161 not TCP vim /etc/firewalld/services/snmp.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>SNMP</short> <description>SNMP protocol</description> <port protocol="udp" port="161"/> </service> Then you should ...


0

SNMP is udp vs tcp. Change your protocol in your rule and it should work.


2

Currently I can think of three ways: The first is to use knockd - my favorite - (http://www.zeroflux.org/projects/knock/) and configure a port sequence only you remember and let knockd open SSH for the IP address you are referring from. knockd is available in a debian package and a sample configuration (/etc/knockd.conf) can be: [options] logfile = ...


0

Simplest answer: use dynamic DNS There are some free (for private use) options around like noip.com, or dyndns.org EDIT: You have to create a script (for example) that updates the iptables rules constantly, I forgot to mention that earlier. (Thanks to @Lambert) EDIT2: I don't use a beautiful solution like that, but you could try out this neat python ...



Top 50 recent answers are included