Notice removed Draw attention by Community
    Bounty Ended with no winning answer by Community
7 added 1 character in body
source | link

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

Ex.: the "MAGIC" script should run a week/month on the machine, collecting informatinsinformations, then, after a week/month, the script will be able to produce an iptables rule file that we can use.

Many people could get in this situation (how to harden a server regarding iptables). And it would be great if there were a script/solution that can do this :\

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

Ex.: the "MAGIC" script should run a week/month on the machine, collecting informatins, then, after a week/month, the script will be able to produce an iptables rule file that we can use.

Many people could get in this situation (how to harden a server). And it would be great if there were a script/solution that can do this :\

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

Ex.: the "MAGIC" script should run a week/month on the machine, collecting informations, then, after a week/month, the script will be able to produce an iptables rule file that we can use.

Many people could get in this situation (how to harden a server regarding iptables). And it would be great if there were a script/solution that can do this :\

    Tweeted twitter.com/#!/StackUnix/status/485745696134664192
6 added 333 characters in body
source | link

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

Ex.: the "MAGIC" script should run a week/month on the machine, collecting informatins, then, after a week/month, the script will be able to produce an iptables rule file that we can use.

Many people could get in this situation (how to harden a server). And it would be great if there were a script/solution that can do this :\

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

Ex.: the "MAGIC" script should run a week/month on the machine, collecting informatins, then, after a week/month, the script will be able to produce an iptables rule file that we can use.

Many people could get in this situation (how to harden a server). And it would be great if there were a script/solution that can do this :\

    Notice added Draw attention by evachristine
    Bounty Started worth 300 reputation by evachristine
5 added 3 characters in body
source | link

IPtables iptables rule adviser script

There is a server without any IPtablesiptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict IPtablesiptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them.  .

QuestionThe question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for IPtablesiptables!

The machine cannot have any outage! The machine cannot have any outage!

IPtables rule adviser script

There is a server without any IPtables defense ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server with strict IPtables rules, we have to find out by hand that which app uses which dst/src port/protocol.  

Question: are there any scripts that can help collecting these informations from a running machine? (from the logs?)

Like there is the audit2allow on SELinux. Just for IPtables!

The machine cannot have any outage!

iptables rule adviser script

There is a server without any iptables defense: ACCEPT all..

There could be custom applications on this server.

If we should need to harden this server (so deny all, and only let what is needed by the applications) with strict iptables rules, we have to find out by hand that which app uses which dst/src port/protocol and then we have to write the iptables rules for them..

The question: are there any scripts that can help collecting these informations from a running machine? (from the logs?) - And automatically generating the iptables rules?

Like there is the audit2allow on SELinux. Just for iptables!

The machine cannot have any outage!

4 edited title
| link
3 added 39 characters in body
source | link
2 improved formatting
source | link
1
source | link