I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. I already disabled all shell access attempts from php. But in order to fully protect myself, my server and my users from downtime, script kiddies and other nasty things I want to disallow RFI. Actually I don't want to allow any traffic (TCP & UDP) going out from my server that I don't allow to. For this task I want to make a transparent proxy that retrieves all packages before they are sent, making decisions if the packages should be allowed or not. I want to use Python for the task of making the decisions as it is easy to fetch allowed URL's from the local database. Like I want to allow certain API's / OAuth sources.

How do I configure iptables to send all data (including destination ip and port), to my python application? Or is there any better way of doing this?

My thought was just that if I can disable shell access and unauthorized network traffic I can sleep at night. Then no one can use my server as a bot in a botnet. And they can't email spam. What do you think?

I don't want to rely upon Suhosin, since I'm using PHP 5.4 and later.


As far as iptables is concerned:

## default policy for OUTPUT
iptables -P OUTPUT DROP

## allow related/established traffic, e.g. for incoming connections
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

## whitelist some APIs (here
## or package repositories, or your DNS (here, ...
iptables -A OUTPUT -p udp --dport 53 -d -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -d -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -d -j ACCEPT

## other TCP packages go to your script (probably not needed anyway)
iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination

You may also have a look at apparmor to filter out outgoing traffic from PHP instead of writing a proxy script yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.