Setting up TCP Wrappers and local firewall on a remote host

If you use local firewall rules and tcp wrappers on a remote host where you might get locked out, with no easy way to get logged in again, here is a quick howto on playing it safe. The trick is to setup a couple cron jobs to undo whatever you stuffed up.

I scheduled two 10 minute recurring jobs. Gives you 10 minute windows of configuring/testing before security resets.

Paranoid hint: Make sure you stay logged into the target host with an extra terminal somewhere else as well.

I could also have done /etc/init.d/iptables restart or service iptables restart to reset rules from cron. That would prevent you from having a wide open machine after the flush. But the downside of that is if you save rules that were broken, a restart will load your saved (broken) rules.

Set two cron jobs:

1
[root@uhz002192 dev]# crontab -l
2
/10 * * * * cp /root/hosts.deny /etc/hosts.deny
3
/10 * * * * /sbin/iptables --flush

Tcp wrappers:

I made a copy of /etc/hosts.deny file in /root and then waited for the next cron run to test if the copy is really working as expected.

It looked good after cron ran.

1
# cat /etc/hosts.deny
2
#
3
...
4
#ALL: ALL

Now uncomment the ALL: ALL line in the real /etc/hosts.deny and start testing /etc/hosts.allow rules.

1
# more /etc/hosts.allow
2
...
3
# Host allowed to SSH
4
sshd: xx.xx.xx.xx

Test from non allowed and allowed host.

1
Feb 24 05:32:56 uhz002192 sshd[12346]: pam_unix(sshd:session): session opened for user rrosso by (uid=0)
2
Feb 24 05:33:43 uhz002192 sshd[12380]: refused connect from host.domain.com (::ffff:xx.xx.xx.xx)
3

4
Feb 24 05:34:34 uhz002192 sshd[12386]: Accepted password for rrosso from xx.xx.xx.xx port 37415 ssh2
5
Feb 24 05:34:34 uhz002192 sshd[12386]: pam_unix(sshd:session): session opened for user rrosso by (uid=0)

Now lets go tune the firewall rules…

List rules:

1
# iptables --list
2
Chain INPUT (policy ACCEPT)
3
target     prot opt source               destination
4
ACCEPT     all  --  anywhere             anywhere
5
ACCEPT     icmp --  anywhere             anywhere            icmp any
6
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
7
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:webcache
8
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:etlservicemgr
9
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql
10
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:redwood-broker
11
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
12
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp
13
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
14
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp
15
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
16
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
17

18
Chain FORWARD (policy ACCEPT)
19
target     prot opt source               destination
20

21
Chain OUTPUT (policy ACCEPT)
22
target     prot opt source               destination

Saved rules in this file:

1
# cat /etc/sysconfig/iptables
2
# Firewall configuration written by system-config-securitylevel
3
# Manual customization of this file is not recommended.
4
*filter
5
:INPUT ACCEPT [0:0]
6
:FORWARD ACCEPT [0:0]
7
:OUTPUT ACCEPT [0:0]
8
-A INPUT -i lo -j ACCEPT
9
-A INPUT -p icmp --icmp-type any -j ACCEPT
10
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
11
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
12
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9001 -j ACCEPT
13
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
14
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3001 -j ACCEPT
15
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
16
-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
17
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
18
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
19
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
20
-A INPUT -j REJECT --reject-with icmp-host-prohibited
21
COMMIT

Delete unneeded rules:

1
# iptables -D INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
2
# iptables -D INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
3
# iptables -D INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
4
# iptables -D INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT

Check (and test using something like nmap):

1
# iptables --list
2
Chain INPUT (policy ACCEPT)
3
target     prot opt source               destination
4
ACCEPT     all  --  anywhere             anywhere
5
ACCEPT     icmp --  anywhere             anywhere            icmp any
6
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
7
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:etlservicemgr
8
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:redwood-broker
9
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
10
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
11
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
12
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
13

14
Chain FORWARD (policy ACCEPT)
15
target     prot opt source               destination
16

17
Chain OUTPUT (policy ACCEPT)
18
target     prot opt source               destination

Save the rules:

1
# service iptables save
2
Saving firewall rules to /etc/sysconfig/iptables:          [  OK  ]

Check stored rules:

1
# cat /etc/sysconfig/iptables
2
# Generated by iptables-save v1.3.5 on Fri Feb 24 05:48:21 2012
3
*filter
4
:INPUT ACCEPT [0:0]
5
:FORWARD ACCEPT [0:0]
6
:OUTPUT ACCEPT [734:96465]
7
-A INPUT -i lo -j ACCEPT
8
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
9
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
10
-A INPUT -p tcp -m state --state NEW -m tcp --dport 9001 -j ACCEPT
11
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3001 -j ACCEPT
12
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
13
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
14
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
15
-A INPUT -j REJECT --reject-with icmp-host-prohibited
16
COMMIT
17
# Completed on Fri Feb 24 05:48:21 2012

Check running rules:

1
# iptables --list
2
Chain INPUT (policy ACCEPT)
3
target     prot opt source               destination
4
ACCEPT     all  --  anywhere             anywhere
5
ACCEPT     icmp --  anywhere             anywhere            icmp any
6
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
7
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:etlservicemgr
8
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:redwood-broker
9
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
10
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
11
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
12
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
13

14
Chain FORWARD (policy ACCEPT)
15
target     prot opt source               destination
16

17
Chain OUTPUT (policy ACCEPT)
18
target     prot opt source               destination

Delete the cron job(s) when working!