Hack The Sec-Leading Resource Of Linux Tutorial: bash

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" style="background-color: white; box-sizing: border-box; font-family: Lato, sans-serif; line-height: 1.1; margin: 20px 0px 10px;">
<span style="color: #990000; font-size: large;"><u>Blocking abusive IP addresses using IPTABLES Firewall</u></span></h1>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">In computing, a firewall is a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted, secure internal network and another outside network, such as the Internet, that is assumed to not be secure or trusted. </span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVLpw76eQcyxf_FJfA5z-xQ_rnjxqJKvLr9bioRWOZ81yGF0gkvnv0ZmEtr_cz0GqKBerizxuLX9yKohg0XrJiIrpt3n3evDA2WOxvLVHWD3uPwxo6i3pImzS__HETrwaS2C9lFrontj46/s1600/firewall_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVLpw76eQcyxf_FJfA5z-xQ_rnjxqJKvLr9bioRWOZ81yGF0gkvnv0ZmEtr_cz0GqKBerizxuLX9yKohg0XrJiIrpt3n3evDA2WOxvLVHWD3uPwxo6i3pImzS__HETrwaS2C9lFrontj46/s1600/firewall_www.hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Firewalls are often categorized as either network firewalls or host-based firewalls. Network firewalls are a software appliance running on general purpose hardware or hardware-based firewall computer appliances that filter traffic between two or more networks. Host-based firewalls provide a layer of software on one host that controls network traffic in and out of that single machine</span></span></div>
<div>
<div style="font-family: verdana, geneva, sans-serif;">
<ul style="color: #222222; font-size: 15px; line-height: 26px; text-align: left;">
<li>Flushing the old firewall rules</li>
<li>Determining service ports</li>
<li>Setting-up default policies</li>
<li>Setting-up your firewall rules</li>
<li>Saving your firewall rules</li>
</ul>
<div>
<div>
<span style="font-size: 15px; line-height: 26px;"><b><u><span style="color: #0b5394;">BLOCKING IPs USING IPTABLES</span></u></b></span></div>
<div style="color: #222222;">
<span style="font-size: 15px; line-height: 26px;">To block some abusive IP address or range of IPs, you can use the following iptables rules:</span></div>
</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: trebuchet ms, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">## iptables -I INPUT -s 1.2.3.4 -j DROP
## iptables -I INPUT -s 1.2.0.0/16 -j DROP</span></span></pre>
</div>
<div>
<div>
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>CREATING THE BLACKLIST</u></b></span></span></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">For better readability and maintenance, it is a good idea to have all abusing IPs in one particular file, for example <b>/etc/blacklist.ips</b>. This way, you can add the IP addresses or subnets in this file (one IP or subnet per line) and use the <b>fwall-rules</b> script below to block anything listed in this file.</span></span></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">So, create or edit <b>/usr/local/bin/fwall-rules </b>and make it as follows:</span></span></div>
</div>
<div style="color: #222222; font-family: verdana, geneva, sans-serif;">
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">#!/bin/bash
#
# iptables firewall script
# 
#

IPTABLES=/sbin/iptables
BLACKLIST=/etc/blacklist.ips

echo " * flushing old rules"
${IPTABLES} --flush
${IPTABLES} --delete-chain
${IPTABLES} --table nat --flush
${IPTABLES} --table nat --delete-chain

echo " * setting default policies"
${IPTABLES} -P INPUT DROP
${IPTABLES} -P FORWARD DROP
${IPTABLES} -P OUTPUT ACCEPT

echo " * allowing loopback devices"
${IPTABLES} -A INPUT -i lo -j ACCEPT
${IPTABLES} -A OUTPUT -o lo -j ACCEPT

${IPTABLES} -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## BLOCK ABUSING IPs HERE ##
#echo " * BLACKLIST"
#${IPTABLES} -A INPUT -s _ABUSIVE_IP_ -j DROP
#${IPTABLES} -A INPUT -s _ABUSIVE_IP2_ -j DROP

echo " * allowing ssh on port 5622"
${IPTABLES} -A INPUT -p tcp --dport 5622  -m state --state NEW -j ACCEPT

echo " * allowing ftp on port 21"
${IPTABLES} -A INPUT -p tcp --dport 21  -m state --state NEW -j ACCEPT

echo " * allowing dns on port 53 udp"
${IPTABLES} -A INPUT -p udp -m udp --dport 53 -j ACCEPT

echo " * allowing dns on port 53 tcp"
${IPTABLES} -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT

echo " * allowing http on port 80"
${IPTABLES} -A INPUT -p tcp --dport 80  -m state --state NEW -j ACCEPT

echo " * allowing https on port 443"
${IPTABLES} -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

echo " * allowing smtp on port 25"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT

echo " * allowing submission on port 587"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT

echo " * allowing imaps on port 993"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT

echo " * allowing pop3s on port 995"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT

echo " * allowing imap on port 143"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT

echo " * allowing pop3 on port 110"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT

echo " * allowing ping responses"
${IPTABLES} -A INPUT -p ICMP --icmp-type 8 -j ACCEPT

# DROP everything else and Log it
${IPTABLES} -A INPUT -j LOG
${IPTABLES} -A INPUT -j DROP

#
# Block abusing IPs 
# from ${BLACKLIST}
#
if [[ -f "${BLACKLIST}" ]] && [[ -s "${BLACKLIST}" ]]; then
    echo " * BLOCKING ABUSIVE IPs"
    while read IP; do
        ${IPTABLES} -I INPUT -s "${IP}" -j DROP
    done < <(cat "${BLACKLIST}")
fi

#
# Save settings
#
echo " * SAVING RULES"

if [[ -d /etc/network/if-pre-up.d ]]; then
    if [[ ! -f /etc/network/if-pre-up.d/iptables ]]; then
        echo -e "#!/bin/bash" > /etc/network/if-pre-up.d/iptables
        echo -e "test -e /etc/iptables.rules && iptables-restore -c /etc/iptables.rules" >> /etc/network/if-pre-up.d/iptables
        chmod +x /etc/network/if-pre-up.d/iptables
    fi
fi

iptables-save > /etc/fwall.rules
iptables-restore -c /etc/fwall.rules</pre>
</div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">make sure the script is executable by adding an ‘x’ bit to it:</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: trebuchet ms, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;"># chmod +x /usr/local/bin/fwall-rules</span></span></pre>
</div>
<div style="font-family: verdana, geneva, sans-serif;">
<span style="font-size: 15px; line-height: 26px;"><div>
<b><u><span style="color: #0b5394;">APPLYING THE RULES</span></u></b></div>
<div style="color: #222222;">
To apply the firewall rules and block the abusers, you need to just execute the fwall-rules script and that’s it.</div>
</span></div>
<div style="color: #222222; font-family: verdana, geneva, sans-serif;">
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># fwall-rules
 * flushing old rules
 * setting default policies
 * allowing loopback devices
 * allowing ssh on port 5622
 * allowing ftp on port 21
 * allowing dns on port 53 udp
 * allowing dns on port 53 tcp
 * allowing http on port 80
 * allowing https on port 443
 * allowing smtp on port 25
 * allowing submission on port 587
 * allowing imaps on port 993
 * allowing pop3s on port 995
 * allowing imap on port 143
 * allowing pop3 on port 110
 * allowing ping responses
 * BLOCKING ABUSIVE IPs
 * SAVING RULES</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><a href="http://wwww.hackthesec.co.in/">wwww.hackthesec.co.in</a>
</pre>
</div>
</div>
</div>

How to Block abusive IP addresses using IPTABLES Firewall in Debian/Ubuntu

Blocking abusive IP addresses using IPTABLES Firewall In computing, a firewall is a network security system that monitors and controls t...

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="margin-bottom: 0in;">
<span style="color: red; font-size: large;"><i style="color: red; font-weight: bold; text-decoration: underline;">Send Email Alert When Hardware Errors
Detected</i></span></div>
<div style="margin-bottom: 0in;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtAmpCzzGIBWU_apJYj-213hyphenhyphensUMg2Ps59KWup0n4uaRzJZmA41rG4KOKjsTS3UwyTkbKfglRLY1t6HnA9Nj9QqmlS_MOdbdq2Mnt-hfVf9-K_zHTPkQOb_vi0EPBrv2KvwoxJjv_mo-5Z/s1600/hardware-bug-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtAmpCzzGIBWU_apJYj-213hyphenhyphensUMg2Ps59KWup0n4uaRzJZmA41rG4KOKjsTS3UwyTkbKfglRLY1t6HnA9Nj9QqmlS_MOdbdq2Mnt-hfVf9-K_zHTPkQOb_vi0EPBrv2KvwoxJjv_mo-5Z/s1600/hardware-bug-www.hackthesec.co.in.jpg" /></a></div>
<span style="color: red; font-size: large;"><u><b><i><br /></i></b></u></span></div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: lime; font-size: medium;"><span style="line-height: 15.6px;">[root@instructor script]# yum install mcelog -y</span></span></pre>
<div style="margin-bottom: 0in;">
<span style="font-size: large;">Default Mcelog cron file is here</span><span style="color: red; font-size: large;"> /etc/cron.hourly/mcelog.cron</span></div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: lime; font-size: medium;"><span style="line-height: 15.6px;">[root@instructor script]# vi /etc/cron.hourly/mcelog.cron

#!/bin/bash

# do not run if mcelogd is running

service mcelogd status >& /dev/null

[ $? -eq 0 ] && exit 0

# is mcelog supported?

/usr/sbin/mcelog --supported >& /dev/null

if [ $? -eq 1 ]; then

exit 1;

/usr/sbin/mcelog --ignorenodev --filter >> /var/log/mcelog </span></span></pre>
<div>
<span style="line-height: 15.6px;"><b><span style="font-family: "georgia" , "times new roman" , serif; font-size: large;"><br /></span></b></span></div>
<div style="margin-bottom: 0in;">
<span style="font-family: "georgia" , "times new roman" , serif; font-size: large;">After that paste bellow line into you
<b>hardwareerror.sh</b> file.. </span></div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: lime; font-size: medium;"><span style="line-height: 15.6px;">[root@instructor script]# touch hardwareerror.sh
</span></span></pre>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: lime; font-size: medium;"><span style="line-height: 15.6px;">[root@instructor script]# vi hardwareerror.sh

#!/bin/bash

[ $(grep -c "error" /var/log/mcelog) -gt 0 ] && echo "Hardware Error Found $(hostname) @ $(date)" |

cat /var/log/mcelog | mail -s 'H/w Error' info@hackthesec.co.in

exit 0 </span></span></pre>
<div style="margin-bottom: 0in;">
<span style="color: red;"><span style="font-family: Georgia, Times New Roman, serif; font-size: large;">and run the script through cronjob<br /></span><span style="color: red;">Note : - If your system get any hardware issue then the script will send you a mail other wise you did </span></span></div>
<div style="margin-bottom: 0in;">
<span style="color: red;"></span></div>
<div style="margin-bottom: 0in;">
<span style="color: red;">not get any email... *Only when your system detected any issue*</span></div>
<div style="margin-bottom: 0in;">
<br /></div>
<div style="margin-bottom: 0in;">
<a href="http://www.hackthesec.co.in/" target="_blank">www.hackthesec.co.in</a><br /><a href="http://www.twitter.com/hackthesecurity">www.twitter.com/hackthesecurity</a><br /><a href="http://www.hackthesec.co.in/p/about-us.html">http://www.hackthesec.co.in/p/about-us.html</a></div>
</div>

Send Email Alert When Hardware Errors Detected

Send Email Alert When Hardware Errors Detected [root@instructor script]# yum install mcelog -y Default Mcelog cron file is here /e...