SSH connections getting through

binro · l33t Joined: 06 May 2005 Posts: 742 Location: Bangkok

I am getting the following messages in my syslog:

The addresses are not on /etc/hosts.allow so are getting rejected. What puzzles me is that I use iptables and port 22 is not open, so I would not expect the packets to get through at all. I use nulog to analyze my netfilter messages and a search shows no packets arriving for port 22. My iptables rules are listed below:

Any comments appreciated.
_________________
"Ship me somewheres east of Suez, where the best is like the worst,
Where there ain't no Ten Commandments an' a man can raise a thirst"
from "Mandalay" by Rudyard Kipling

morodoch · Guru Joined: 22 Sep 2005 Posts: 523 Location: England

I'm not familiar with the output of the iptables save command; this command should produce more human readable output:

ASID · Apprentice Joined: 22 Mar 2006 Posts: 195

I believe you have as default strategy to allow INPUT traffic unless you block some ports. A good firewall should be the other way round. You should block all INPUT traffic unless you want some ports open for your services. You should set:

binro · l33t Joined: 06 May 2005 Posts: 742 Location: Bangkok

Thanks for the tip. I changed the default policy as you suggested and iptables output is now:

It doesn't seem to have caused any harm, so I shall wait to see if it catches any miscreants!

Cheers.
_________________
"Ship me somewheres east of Suez, where the best is like the worst,
Where there ain't no Ten Commandments an' a man can raise a thirst"
from "Mandalay" by Rudyard Kipling

binro · l33t Joined: 06 May 2005 Posts: 742 Location: Bangkok

Hmm, I am doing something very stupid here. I logged on via dial-up and used nmap against my domain and I am not stopping anything! Yet my tables are derived from the standard HOWTO but I must have borked something somewhere along the line. Here is the iptables output again, and I must say it looks logical to me:

ASID · Apprentice Joined: 22 Mar 2006 Posts: 195

First of all you shouldn't panic

What was the result of the scan? Did you see port 22 open? Did you set the default rules for INPUT to DROP? Did you make sure that you set this to the correct position so that no other rule bypass it?

Also, if you could provide us with the script for your firewall we would be more helpfull.

binro · l33t Joined: 06 May 2005 Posts: 742 Location: Bangkok

No panic, /etc/hosts.allow is keeping them out. Yes, I changed the default policy to DROP, you can see that at the top of the chain definitions. nmap showed the ports for all the active services open, including 22. I don't have a script, I use the /etc/init.d/iptables service which reads /var/lib/iptables/rules.save and effectively issues an iptables command against each line. Here is the output of iptables-save which might be easier to read:

ASID · Apprentice Joined: 22 Mar 2006 Posts: 195

Wierd! Everything looks good. Try adding a rule to block port 22 and test again. If this fails then your firewall is not running.

binro · l33t Joined: 06 May 2005 Posts: 742 Location: Bangkok

Ok, I found the problem by comparison with a machine that I have not been improving! The problem rule is:

morodoch · Guru Joined: 22 Sep 2005 Posts: 523 Location: England

I think the problem may be your "block" rule; I think packets may drop off the end of it, maybe you need to