Hack The Sec-Leading Resource Of Linux Tutorial: scripting

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" style="background-color: white; box-sizing: border-box; font-family: Lato, sans-serif; line-height: 1.1; margin: 20px 0px 10px;">
<span style="color: #990000; font-size: large;"><u>Blocking abusive IP addresses using IPTABLES Firewall</u></span></h1>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">In computing, a firewall is a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted, secure internal network and another outside network, such as the Internet, that is assumed to not be secure or trusted. </span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVLpw76eQcyxf_FJfA5z-xQ_rnjxqJKvLr9bioRWOZ81yGF0gkvnv0ZmEtr_cz0GqKBerizxuLX9yKohg0XrJiIrpt3n3evDA2WOxvLVHWD3uPwxo6i3pImzS__HETrwaS2C9lFrontj46/s1600/firewall_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVLpw76eQcyxf_FJfA5z-xQ_rnjxqJKvLr9bioRWOZ81yGF0gkvnv0ZmEtr_cz0GqKBerizxuLX9yKohg0XrJiIrpt3n3evDA2WOxvLVHWD3uPwxo6i3pImzS__HETrwaS2C9lFrontj46/s1600/firewall_www.hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Firewalls are often categorized as either network firewalls or host-based firewalls. Network firewalls are a software appliance running on general purpose hardware or hardware-based firewall computer appliances that filter traffic between two or more networks. Host-based firewalls provide a layer of software on one host that controls network traffic in and out of that single machine</span></span></div>
<div>
<div style="font-family: verdana, geneva, sans-serif;">
<ul style="color: #222222; font-size: 15px; line-height: 26px; text-align: left;">
<li>Flushing the old firewall rules</li>
<li>Determining service ports</li>
<li>Setting-up default policies</li>
<li>Setting-up your firewall rules</li>
<li>Saving your firewall rules</li>
</ul>
<div>
<div>
<span style="font-size: 15px; line-height: 26px;"><b><u><span style="color: #0b5394;">BLOCKING IPs USING IPTABLES</span></u></b></span></div>
<div style="color: #222222;">
<span style="font-size: 15px; line-height: 26px;">To block some abusive IP address or range of IPs, you can use the following iptables rules:</span></div>
</div>
</div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: trebuchet ms, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;">## iptables -I INPUT -s 1.2.3.4 -j DROP
## iptables -I INPUT -s 1.2.0.0/16 -j DROP</span></span></pre>
</div>
<div>
<div>
<span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><b><u>CREATING THE BLACKLIST</u></b></span></span></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">For better readability and maintenance, it is a good idea to have all abusing IPs in one particular file, for example <b>/etc/blacklist.ips</b>. This way, you can add the IP addresses or subnets in this file (one IP or subnet per line) and use the <b>fwall-rules</b> script below to block anything listed in this file.</span></span></div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">So, create or edit <b>/usr/local/bin/fwall-rules </b>and make it as follows:</span></span></div>
</div>
<div style="color: #222222; font-family: verdana, geneva, sans-serif;">
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">#!/bin/bash
#
# iptables firewall script
# 
#

IPTABLES=/sbin/iptables
BLACKLIST=/etc/blacklist.ips

echo " * flushing old rules"
${IPTABLES} --flush
${IPTABLES} --delete-chain
${IPTABLES} --table nat --flush
${IPTABLES} --table nat --delete-chain

echo " * setting default policies"
${IPTABLES} -P INPUT DROP
${IPTABLES} -P FORWARD DROP
${IPTABLES} -P OUTPUT ACCEPT

echo " * allowing loopback devices"
${IPTABLES} -A INPUT -i lo -j ACCEPT
${IPTABLES} -A OUTPUT -o lo -j ACCEPT

${IPTABLES} -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## BLOCK ABUSING IPs HERE ##
#echo " * BLACKLIST"
#${IPTABLES} -A INPUT -s _ABUSIVE_IP_ -j DROP
#${IPTABLES} -A INPUT -s _ABUSIVE_IP2_ -j DROP

echo " * allowing ssh on port 5622"
${IPTABLES} -A INPUT -p tcp --dport 5622  -m state --state NEW -j ACCEPT

echo " * allowing ftp on port 21"
${IPTABLES} -A INPUT -p tcp --dport 21  -m state --state NEW -j ACCEPT

echo " * allowing dns on port 53 udp"
${IPTABLES} -A INPUT -p udp -m udp --dport 53 -j ACCEPT

echo " * allowing dns on port 53 tcp"
${IPTABLES} -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT

echo " * allowing http on port 80"
${IPTABLES} -A INPUT -p tcp --dport 80  -m state --state NEW -j ACCEPT

echo " * allowing https on port 443"
${IPTABLES} -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

echo " * allowing smtp on port 25"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT

echo " * allowing submission on port 587"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT

echo " * allowing imaps on port 993"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT

echo " * allowing pop3s on port 995"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT

echo " * allowing imap on port 143"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT

echo " * allowing pop3 on port 110"
${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT

echo " * allowing ping responses"
${IPTABLES} -A INPUT -p ICMP --icmp-type 8 -j ACCEPT

# DROP everything else and Log it
${IPTABLES} -A INPUT -j LOG
${IPTABLES} -A INPUT -j DROP

#
# Block abusing IPs 
# from ${BLACKLIST}
#
if [[ -f "${BLACKLIST}" ]] && [[ -s "${BLACKLIST}" ]]; then
    echo " * BLOCKING ABUSIVE IPs"
    while read IP; do
        ${IPTABLES} -I INPUT -s "${IP}" -j DROP
    done < <(cat "${BLACKLIST}")
fi

#
# Save settings
#
echo " * SAVING RULES"

if [[ -d /etc/network/if-pre-up.d ]]; then
    if [[ ! -f /etc/network/if-pre-up.d/iptables ]]; then
        echo -e "#!/bin/bash" > /etc/network/if-pre-up.d/iptables
        echo -e "test -e /etc/iptables.rules && iptables-restore -c /etc/iptables.rules" >> /etc/network/if-pre-up.d/iptables
        chmod +x /etc/network/if-pre-up.d/iptables
    fi
fi

iptables-save > /etc/fwall.rules
iptables-restore -c /etc/fwall.rules</pre>
</div>
<div>
<span style="color: #222222; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">make sure the script is executable by adding an ‘x’ bit to it:</span></span></div>
<div>
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: trebuchet ms, sans-serif;"><span style="font-size: 15px; line-height: 15.6px;"># chmod +x /usr/local/bin/fwall-rules</span></span></pre>
</div>
<div style="font-family: verdana, geneva, sans-serif;">
<span style="font-size: 15px; line-height: 26px;"><div>
<b><u><span style="color: #0b5394;">APPLYING THE RULES</span></u></b></div>
<div style="color: #222222;">
To apply the firewall rules and block the abusers, you need to just execute the fwall-rules script and that’s it.</div>
</span></div>
<div style="color: #222222; font-family: verdana, geneva, sans-serif;">
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"># fwall-rules
 * flushing old rules
 * setting default policies
 * allowing loopback devices
 * allowing ssh on port 5622
 * allowing ftp on port 21
 * allowing dns on port 53 udp
 * allowing dns on port 53 tcp
 * allowing http on port 80
 * allowing https on port 443
 * allowing smtp on port 25
 * allowing submission on port 587
 * allowing imaps on port 993
 * allowing pop3s on port 995
 * allowing imap on port 143
 * allowing pop3 on port 110
 * allowing ping responses
 * BLOCKING ABUSIVE IPs
 * SAVING RULES</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><a href="http://wwww.hackthesec.co.in/">wwww.hackthesec.co.in</a>
</pre>
</div>
</div>
</div>

How to Block abusive IP addresses using IPTABLES Firewall in Debian/Ubuntu

Blocking abusive IP addresses using IPTABLES Firewall In computing, a firewall is a network security system that monitors and controls t...

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="font-size: x-large;"><b><u>Rsync-Backup Script</u></b></span><br />
<div style="background-color: white; text-align: justify;">
<div>
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">rsync is a widely-used utility to keep copies of a file on two computer systems the same. It is commonly found on Unix-like systems and functions as both a file synchronization and file transfer program. The rsync algorithm, a type of delta encoding, is used to minimize network usage. Zlib may be used for additional compression, and <a href="http://www.hackthesec.co.in/search/label/SSH">SSH </a>or stunnel can be used for data security.</span></span></div>
<div>
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifikxORTcCWGEKUMGs1B6qcE1FGZYXx-mprnhY8QwnPw9dNKSTaGTZZPm_lirxHa8AENfuM2DO4WARHmwYpEE7R1Od8Eax49M_8FbrwO6iCOKtZ3y7Fjy213cJsCYpHW5hV-h17xVcTzx-/s1600/Rsync-data-backup-www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifikxORTcCWGEKUMGs1B6qcE1FGZYXx-mprnhY8QwnPw9dNKSTaGTZZPm_lirxHa8AENfuM2DO4WARHmwYpEE7R1Od8Eax49M_8FbrwO6iCOKtZ3y7Fjy213cJsCYpHW5hV-h17xVcTzx-/s1600/Rsync-data-backup-www.hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Rsync is typically used to synchronize files and directories between two different systems. For example, if the command rsync local-file user@remote-host:remote-file is run, rsync will use SSH to connect as user to remote-host. Once connected, it will invoke the remote host's rsync and then the two programs will determine what parts of the file need to be transferred over the connection.</span></span></div>
<div>
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"><br /></span></span></div>
<div>
<span style="color: #222222; font-family: Verdana, Geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">Rsync can also operate in a daemon mode, serving files in the native rsync protocol (using the "<a href="http://www.hackthesec.co.in/search/label/rsync">rsync</a>://" syntax).</span></span></div>
</div>
<div style="text-align: center;">
<span style="font-size: x-large;"><b><u><a href="http://hackthesec.byethost22.com/rsync-backup.sh">DOWNLOAD HERE</a></u></b></span></div>
</div>

Rsync-Automatic Backup Script

Rsync-Backup Script rsync is a widely-used utility to keep copies of a file on two computer systems the same. It is commonly found on Un...