[PLUGIN] ConfigServer Security & Firewall

winger said:
any plan to release cse for DA too?
Click to expand...
If there's a demand. That and cmq could probably be reasonably easily adapted.

The only issue would be the Virtual Console in cse might have to go due to the mod_perl apache process issues.
 
hello,

csf is blocking the backups:

Falling back to PORT instead of PASV mode.
Could not read reply from control connection -- timed out.
ncftpput /home/tmp/admin/admin.tar.gz: timed out while waiting for server response.

if I stop csf, the backups works.

any help to fix that?

thanks!
 
Your csf isnt properly configured then for passive ports.
 
Make sure the ip_conntrack_ftp kernel module has been loaded (run "lsmod"). It should take care of it without messing with the open ports (which shouldn't list non-listening ports for security reasons).

If anyone opens a set of standard non-privileged non-listening ports the firewall becomes much less useful. The way to go is to compile and load the ip_conntrack_ftp module.
CSF is loading it in my system, those with problems probably don't have it.
 
tillo said:
Make sure the ip_conntrack_ftp kernel module has been loaded (run "lsmod"). It should take care of it without messing with the open ports (which shouldn't list non-listening ports for security reasons).

If anyone opens a set of standard non-privileged non-listening ports the firewall becomes much less useful. The way to go is to compile and load the ip_conntrack_ftp module.
CSF is loading it in my system, those with problems probably don't have it.
Click to expand...

sure, I've just add this ports to check if this was the problem. the VPS was working fine fine APF...

when I run lsmod:

[root@srv11 ~]# lsmod
[root@srv11 ~]#

what does it means?
 
It may mean two separate things: your server has a monolithic kernel (no modules) or it's a VPS (no direct access to kernel settings).
In the first case you may want to recompile the kernel to have ip_conntrack_ftp built in, in the second it depends on which kind of VPS, either the hoster can help you or it's not possible.

Maybe it was working on APF because you didn't set it to block outgoing connections; you can do it on CSF too, by setting TCP_OUT to "0:65535". Remember to set TESTING=1 when modifying a delicate setting like TCP_OUT, then revert it back to 0 if it's working.
This will definitely lower the efficiency of the firewall, but probably be the only solution if you can't have ip_conntrack_ftp on a VPS.

Regarding this last suggestion, it would be better to set a custom range of ports for FTP transfers, like 35000:35999, but this requires access to the ftp server settings on the other end (for passive transfers) or to the client in your system (for active transfers), and then just add them to TCP_OUT (for passive) or TCP_IN (for active). It's complicated, I know, but that's the way FTP has been designed... messy :D
 
tillo said:
It may mean two separate things: your server has a monolithic kernel (no modules) or it's a VPS (no direct access to kernel settings).
In the first case you may want to recompile the kernel to have ip_conntrack_ftp built in, in the second it depends on which kind of VPS, either the hoster can help you or it's not possible.

Maybe it was working on APF because you didn't set it to block outgoing connections; you can do it on CSF too, by setting TCP_OUT to "0:65535". Remember to set TESTING=1 when modifying a delicate setting like TCP_OUT, then revert it back to 0 if it's working.
This will definitely lower the efficiency of the firewall, but probably be the only solution if you can't have ip_conntrack_ftp on a VPS.

Regarding this last suggestion, it would be better to set a custom range of ports for FTP transfers, like 35000:35999, but this requires access to the ftp server settings on the other end (for passive transfers) or to the client in your system (for active transfers), and then just add them to TCP_OUT (for passive) or TCP_IN (for active). It's complicated, I know, but that's the way FTP has been designed... messy :D
Click to expand...

thank you for you help and informations, I've fixed that with something "simple", I've just add the ftp server at the ALLOWED IPs, and it is working fine now :D
 
My suggestion is adapting the "msinstall" code with the DA as the next step. :) and thanks for the new csf.
 
Hi there
I have just installed CSF on my DA VPS
But it seems not running on my server
I can see the link of Config Server as plugin in my admin section
After clicking it I can only see ConfigServer Security & Firewall - csf v4.56 with the logo and nothing below it

Any suggestion
Rizwan
 
TonyTran said:
Thanks, I have fix it by Google ^^
I think it may helpful with you:

Step 1: Securing /tmp
Step 1.1: Backup your fstab file

cp /etc/fstab /etc/fstab.bak

Step 1.2: Creating tmpmnt partition file (Around 1Gb in size)

cd /var
dd if=/dev/zero of=tmpMnt bs=1024 count=1048576

Step 1.3: Format the new partition

mkfs.ext3 -j /var/tmpMnt

Press Y when asked
Step 1.4: Making backup of old /tmp

cp -Rp /tmp /tmp_backup

Step 1.5: Mount the tmp filesystem

mount -o loop,noexec,nosuid,rw /var/tmpMnt /tmp

Step 1.6: Set the right permissions

chmod 0777 /tmp

Step 1.7: Copy the files back to new tmp folder

cp -Rp /tmp_backup/* /tmp/

Step 1.8: Adding new /tmp filesystem to fstab

echo "/var/tmpMnt /tmp ext3 loop,rw,noexec,nosuid,nodev 0 0" >> /etc/fstab

Step 2: No need for 2 tmp filesystems, so we symlink /var/tmp to /tmp

rm -rf /var/tmp/
ln -s /tmp/ /var/tmp
Click to expand...

thank you for that - can we use this also in a VPS?
 
From the chmod man page:
The restricted deletion flag [...] prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the directory.
Click to expand...

It's very, very important for the security of your server. Otherwise any user in the system can for example DoS your MySQL daemon by removing /tmp/mysql.sock, or even gain privileged access by exploiting a temporary file race condition.

The friendly command is "chmod a+rwxt /tmp".
 
Hi,

Does anyone successfully installed this on an openvz vps? And furthermore I guess securing /tmp can't be done in an openvz vps??

Thnx
 
we have over 20 vms with xen using csf,. Work perfectly,. just a pain in the ass when we console in and see few hundred lines of firewall log.

Other than that, gonna get a tattoo with CSF this weekend,. jejeje just kidding,. but really happy we are using them.

I donated a subscription :)
 
just a pain in the ass when we console in and see few hundred lines of firewall log
Click to expand...
You need to tweak /etc/syslog.conf to divert the kernel logging
 
You must log in or register to reply here.
Back
Top