Loading
Paranoid Penguin: Using iptables for Local Security
Mick explains how to use the owner match extension for iptables to prevent local users from violating your network's security protocols.
As you can see, the uses of --uid-owner and --gid-owner are pretty straightforward. One thing I haven't mentioned yet is that both options accept names, as I've shown in the examples, or numeric IDs.
Another issue I've dodged is TCP Wrappers-style access controls. On any system that uses TCP Wrappers (or whose stunnel binary was compiled with support for libwrapper), you must add appropriate entries to /etc/hosts.allow for Stunnel to work properly, whether you run Stunnel in client mode or dæmon mode on that host. This is a good thing; rather than being one more thing capable of preventing Stunnel from working, you should think of it as another layer of your security onion.
Finally, I'm leaving it to you to tinker with --pid-owner and --sid-owner. I will give you a hint, though. Many dæmons write their parent PID in a predictable place on startup, that is, /var/run/sshd.pid. By reading such a PID file into a variable in your iptables startup script, you can match packets originating from a specific process. Good luck!
______________________
Webcast
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Sponsored by AMD
White Paper
Private PaaS for the Agile Enterprise
If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.
Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.
Sponsored by ActiveState
- Yeah, user namespaces are
23 min 41 sec ago - Cari Uang
3 hours 54 min ago - user namespaces
6 hours 48 min ago - yea
7 hours 14 min ago - One advantage with VMs
9 hours 42 min ago - about info
10 hours 15 min ago - info
10 hours 16 min ago - info
10 hours 17 min ago - info
10 hours 19 min ago - info
10 hours 21 min ago
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?
Comments
A misteak
The code after Next, we need to allow Stunnel itself to connect to strudel: calls
stunnelinstead ofiptables.Also: should the very first rule for
-P DROPchains be-m state --state ESTABLISHED,NEWor should it be-m state --state ESTABLISHED,RELATED? Perhaps I am mistaken, but I believe--state NEWpermits all new connections.Thank you!
This is the first article I have read that ended up being a truly step-by-step tutorial on setting up iptables in relation to local host network/port restrictions. A while ago I noticed that iptables had started to support user/group based restrictions, but after my first attempt at setting it up, I threw it on a back burner.
Having read through your article today, I decided to try once again to implement user based restrictions. I found that by following your instructions I was able to get a similar example working on my own machine. This in turn gave me a good grasp of the commands and their usage, so my later attempt to create custom restrictions was a resounding success.
Thank you for making an easy to follow, well thought out, and well explained/summarized article.