I'd like to use lists of networks to block all countries outside of mine on my firewall box. We don't need access to other places at work and it would look good in a security audit. I found a site that publishes lists to add. So I have a few newb linux questions..
1. Where is the best place to add this, a hosts.deny file? Does it work like a windows hosts file in linux where no traffic is allowed? I read something about it only applies to tcpwrappers and I don't know if our apache build, mysql, webmin uses tcpwrappers. Our webserver is fedora/apache/mysql and rails
2. how would you add that to iptables, and would it slow the machine down a lot? Its a dual athlon 64 4400. Usually have 2-4 concurrent users.
3. On my firewall box which is untangle, can you edit the hosts.allow and hosts.deny files without screwing up Untangle?
and the bonus question - anyone use ossec or something similar? Any suggestions on a favorite? I like the central console idea of ossec.
It turns out you can easily block whole countries and domains in hosts.deny. So I'm now blocking all countries except the US, plus some other specific domains. Combined with denyhosts (Python script that looks for bad SSH login requests in /var/log/messages and shares attackers in a global database), it has cut my incoming SSH attacks from dozens per day to essentially zero.
I can't switch ports because at work they only let me out on port 22.
I have a very simple hosts.allow file, just 2 entries. This ensures that I can always get in via my employer's VPN, which gives me the same outside IP all the time.
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
# See 'man 5 hosts_access' and 'man 5 hosts_options'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers.
ALL: 192.168.1.0/24 # Local network
ALL: a.b.c.d # My employer's VPN
# hosts.deny This file describes the names of the hosts which are
# *not* allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow. In particular
# you should know that NFS uses portmap!
I've never used untangle... but last I checked hosts.allow / hosts.deny only applied to programs that used tcp_wrappers for connections TO the linux host (untangle). With iptables you'll need to filter packets as they come through the FORWARD chain. The only way this may work is if some of the untangle blades / features actually use tcp_wrappers and the connection is made TO the firewall and then proxied on....
Just saying, keep it in mind and test to verify it actually blocks like you want.