Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 6 ■ SECURING YOUR SYSTEMS01 iptables -A SSH -j LOG --log-prefix "ssh:"02 iptables -A SSH -m limit --limit 3/min --limit-burst 3 -j ACCEPT03 iptables -P SSH DROPLine 01 logs all connections (see line 05 in the first setup). Line 02 does the limiting work. The limitis set at three connections per minute, but this is an average. limit-burst sets how often the average ischecked. So here, the rule will be checked after three connections. If those three connections havehappened within a minute, the limiting is triggered; no further packets will be accepted until a fullminute has passed (whereupon we’re back below the three per minute rate). If you set --limit-burst as6, you could get six connections through as fast as you like, but after that you would have to wait untiltwo minutes had passed since the first connection to have another packet accepted.Line 03 sets the chain policy to DROP; so, all other packets are dropped.Finally, we have the issue of when to trigger this. We want to replace line 06 in the first listing, whichis also rule 6 in the INPUT chain (execute iptables -L –linenumbers -n to check this). Use this commandto replace (-R) rule 6 with this definition:iptables -R INPUT 6 -d 192.168.100.25 -p tcp -m tcp --dport 22 -j SSHThis passes all SSH connections (in other words, TCP connections coming in on the SSH port, port21) to the SSH chain.You can also get rid of rule 5, since the logging is now done in the SSH chain:iptables -D INPUT 5■ Note Remember that after this rule is deleted, the numbering of the rules in the chain will change! It’s alwayswise to use iptables -L --linenumbers to check rule numbers before you make changes.Now, an SSH packet for this machine will be passed to the SSH chain and rate limited.6-14. Monitoring for Break-ins with chkrootkitchkrootkit enables you to have a set of important files monitored for signs of an attacker breaking in, forrootkits, and for worms and other similar nasties. You can set it up to send you information on a regularbasis.It should be available as a package for most distros. On Debian/Ubuntu, install it like this:sudo apt-get install chkrootkitAlternatively, install from source from http://www.chkrootkit.org/.You can run it manually with /usr/sbin/chkrootkit. You should see a list of files being checked and(ideally!) all having “not infected” after their names. You’ll also see the program searching for variousspecific worms and rootkits and for suspicious files generally. If anything has been found, you’ll see thestring INFECTED.152Download at WoweBook.Com