lion's questions

I am familiar with hardening IPv4 on Ubuntu server, but when I use the same rules for IPv6 with ip6tables, the IPv6 connectivity is lost resulting in Destination unreachable: Address unreachable errors during ping. Could you please advise on how to fix this issue? My logic is the following:

#IPv6
#Reset all rules (F) and chains (X)
ip6tables -F
ip6tables -X

#Force SYN packets check
ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
#Drop XMAS packets
ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
#Drop null packets
ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
#Drop incoming packets with fragments
#ip6tables -A INPUT -f -j DROP #this does not really work like in iptables

#Drop traffic 
ip6tables -t filter -P INPUT DROP
ip6tables -t filter -P FORWARD DROP
ip6tables -t filter -P OUTPUT DROP
#Keep established
ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#Accept loopback
ip6tables -t filter -A INPUT -i lo -j ACCEPT
ip6tables -t filter -A OUTPUT -o lo -j ACCEPT

#ICMP
ip6tables -t filter -A INPUT -p icmp -j ACCEPT
ip6tables -t filter -A OUTPUT -p icmp -j ACCEPT

#ServiceX
ip6tables -t filter -A DESTINATION -p PROTOCOL --dport PORT -j ACCEPT
#ServiceY
ip6tables -t filter -A DESTINATION -p PROTOCOL --dport PORT -j ACCEPT
#ServiceZ
ip6tables -t filter -A DESTINATION -p PROTOCOL --dport PORT -j ACCEPT
...

Example for ssh server, though I never use the default port 22...

#SSH
ip6tables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT

The script is made executable, so it runs across reboots in /etc/init.d/scriptname. The idea is to block everything and allow only what is actually known to be used by the server services. Any better approach, please? Why this works in IPv4, but not in IPv6? When I issue ip6tables -t filter -P INPUT ACCEPT it works, but that's not the point. How do I really secure IPv6 on Ubuntu servers? Thanks!

I have nginx with 3 pools for php7.4-fpm - one for each of 3 users on the system as they have their own apps and files. The setup of all 3 is completely identical, but the recently added one has some permission problem.

Browser returns error 404 - Not Found.

Error returned in nginx log:

2022/01/18 09:32:16 [crit] 504237#504237: *5120 stat() "/var/www/user3/websites/site.com/index.php" failed (13: Permission denied), client: XXX.XXX.XXX.XXX, server: site.com, request: "GET / HTTP/2.0", host: "site.com"

sudo -u user3 stat /var/www/user3/websites/site.com/index.php

returns

  File: /var/www/user3/websites/site.com/index.php
  Size: 405         Blocks: 8          IO Block: 4096   regular file
Device: 807h/2055d  Inode: 1441895     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1003/ user3)   Gid: ( 1003/ user3)
Access: 2022-01-17 20:32:08.081267396 +0000
Modify: 2020-04-26 21:46:41.000000000 +0000
Change: 2022-01-18 09:35:09.129994390 +0000

Pool config:

[php7.4-user3]

user = user3
group = user3

listen = 127.0.0.1:9003
listen.owner = nobody
listen.group = nobody
listen.allowed_clients = 127.0.0.1

pm = ondemand
pm.max_children = 24
pm.start_servers = 16
pm.min_spare_servers = 6
pm.max_spare_servers = 24
pm.process_idle_timeout = 900s
pm.max_requests = 55

php_admin_value[error_log] = /var/log/fpm-php7.4.log
php_admin_flag[log_errors] = on
php_admin_value[error_reporting] = E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED

The other pools are pretty much the same, except pool name, user and group are user1, user2 and the listen port is different like for example 9001, 9002, 9003, hence the x in the config.

virtual host config

server {
    server_name site.com   www.site.com;

    access_log /var/log/nginx/site.com.access.log; 
    error_log /var/log/nginx/site.com.error.log;

    root /var/www/user3/websites/site.com;

    index index.php index.html index.htm;

    location / {
      try_files $uri $uri/ /index.php?$args;
    }
    location ~ \.php$ {
      try_files $uri =404;
      include fastcgi_params;
      fastcgi_pass 127.0.0.1:9003;
    }

    listen 443 ssl http2;
    ssl_certificate /etc/letsencrypt/live/site.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/site.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
server {
    if ($host = www.site.com) {
        return 301 https://$host$request_uri;
    }
    if ($host = site.com) {
        return 301 https://$host$request_uri;
    }
    listen XXX.XXX.XXX.XXX:80;
    server_name site.com   www.site.com;
    return 404;
}

What am I missing for user3, so nginx and fpm work? The same config for user1 and user2 works fine.

I have a problem with docker

docker: Error response from daemon: driver failed programming external connectivity on endpoint containername (containerhash): (iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.17.0.4 --dport 28967 -j ACCEPT: iptables: No chain/target/match by that name.

In the boot log I see

systemd-udevd[4611]: veth9c4b829: Failed to get link config: No such device

Have 4 network ports and it seems to do it at random for each. The idea is to have a separate IP from different /24 subnet for each container, but it looks like docker can't successfully generate outside world access for all of the containers at once. Any advice, please? Routing is done, ports are open and each IP from each network on different network port have ping. It is just docker messing with iptables in some weird way. Resetting firewall does not help.

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -t nat -F
ip6tables -t mangle -F
ip6tables -F
ip6tables -X

There is also IPv6 from different /64 network on each port.

Could post netplan (network config) and rc.local (adds routes at boot), if needed.

Have a server with 4 subnets - 1 usable IP each and each configured on separate network port on the network card. Running 4 docker containers, but they are randomly accessible upon reboot. How to add a static route for each?

container1 - network card port1 - Subnet/IP1
container2 - network card port2 - Subnet/IP2
container3 - network card port3 - Subnet/IP3
container4 - network card port4 - Subnet/IP4

the route of docker for now is: 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1

I need each docker container to use a separate port, network (IP). All containers start. Their IPs are pingable, but looks like docker needs extra static routing. What am I missing?

Is it possible to set up the same VLANs on two different switches with same IPs, but different MACs on dual port network cards of servers? In case switch 1 is down or needs maintenance I would like switch 2 to take over the communication between servers and vice versa as I do not want the entire network of servers to have no connectivity between each other as they are either replicas of each other or shards receiving older data, I need to make the network highly available - redundant. The whole purpose of my network is 3 shards with 3 replicas each and shards of the same app data distributed to make it fail safe, but the network is not fail safe with 1 switch in my engineering plan, yet.

Something like this:

Shard I - fresh data replicated, new incoming data - 3 servers to make it fail safe on server level server1 + server2 + server3

Shard II - server4 (less accessed data) - data moved regularly from fresh data Shard I - replica not needed (redundancy on RAID level)

Shard III - same server4, but data on Modular Storage Arrays attached to server4 - data moved here regularly from Shard II (least accessed data) - replica not needed (redundancy on RAID level)

So I need to make the network fail-safe. My idea is 2nd same switch, but have questions on the setup. Still researching how to achieve. Best method to achieve assuming both switches are not connected? Would it work, if each server is connected to both switches at the same time from different ports on their network cards? Switch used, if matters - Quanta LB6M. Any better switch to recommend for the use case? Do switches need be connected to each other? Then I could possibly try with Dell EMC PowerSwitch S4048-ON 48 10GbE SFP+, 6 40Gbps QSFP+ and use the 40GbE QSFP+ to interconnect the switches and the 10Gbe SFP+ to connect the servers to the switches. Thanks!