tomsk's questions

I use AlmaLinux 9, I understand that there is new backend service nftables which can be managed by iptables-nft command, so I set some rules and my rule set looks like:

# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
    chain DOCKER {
        iifname "docker0" counter packets 0 bytes 0 return
        iifname != "docker0" tcp dport 8080 counter packets 3 bytes 180 dnat to 172.17.0.2:80
        iifname != "docker0" tcp dport 9001 counter packets 4 bytes 240 dnat to 172.17.0.3:9001
    }

    chain POSTROUTING {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
        ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
        ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
        ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 9001 counter packets 0 bytes 0 masquerade
        ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 9001 counter packets 0 bytes 0 masquerade
        ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
        ip saddr 172.17.0.3 ip daddr 172.17.0.3 tcp dport 9001 counter packets 0 bytes 0 masquerade
    }

    chain PREROUTING {
        type nat hook prerouting priority dstnat; policy accept;
        fib daddr type local counter packets 236 bytes 12653 jump DOCKER
        fib daddr type local counter packets 39 bytes 1732 jump DOCKER
        fib daddr type local counter packets 39 bytes 1732 jump DOCKER
        fib daddr type local counter packets 23 bytes 1056 jump DOCKER
        fib daddr type local counter packets 23 bytes 1056 jump DOCKER
    }

    chain OUTPUT {
        type nat hook output priority dstnat; policy accept;
        ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
        ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
        ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
    }
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
    chain FORWARD {
        type filter hook forward priority filter; policy drop;
        counter packets 178 bytes 55546 jump DOCKER-USER
        counter packets 178 bytes 55546 jump DOCKER-ISOLATION-STAGE-1
        oifname "docker0" ct state related,established counter packets 84 bytes 11338 accept
        oifname "docker0" counter packets 7 bytes 420 jump DOCKER
        iifname "docker0" oifname != "docker0" counter packets 87 bytes 43788 accept
        iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
    }

    chain DOCKER-USER {
        counter packets 178 bytes 55546 return
    }

    chain INPUT {
        type filter hook input priority filter; policy drop;
        ct state established,related counter packets 195 bytes 18089 accept
        tcp dport 22 counter packets 2 bytes 120 accept
        tcp dport 443 counter packets 0 bytes 0 accept
    }

    chain DOCKER {
        ip daddr 172.17.0.2 iifname != "docker0" oifname "docker0" tcp dport 80 counter packets 3 bytes 180 accept
        ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 9001 counter packets 4 bytes 240 accept
    }

    chain DOCKER-ISOLATION-STAGE-1 {
        iifname "docker0" oifname != "docker0" counter packets 87 bytes 43788 jump DOCKER-ISOLATION-STAGE-2
        counter packets 178 bytes 55546 return
    }

    chain DOCKER-ISOLATION-STAGE-2 {
        oifname "docker0" counter packets 0 bytes 0 drop
        counter packets 87 bytes 43788 return
    }
}

that rule set is saved in /etc/sysconfig/nftables.conf so it is loaded everytime server restarts, as you can see in chain INPUT, everything should be dropped except port 22 and 443, so I tried to run testing nginx server on port 8080 and I can still access it as well, my firewall is not blocking anything.. why? even when INPUT policy is set to drop.

EDIT2:

so I read that docker use DOCKER-USER chain for user defined rules, so I did:

table ip filter {
    chain FORWARD {
        type filter hook forward priority filter; policy drop;
        counter packets 0 bytes 0 jump DOCKER-USER
        counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1
        oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
        oifname "docker0" counter packets 0 bytes 0 jump DOCKER
        iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
        iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
        oifname "docker0" ct state established,related counter packets 184 bytes 27570 accept
        oifname "docker0" ct state established,related counter packets 85 bytes 28483 accept
    }

    chain DOCKER-USER {
        counter packets 534 bytes 178277 return
        tcp dport 8080 drop
        tcp dport 9001 drop
    }

    chain INPUT {
        type filter hook input priority filter; policy drop;
        ct state established,related counter packets 584 bytes 54071 accept
        tcp dport 22 counter packets 8 bytes 460 accept
    }

    chain DOCKER {
        ip daddr 172.17.0.2 iifname != "docker0" oifname "docker0" tcp dport 80 counter packets 0 bytes 0 accept
        ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 9001 counter packets 0 bytes 0 accept
    }

    chain DOCKER-ISOLATION-STAGE-1 {
        iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
        counter packets 0 bytes 0 return
    }

    chain DOCKER-ISOLATION-STAGE-2 {
        oifname "docker0" counter packets 0 bytes 0 drop
        counter packets 0 bytes 0 return
    }
}

and still doesnt work, I can access both ports 8080 and 9001, tried even to restart server.

EDIT 3:

changed my chain to this:

chain DOCKER-USER {
    tcp dport 8080 drop
    tcp dport 9001 drop
    return
}

restarted server and port 8080 is still accesible

I just created new VPS and setup iptables, and I see this in logs:

 IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:56:94:c9:82:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=308

I really wonder what that source 0.0.0.0 and destination 255.255.255.255 mean. It sends packet like every 2 seconds.

I know that IP 0.0.0.0 is like loopback (127.0.0.1), but is accessible for anyone outside. So I really wonder what it could be, it is new VPS with Debian 9 without any server running on it.

So I don't know if I should allow it (for security reasons) and what is the best rule to allow it, isn't there any kind of rule which allow all these kinds of loopback addresses?

I have production server running on Debian 9. I would like to ask you what is safe way to manage MySQL/MariaDB server (on production server).

MySQL/MariaDB server listens only on localhost, because I don't want to be accessible from internet for security reasons.

So if I want something change or look for something, then I have to login into MySQL/MariaDB server using cli and write SQL queries. But I am tired of that.

I would like to ask you what are possibilities or what is the best way to manage MySQL/MariaDB server in safe way and in comfortable way.

I find out some several solutions, but I don't know if they are right, so I write them.

Solution 1

Find some kind of frontend cli software for MySQL/MariaDB server, like Midnight Commander (yes I know that Midnight Commander is like file explorer, but it has that "GUI feel" even it is cli software), but I don't know if that software exists.

Solution 2

Install phpMyAdmin without apache (using -S parameter in PHP) to avoid some security risks, block phpMyAdmin's port using firewall (to be not reachable from internet, only localhost) and connect to phpMyAdmin only via SSH tunneling.

If you know something better, I would be happy for any advice.

I would like to ask you what is faster in term of performance GeoIP or IPset.

Let me explain, imagine that I have rule:

iptables -A INPUT -m geoip ! --src-cc US,UK,CA -j DROP

And imagine that I have IPset of hash:net and I put all these IPs (from US, UK and CA) into hash:net country_whitelist set.

iptables -A INPUT -m set --match-set country_whitelist src -j ACCEPT

What is faster? GeoIP or IPset? We know that IPset is fast because it uses hash table (for hashes), but I don't know how does GeoIP work, if it isn't like 1 subnet for 1 rule.

If I create OpenVPN server on my Linux machine, can I connect to that server (from Windows) using different client for example SoftEther VPN or built-in VPN client in Windows?

Or I have to use OpenVPN client?

Imagine that I have 3 rules in iptables:

1. Check if IP is whitelisted in ipset, then accept it.
2. Check if user tries connect to port 22, then drop it.
3. Check if user tries connect to port 80, then accept it.

This is example (not real) of rules:

iptables -A INPUT -m set --match-set whitelist src -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j DROP

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

But I would like to do that if user is whitelisted (1st rule), then don't accept it, but skip/redirect it to 3rd rule (skip 2nd rule), like on this picture (I know that if packet is ACCEPTED then it is done, this is only example, I don't know how to make that jump):

So I would like to ask you, how can I set this "skipping" in chain.

Subquestion: If it is possible, then is it possible to redirect it to another chain to specific rule too?

Update: Real scenario

iptables -A INPUT -m set --match-set whitelist src -j ACCEPT

iptables -A INPUT -m geoip --src-cc DE -j DROP

... other rules ...

As you can see, I whitelisted only Germany, if German's IP pass throught second rule, then I will check it for other rules, but I use whitelisted IPs too.

So if some IP is whitelisted (mostly not German) then I don't want to check if it is German IP (because it would fail) instead that IP should jump into other rules (3rd row) and skip country checking.

What about go to function?

My server is blocking all IP addresses except Slovakia and Czech Republic, and I would like to log all other countries and then drop it.

So my rules looks like this:

iptables -A INPUT -m geoip ! --src-cc CZ,SK -j LOG_COUNTRY

then I have LOG_COUNTRY chain like this:

iptables -N LOG_COUNTRY
iptables -A LOG_COUNTRY -m limit --limit 5/s --limit-burst 10 -j LOG --log-prefix "COUNTRY DROP: "
iptables -A LOG_COUNTRY -j DROP

I would like to ask you how to "secure" it against DDoS, I set limit, so it should be fine.

But if someone will DDoS me, I would like to get all these IP addresses from DDoS attack, and I don't know if limit 5/s can log all attacker's IP addresses.

I don't know what limit number is considered as safe, I don't want to log same IP addresses and packets multime times per second, rather I would like to log as much different IP addresses as possible. I hope you understand me.

I try to add this rule:

iptables -A INPUT -m geoip ! --src-cc CZ,SK -j DROP

I set GeoIP support according to this answer: Ubuntu IPTables allow only allow 1 country | Super User

But it doesn't work, because I get message: iptables: No chain/target/match by that name.

I use Debian 9.

Update:

After result after running uname -a

Linux Andromeda 4.9.0-4-amd64 #1 SMP Debian 4.9.51-1 (2017-09-28) x86_64 GNU/Linux

How can I fix it?

I would like to ask you what is performance of iptables.

Let's say that I whitelist and blacklist some IP addresses, I block about 10 000+ IP addresses, so every IP is like new rule.

I don't know how fast it is, because let's say that someone DDoS me width bandwidth of some Gbps, can iptables handle it?

CPU: 1 core of Intel ® Xeon® E5-2650L v4

And is possible to make iptables faster? For example that I would "bundle" all these IP addresses into 1 rule.

I need to block about 10 000 IP addresses in my firewall, I have all IP addresses in file, so I run this command from command line:

while read line; do sudo ufw insert 1 deny from $line; done < IP_addresses

And it works, it inserts rules, but it is very slow, it inserts about 1 rule per second, is possible to make it faster?

It is running on Debian 9 with 1 CPU core of Xeon (VPS).

I have Apache2 server running on Debian 9. And I have 2 virtualhost configs in /etc/apache2/sites-enabled/ folder.

First:

Options FollowSymLinks

<Directory "/srv/">
        Options FollowSymLinks ExecCGI
        Require all granted
</Directory>

<Directory "/srv">
        Options FollowSymlinks ExecCGI
        Require all granted
</Directory>

<VirtualHost *:80>
       ServerName domain.sk
       ServerAlias dev.domain.sk
       DocumentRoot /srv/domain.sk/!www
       <Directory /srv/domain.sk/!www>
                Options Indexes FollowSymlinks ExecCGI
                AllowOverride All
       </Directory>
</VirtualHost>

Second:

Options FollowSymLinks

<Directory "/home/test/">
        Options FollowSymLinks ExecCGI
        Require all granted
</Directory>

<VirtualHost *:80>
       ServerName domain.sk
       ServerAlias test.dev.domain.sk
       DocumentRoot /home/test/domain.sk/!www
       <Directory /home/test/domain.sk/!www>
                Options Indexes FollowSymlinks ExecCGI
                AllowOverride All
       </Directory>
</VirtualHost>

Problem is that if I go to dev.domain.sk it is ok, but if I go to test.dev.domain.sk it will show content of dev.domain.sk and not content of test.dev.domain.sk. If I disable first virtualhost config then I see content of test.dev.domain.sk, so it looks like dev.domain.sk "override" that test.dev.domain.sk, how can I solve it?

On my server is Debian 9 with Apache2, and quite often apache2 just stop working and I have to log into SSH and manually start it.

So I looked into Apache2 error's log and I found lot of NULs, like on this screenshot:

So I really don't know what to do, because I don't know why apache2 crashed. I don't think it is because of warning in

/srv/Cyclone3/.core/.libs/TOM/Warning.pm

because I have quite often these warnings and no problem with it (I know I have to fix it in future, but I have to solve this Apache2 crash now).

I try to install mysql server with command apt-get install mysql-server mysql-common

But output is:

Reading package lists... Done
Building dependency tree
Reading state information... Done
mysql-common is already the newest version (5.8+1.0.2).
The following additional packages will be installed:
  default-mysql-server mariadb-client-10.1 mariadb-client-core-10.1
  mariadb-common mariadb-server-10.1 mariadb-server-core-10.1
Suggested packages:
  mariadb-test netcat-openbsd tinyca
The following NEW packages will be installed:
  default-mysql-server mariadb-client-10.1 mariadb-client-core-10.1
  mariadb-common mariadb-server-10.1 mariadb-server-core-10.1 mysql-server
0 upgraded, 7 newly installed, 0 to remove and 0 not upgraded.
Need to get 18.8 MB/18.8 MB of archives.
After this operation, 169 MB of additional disk space will be used.
Do you want to continue? [Y/n]

As you can see it will not install mysql server but mariadb-server-10.1 why?

I want mysql not mariadb.

Sources list:

deb http://ftp.fr.debian.org/debian/ stretch main contrib non-free
deb-src http://ftp.fr.debian.org/debian/ stretch main contrib non-free

# Security
deb http://security.debian.org/ stretch/updates main contrib non-free
deb-src http://security.debian.org/ stretch/updates main contrib non-free

# Backports
deb http://ftp.debian.org/debian/ stretch-backports main contrib non-free

I have a Apache2 webserver running and I created SSL certificate using sslforfree.com

Everytime when I try to reload a page I get a message "SSL_ERROR_RX_RECORD_TOO_LONG". I tried to disable firewall too.

This is my config of virtualhost:

<VirtualHost _default_:80>
    ServerName www.dev.bellakabelky.sk
    Redirect / https://www.dev.bellakabelky.sk/
</VirtualHost>

<VirtualHost _default_:433>
      ServerName www.bellakabelky.sk
      ServerAlias bellakabelky.sk
      ServerAlias dev.bellakabelky.sk
      DocumentRoot /srv/Cyclone3/!bellakabelky.sk/!www

      SSLEngine on
      SSLProtocol all
      SSLCertificateFile /etc/ssl/certs/bellakabelky.crt
      SSLCertificateKeyFile /etc/ssl/private/bellakabelky.key
      SSLCertificateChainFile /etc/ssl/certs/bellakabelky_ca_bundle.crt

      <Directory /srv/Cyclone3/!bellakabelky.sk/!www>
              Options Indexes FollowSymlinks ExecCGI
              AllowOverride All
      </Directory>
</VirtualHost>

ports.conf:

Listen 80
Listen 443 https

Port 443 is allowed, but I don't know where can be a problem.

I have a dedicated server that connects to a webhosting to send a mails using SMTP protocol, but I get 554 5.7.1 and 221 2.7.0 errors and e-mail won't send. Full SMTP log is below.

This is a script for sending e-mails written in Perl:

    my $mail = "mail.bellakabelky.sk";
    my $pass = "secret";
    my $user = "mail\@bellakabelky.sk";
    my $to = "tomsk.slovak\@gmail.com";

    use Data::Dumper;
    use Net::SMTP;
    use Mail::Mailer qw(sendmail);

    my $smtp = Net::SMTP->new(
                       Host => $mail,
                       Port => '25',
                       Hello => 'dev.bellakabelky.sk',
                       Timeout => 30,
                       Debug   => 1,
                      );
    print Dumper($smtp);
    $smtp->auth($user,$pass);
    $smtp->mail($user);
    $smtp->to($to);
    $smtp->recipient($to);
    $smtp->data();
    $smtp->datasend("To: Tomsk <$to>\r\n");
    $smtp->datasend("From: Mail <$user>\r\n");
    $smtp->datasend("Return-Path: $user\r\n");
    $smtp->datasend("Reply-To: $user\r\n");
    $smtp->datasend("Subject: Subject\r\n");
    $smtp->datasend("\r\n");
    $smtp->datasend("hello");
    $smtp->dataend();
    $smtp->quit;

And I get 554 5.7.1 and 221 2.7.0 errors. This is a log from SMTP:

Net::SMTP>>> Net::SMTP(2.33)
Net::SMTP>>>   Net::Cmd(2.30)
Net::SMTP>>>     Exporter(5.71)
Net::SMTP>>>   IO::Socket::INET(1.35)
Net::SMTP>>>     IO::Socket(1.38)
Net::SMTP>>>       IO::Handle(1.35)
Net::SMTP=GLOB(0x51d1810)<<< 220 mail4-1.hostmaster.sk ESMTP Postfix
Net::SMTP=GLOB(0x51d1810)>>> EHLO dev.bellakabelky.sk
Net::SMTP=GLOB(0x51d1810)<<< 250-mail4-1.hostmaster.sk
Net::SMTP=GLOB(0x51d1810)<<< 250-PIPELINING
Net::SMTP=GLOB(0x51d1810)<<< 250-SIZE 104857600
Net::SMTP=GLOB(0x51d1810)<<< 250-ETRN
Net::SMTP=GLOB(0x51d1810)<<< 250-STARTTLS
Net::SMTP=GLOB(0x51d1810)<<< 250-AUTH PLAIN LOGIN
Net::SMTP=GLOB(0x51d1810)<<< 250-AUTH=PLAIN LOGIN
Net::SMTP=GLOB(0x51d1810)<<< 250-ENHANCEDSTATUSCODES
Net::SMTP=GLOB(0x51d1810)<<< 250 8BITMIME
$VAR1 = bless( \*Symbol::GEN1, 'Net::SMTP' );
Net::SMTP=GLOB(0x51d1810)>>> AUTH PLAIN bWFpbEBiZWxsYWthYmVsa3kuc2sAbWFpbEBiZWxsYWthYmVsa3kuc2sARXNob3AxMjNrYWJlbGt5
Net::SMTP=GLOB(0x51d1810)<<< 235 2.7.0 Authentication successful
Net::SMTP=GLOB(0x51d1810)>>> MAIL FROM:<[email protected]>
Net::SMTP=GLOB(0x51d1810)<<< 250 2.1.0 Ok
Net::SMTP=GLOB(0x51d1810)>>> RCPT TO:<[email protected]>
Net::SMTP=GLOB(0x51d1810)<<< 554 5.7.1 <[email protected]>: Sender address rejected: Your mail account ([email protected]) was compromised. Please change your password immediately after next login and contact technical support.
Net::SMTP=GLOB(0x51d1810)>>> RCPT TO:<[email protected]>
Net::SMTP=GLOB(0x51d1810)<<< 554 5.7.1 <[email protected]>: Sender address rejected: Your mail account ([email protected]) was compromised. Please change your password immediately after next login and contact technical support.
Net::SMTP=GLOB(0x51d1810)>>> DATA
Net::SMTP=GLOB(0x51d1810)<<< 554 5.5.1 Error: no valid recipients
Net::SMTP=GLOB(0x51d1810)>>> To: Tomsk <[email protected]>
Net::SMTP=GLOB(0x51d1810)>>> From: Mail <[email protected]>
Net::SMTP=GLOB(0x51d1810)>>> Return-Path: [email protected]
Net::SMTP=GLOB(0x51d1810)>>> Reply-To: [email protected]
Net::SMTP=GLOB(0x51d1810)>>> Subject: Subject
Net::SMTP=GLOB(0x51d1810)>>>
Net::SMTP=GLOB(0x51d1810)>>> hello
Net::SMTP=GLOB(0x51d1810)>>> .
Net::SMTP=GLOB(0x51d1810)<<< 221 2.7.0 Error: I can break rules, too. Goodbye.
Net::SMTP=GLOB(0x51d1810)>>> QUIT
Net::SMTP: Unexpected EOF on command channel at (eval 187) line 49.

I really don't know, where can be a problem, I was looking for solution but I didn't find anything.

I run apache2 webserver on Debian 9 and root of that web is located in /srv/www/, I am logged as user tomsk, problem is that I don't have a permissions in /srv/www/ because it is owned by www-data group.

As far as I know, www-data has only read permissions in that folder so I shouldn't give a write permission for group www-data in that folder.

Let's say that I have a group named developers and I am a member of that group. What I have to do to give a permissions for group developers in folder /srv/www/, without affecting a apache2's default www-data group?

EDIT: Shouln't it be 2470? Because user (www-data) can only read, group (developers) can do anything and others cannot do anything.

I am running Nginx server on Debian 9. My problem is that, Nginx is serving Perl files in root directory, but it is not serving in alias directory (I get 403 Forbidden).

This is my configuration of alias:

    include /etc/nginx/fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    server {
        listen   80;

        server_name www.example.tld example.tld;
        root /srv/!example.tld/!www;
        index  desktop.pl index.html index.htm core.tom core.pl;

        location /my_alias {

            alias /srv/!example.tld/my_alias/!www;

            location ~ /my_alias/\.pl$ {
                gzip off;
                fastcgi_pass unix:/var/run/fcgiwrap.socket;
            }
        }

        location ~ \.pl$ {
            gzip off;
            fastcgi_pass unix:/var/run/fcgiwrap.socket;
        }
    }

I really don't know what is wrong with it.

Everything what I want is to execute Perl files on whole server (all aliases), ideal is to execute Perl files on ALL sites (virtualhosts).