Lito's questions

All my servers are running SSH on non standard port (987) and I want to permanent block all IPs that try to connect to port 22.

I have now the rule iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j DROP but this rule do not add IP to iptables as blocked, only current connection is drop.

Can iptables add a IP as globaly blocked (disable connection on any other port) after first connection try on port 22?

Complete rules are:

iptables -N SSH
iptables -A SSH -p tcp -m tcp --dport 22 -m state --state NEW -j DROP
iptables -A SSH -p tcp -m tcp --dport 987 -m state --state NEW -m recent --rcheck --set --rsource
iptables -A SSH -p tcp -m tcp --dport 987 -m state --state NEW -m recent --rcheck --update --seconds 300 --hitcount 4 --rsource -j DROP

Thanks!

(I'm using iptables v1.8.4 (legacy))

UPDATE 1: Thanks to @A.B

Connections on port 22 managed by ipset with 86400 seconds IP block (1 day).

Connections on port 987 managed by iptables with a 300 seconds block after connection 4 tries (failed or success) in 300 seconds.

ipset create ssh22 hash:ip timeout 86400

iptables -N SSH22
iptables -A SSH22 -p tcp -m tcp --dport 22 -m state --state NEW -j SET --add-set ssh22 src
iptables -A SSH22 -m set --match-set ssh22 src -j DROP

iptables -N SSH
iptables -A SSH -p tcp -m tcp --dport 987 -m state --state NEW -m recent --name ssh --set --rsource
iptables -A SSH -m recent --name ssh --update --seconds 300 --reap --hitcount 4 --rsource -j DROP

UPDATE 2: Final iptables working version:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -s XXX.XXX.XXX.XXX/32 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 987 -m state --state NEW -m recent --set --name ssh --rsource
-A INPUT -m recent --update --seconds 300 --reap --hitcount 4 --name ssh --rsource -j DROP

-A INPUT -p tcp -m tcp --dport 22 -j SET --add-set ssh22 src
-A INPUT -m set --match-set ssh22 src -j LOG --log-prefix "[SSH 22] " --log-level 4
-A INPUT -m set --match-set ssh22 src -j DROP

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

-A INPUT -p tcp -m tcp --dport 80  -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 987 -j ACCEPT

-A INPUT -i lo -p all -j ACCEPT

COMMIT

My DNS provider doesn't allow me to set a custom TTL.

All my domains have a 300 (5 minutes) TTL, that is terrible low.

Can I send to browser a header from nginx with a custom TTL time to overwrite domain TTL?

Thanks!

I have the current proxy modules enabled and working fine:

$ apache2ctl -M | grep proxy
 proxy_module (shared)
 proxy_fcgi_module (shared)

When I enable mod_proxy_http with a2enmod proxy_http and service apache2 restart, apache returns an error as if mod_proxy was not enabled:

oct 16 10:55:45 apachectl[15243]: apache2: Syntax error on line 140 of /etc/apache2/apache2.conf: Syntax error on line 2 of /etc/apache2/mods-enabled/proxy_http.load: Cannot load /usr/lib/apache2/modules/mod_proxy_http.so into server: /usr/lib/apache2/modules/mod_proxy_http.so: undefined symbol: ap_proxy_check_connection

ap_proxy_check_connection is a mod_proxy.h method https://ci.apache.org/projects/httpd/trunk/doxygen/group__MOD__PROXY.html#ga618c0e1bede21bdd3af5d6a802671cae

Maybe some problem on module order load?

Thanks.

UPDATE: After add LoadModule mod_proxy before IncludeOptional directive, the problem is same.

$ vi /etc/apache2/apache2.conf

Include /etc/apache2/mods-available/proxy.load
Include /etc/apache2/mods-available/proxy.conf

# Include module configuration:
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

$ apache2ctl -M | grep proxy

[Mon Oct 16 11:14:00.205439 2017] [so:warn] [pid 19944] AH01574: module proxy_module is already loaded, skipping
 proxy_module (shared)
 proxy_fcgi_module (shared)

$ a2enmod proxy_http

Considering dependency proxy for proxy_http:
Module proxy already enabled
Enabling module proxy_http.
To activate the new configuration, you need to run:
  systemctl restart apache2

$ apache2ctl -M | grep proxy

[Mon Oct 16 11:14:11.256292 2017] [so:warn] [pid 20006] AH01574: module proxy_module is already loaded, skipping
apache2: Syntax error on line 142 of /etc/apache2/apache2.conf: Syntax error on line 2 of /etc/apache2/mods-enabled/proxy_http.load: Cannot load /usr/lib/apache2/modules/mod_proxy_http.so into server: /usr/lib/apache2/modules/mod_proxy_http.so: undefined symbol: ap_proxy_check_connection

I have a SSH + LDAP installation with users public keys stored in LDAP.

I want that when some user in a list (configured into server) do a ssh connection with ssh user@server always log in as root. user user not exists on server, only on LDAP.

Now I have working this steps if I have configured my LDAP uid as root and ssh connection is ssh root@server.

But I need to login with ssh user@server.

Is SSH able to do this map?

Moved from StackOverflow.

I have a problem executing a cron process to check current CPU use in my server.

My script start with:

top -c -n 1 -u www-data > /tmp/kill-cpu

I can execute without problem in console, but in cron I get

top: failed tty get

If I use the -b option to top

top -b -n 1

I get

'dumb': unknown terminal type.

I'm using xterm as TERM

Thanks for your help :)
Lito.

SOLUTION: I was able to solve the problem with:

ln -s /lib/terminfo/d/dumb /usr/share/terminfo/d/dumb

I have a problem with my server (VPS). It's veeery slow.

Checking the connections with netstat, there are a lot of internal connections. I don't understand why!

It's normal all this connections?

# netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp      174      0 localhost:80        localhost:50035     ESTABLISHED -               
tcp        0      0 localhost:80        localhost:49523     FIN_WAIT2   -               
tcp      174      0 localhost:80        localhost:50034     ESTABLISHED -               
tcp        0      0 localhost:80        localhost:49522     FIN_WAIT2   -               
tcp      174      0 localhost:80        localhost:50045     ESTABLISHED -               
tcp      174      0 localhost:80        localhost:50044     ESTABLISHED -               
tcp      174      0 localhost:80        localhost:50043     ESTABLISHED -               
tcp        0      0 localhost:80        localhost:49531     FIN_WAIT2   -               
tcp      174      0 localhost:80        localhost:50042     ESTABLISHED -               
tcp    14494      0 localhost:49448     localhost:80        CLOSE_WAIT  24351/apache2   
tcp    14556      0 localhost:49449     localhost:80        CLOSE_WAIT  24351/apache2   
tcp    25098      0 localhost:49450     localhost:80        CLOSE_WAIT  24351/apache2   
tcp    26914      0 localhost:49444     localhost:80        CLOSE_WAIT  24351/apache2   
tcp    21143      0 localhost:49445     localhost:80        CLOSE_WAIT  24351/apache2   
tcp    17907      0 localhost:49446     localhost:80        CLOSE_WAIT  24351/apache2   
tcp    22300      0 localhost:49519     localhost:80        CLOSE_WAIT  -               
tcp    25098      0 localhost:49528     localhost:80        CLOSE_WAIT  -               
tcp      861      0 localhost:49531     localhost:80        CLOSE_WAIT  24170/apache2   
tcp    17907      0 localhost:49524     localhost:80        CLOSE_WAIT  -               
tcp    16336      0 localhost:49525     localhost:80        CLOSE_WAIT  -               
tcp    14494      0 localhost:49526     localhost:80        CLOSE_WAIT  -               
tcp    14556      0 localhost:49527     localhost:80        CLOSE_WAIT  -               
tcp    51238      0 localhost:49520     localhost:80        CLOSE_WAIT  -               
tcp    18377      0 localhost:49521     localhost:80        CLOSE_WAIT  -               
tcp        0      0 localhost:50003     localhost:80        ESTABLISHED 24417/apache2   
tcp        0      0 localhost:49839     localhost:80        ESTABLISHED -               
tcp      780      0 localhost:49838     localhost:80        ESTABLISHED -               
tcp     3348      0 localhost:49837     localhost:80        ESTABLISHED -               
tcp      925      0 localhost:49836     localhost:80        ESTABLISHED -               
tcp     4159      0 localhost:49835     localhost:80        ESTABLISHED -               
tcp     1960      0 localhost:49834     localhost:80        ESTABLISHED -               

This is only a resume, there are hundred of them.

How can I fix it?

Thanks a lot!

EDIT: Problem seems to be the high CPU use for apache proccess.

top - 09:59:17 up 20:06,  1 user,  load average: 49.51, 41.65, 33.52
Tasks:  73 total,  27 running,  46 sleeping,   0 stopped,   0 zombie
Cpu(s): 91.4%us,  8.6%sy,  0.0%ni,  0.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   1048576k total,   732896k used,   315680k free,        0k buffers
Swap:        0k total,        0k used,        0k free,        0k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
 7978 www-data  16   0 93832  28m 6656 R 11.2  2.8   0:20.99 apache2
 8182 www-data  16   0 93812  27m 6768 R 11.2  2.7   0:07.19 apache2
 8163 www-data  16   0 90068  23m 5412 R 10.9  2.3   0:07.00 apache2
 8095 www-data  16   0 88584  23m 6544 S  3.8  2.3   0:19.31 apache2
 8097 www-data  15   0 88204  23m 6524 S  3.5  2.3   0:17.58 apache2
 8175 www-data  16   0 90780  23m 5900 S  3.5  2.3   0:07.40 apache2
 8058 www-data  15   0 84916  21m 8388 S  3.2  2.1   0:18.26 apache2
 8018 www-data  17   0 89460  23m 6388 R  2.9  2.3   0:15.99 apache2
 8112 www-data  16   0 89308  24m 7276 S  2.9  2.4   0:17.65 apache2
 7880 www-data  17   0 99532  34m 8364 R  2.6  3.3   0:26.61 apache2
 7885 www-data  17   0 94680  28m 7892 R  2.6  2.7   0:28.58 apache2
 7916 www-data  17   0 90388  24m 7932 R  2.6  2.4   0:35.33 apache2
 8002 www-data  17   0 95820  30m 7176 R  2.6  3.0   0:13.93 apache2
 8022 www-data  17   0 96336  31m 7728 R  2.6  3.1   0:21.56 apache2
 8035 www-data  17   0 88728  23m 7464 R  2.6  2.3   0:22.86 apache2
 8066 www-data  17   0 96124  29m 6676 R  2.6  2.9   0:19.17 apache2
 8070 www-data  17   0 93432  26m 6600 R  2.6  2.6   0:17.57 apache2
 8092 www-data  17   0 92668  26m 6260 R  2.6  2.6   0:20.82 apache2
 8142 www-data  17   0 96536  28m 7024 R  2.6  2.7   0:09.55 apache2
 8158 www-data  17   0 84420  18m 5480 S  2.6  1.8   0:06.44 apache2
 8161 www-data  16   0 88452  22m 5924 S  2.6  2.2   0:09.34 apache2
 8171 www-data  17   0 91236  25m 5648 R  2.6  2.4   0:05.09 apache2
 8088 www-data  17   0 88132  22m 6456 S  2.2  2.2   0:14.52 apache2
 8009 www-data  17   0 91484  26m 6468 S  1.9  2.5   0:17.19 apache2
 8116 www-data  16   0 91204  24m 7176 S  1.6  2.4   0:15.72 apache2
 8029 www-data  17   0 92784  26m 7708 S  1.3  2.6   0:23.54 apache2
 7964 www-data  17   0 86836  22m 7676 R  1.0  2.2   0:24.60 apache2
 8032 www-data  16   0 84836  20m 7564 S  1.0  2.0   0:17.05 apache2
 8084 www-data  17   0 99564  32m 6796 R  1.0  3.2   0:15.57 apache2
 8148 www-data  15   0 91424  26m 6356 S  1.0  2.5   0:08.83 apache2
 8062 www-data  17   0 88708  23m 7592 S  0.6  2.3   0:13.60 apache2
 8108 www-data  17   0 92492  25m 6832 S  0.6  2.5   0:18.80 apache2
 8153 www-data  17   0 82604  16m 5364 S  0.6  1.6   0:07.91 apache2
 8006 www-data  17   0 85296  20m 7052 S  0.3  2.0   0:18.04 apache2
 8014 www-data  17   0 88696  25m 8124 S  0.3  2.4   0:19.57 apache2