JWood's questions

I'm trying to limit the number of possible SSH connections to my server but it just seems to lock me out every time. I'm not very familiar with iptables but I've been reading up on the rules that I need to apply to rate limit the connections but no success. Here's my iptables config file:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [28130:3096101]
:RH-Firewall-1-INPUT - [0:0]
:WebServices - [0:0]
-A INPUT -p tcp --dport 2020 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 2020 -m state --state NEW -m recent --update --seconds 120 --hitcount 8 --rttl --name SSH -j DROP
-A INPUT -j WebServices
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A WebServices -p tcp -m tcp --dport 8088 -j ACCEPT
-A WebServices -p tcp -m tcp --dport 443 -j ACCEPT
-A WebServices -p tcp -m tcp --dport 80 -j ACCEPT
COMMIT

The top 2 rules I believe should prevent any new connections being established from a host if they exceed 8 connections in 2 minutes but it just locks down the port all together. What am I doing wrong?

I'm trying to configure SSH access to my CentOS server using an RSA key rather than with a password but it refuses to accept the key. Here's what I've done so far:

On client machine (OSX):

ssh-keygen -b 4096 -C "[email protected]" -t rsa
// no passphrase

On Server (CentOS 5):

cat id_rsa.pub >> ~/.ssh/authorized_keys2
chmod 700 ~/.ssh
chmod 600 ~/.ssh/*
chmod go-w ~/

// Added to /etc/ssh/sshd_config:
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  .ssh/authorized_keys2

// and finally restart sshd
/sbin/service sshd restart

Back on the client trying to connect:

ssh [email protected] -v

debug1: Found key in /Users/jwood/.ssh/known_hosts:16
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/jwood/.ssh/identity
debug1: Offering public key: /Users/jwood/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Offering public key: /Users/jwood/.ssh/id_dsa
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: password
[email protected]'s password:

As you can see, it tries to use the public key and fails falling back to password. What could be wrong with the config to cause this?

Thanks, J

I'm running apache2 with mod_proxy to forward certain requests to an nginx server running on the same machine. Occasioanaly the Apache server will stop responding all together until a restart. Checking the httpd.log shows the following lines happening every second or 2:

The timeout specified has expired: proxy: error reading status line from remote server localhost proxy: Error reading from remote server returned by /

I've searched google for an answer but found nothing definitive other than people mentioning mod_proxy as the cause.

Does anyone have a clue where to look next or even how to solve it?

Thanks, J

I'm working on an application which uses Volume Shadow Copy Service to backup a particular file at regular intervals. This works when run as admin but when I run the service under the "Network Service" account which I believed to be the correct choice for such as application I am unable to set the SE_BACKUP_NAME privilege and therefore unable to use VSS.

It seems incorrect to run the service as admin but that seems to be the only option. Do I have any other choice?