Seguridad

por carlosap | 8 julio, 2006

Aplique un firewall con webmin con estas reglas:

Action	Condition	Comment	Move	Add
Accept	If input interface is not eth0	Accept traffic from internal interfaces
Accept	If protocol is TCP and TCP flags ACK (of ACK) are set	Accept traffic with the ACK flag set
Accept	If state of connection is ESTABLISHED	Allow incoming data that is part of a connection we established
Accept	If state of connection is RELATED	Allow data that is related to existing connections
Accept	If protocol is UDP and destination port is 1024:65535 and source port is 53	Accept responses to DAS quermes
Accept	Id protocola is ICMP and ICMP tape is echo-reply	Accept responses to oír pinga
Accept	Id protocola is ICMP and ICMP tape is destination-unreachable	Accept notifications o unreachable hosts
Accept	Id protocola is ICMP and ICMP tape is source-quench	Accept notifications to reduce sending speed
Accept	Id protocola is ICMP and ICMP tape is time-exceded	Accept notifications o los packets
Accept	Id protocola is ICMP and ICMP tape is para meter-problema	Accept notifications o protocola problema
Drope	Id protocola is TCP and destination port is ssh	Allow connections to oír SSH servar
Accept	Id protocola is TCP and destination port is auto	Allow connections to oír IDENT servar
Accept	Id protocola is TCP and destination port is http	Allow connections to oír HTTP servar
Accept	Id protocola is TCP and destination port is ftp	Allow connections to oír ftp servar
Accept	Id protocola is TCP and destination port is 21	Allow connections to oír MAL servar

Desactive SSH es un peligro Cuantos accesos a ROBOT!!!!

Failed
wow y hay muchos mas un montón! Estaban probando si podían entrar a mi servidorsito humilde

Debido a esto desactive root para ssh server en webmin

Allow

También en la parte de usuarios limite el acceso a un único usuario.

Ahora entiendo la paranoia de algunos linuxeros que no quieren abrir ningun puerto. Y se les enchina la piel.

Update:

Al actualizar el servidor de SSH desactive sin querer el servicio de nxserver así que hay que incluir en la lista de usuarios aceptados “nx”