CSF Blocking EVERYTHING

If you have csf installed on a OpenVZ container, suddenly you may end up with  csf blocking all ips and even ssh, email and all services will not be accesible, even though server is working, but firewall puts a block on everyone, and appears offline to others.

I got this fixed by doing the following steps:

Login to the host node and edit /etc/vz/conf/vpsid.conf. For example I'm using 101 as vpsid.

[root@node ~]# vi /etc/vz/conf/101.conf

Then add the following line to the end of the file. 

IPTABLES="iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc"

Now restart the container.

[root@node ~]# vzctl restart  101

The problem should be resolved now!!

How to install Csf

Csf installation is very simple and quite straightforward. Login to the server as root, then navigate to the desired location where you wan't to download the installation file.

#cd /usr/local/src

Then download the installation package:

#wget http://www.configserver.com/free/csf.tgz

Now ontar the package using the blow command

#tar -xzf csf.tgz 

Now get into the directory csf

#cd csf 

Now run the below command to install

#sh install.sh

 Once the installation is done, you can do the configuration in

#/etc/csf/csf.conf

Once this is done  disable TESTING mode, lfd will not start while this is enabled. For this change the value to "0" from "1" in csf.conf file.

TESTING = "0"

Once this is done, restart the csf .

#csf -r 

DONE!!!! 

How to block Ddos

You can find the ips which have most number of connections with the command below.

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

The result of above command will look something like that is given below.

1 192.168.1.1
1 192.168.1.2
15 192.168.2.26
25 192.168.2.27
30 192.168.1.29
39 192.168.1.32
100 192.168.1.50


You can use the following script to block the ips causing ddos.


#!/bin/bash

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n > test.out

for i in `cat test.out | awk '{print $2}' `

do

 {

 if [ "$i" != "127.0.0.1" ] && [ `cat test.out | grep $i | awk '{print$1}'` -gt 35 ] && [  "$i" != "0.0.0.0" ]

 then

 iptables -A INPUT -s $i -j DROP

 echo "Writing the rule :iptables -A INPUT -s $i -j DROP"

 fi

 }

done

How to Install maldetect

For installing Maidetect in your server, login to your server.

Download the latest tar file available using wget .

#wget http://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the file using the the command below.

# tar -xzvf maldetect-current.tar.gz

Get into the directory  maldetect-*

# cd maldetect-1.4.2/

Now issue the following command, which will install maldetect in your server

# sh install.sh

Now for scanning a particular directory "eg: /home"  using maldetect, issue the below command

#maldet -a  /home

Install rkhunter

The following steps explains how to install rkhunter in your server.

Firstly login to your server as root. And navigate to the directory where you would download the file.

# cd /usr/local/src

Now download the source file using wget.

# wget http://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.0/rkhunter-1.4.0.tar.gz

Now extract the file using the following comand.

# tar -zxvf rkhunter-1.4.0.tar.gz

And get into the directory rkhunter-*

# cd rkhunter-1.4.0

Now, the command below will install rkhunter in your server.

# ./installer.sh --install

Now to automate the scan do the following steps below. We are creating the file in /usr/local/

# vi rkhunterscan

Add the following script to the file.

#!/bin/sh

( /usr/local/bin/rkhunter --versioncheck
/usr/local/bin/rkhunter --update
/usr/local/bin/rkhunter --cronjob --report-warnings-only
) | /usr/bin/mail -s "rkhunter output" admin@yourdomain.com

Now change the permission.

# chmod 750 rkhunterscan

Now edit the cronjob.

# crontab -e

Now add the following line.

0 3 * * * /usr/local/rkhunterscan -c

Email alert on root ssh login

For setting up email alert on root login, firstly login to the server.

Then get into the directory /root

# cd /root

The using your favorite editor, edit the file ".bashrc"

# vi .bashrc

Go to the end of the file. And insert the following line.

echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" you@yourdomain.com

Replace the following in the line with your variables.

YourserverName = Server hostname or Server IP address
you@yourdomain.com = Your mail id where you would like to receive the alert.


You are DONE!! Now if you login to the server, you will be receiving email alert at you@yourdomain.com.

Enable/Disable ping in a server

To disable ping in the server, you can execute the following

root@amaziah [~]# echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

Now, if you want to re-enable it,

root@amaziah [~]# echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all

Now to disable it permanently, you can edit /etc/sysctl.conf

root@amaziah [~]#vi /etc/sysctl.conf

edit the following line

net.ipv4.icmp_echo_ignore_all = 0

and replace the "0" with "1" ie.

net.ipv4.icmp_echo_ignore_all = 1

 then save and close the file.

How to install Chkrootkit

Firstly login to the shell and go to the desired location where the installation file has to be downloaded.

root@amaziah [~]# cd /usr/local/src

Now download Chkrootkit

# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

Unpack the file that you just have downloaded

# tar -xzvf  chkrootkit.tar.gz

Now do the following,

# cd chkrootkit-*

# make sense

We have finished the installation process. You scan the server by

# ./chkrootkit

Now we can set a daily cronjob  to scan the server and send the report to your mail id

# crontab -e

Add the following line

0 1 * * * (cd /usr/local/src/chkrootkit*; ./chkrootkit 2>&1 | mail -s “chkrootkit output” email@domain.com)