<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Oh, I can tell you - they <span style="font-weight: bold;">aren't</span> permanent. The BlueQuartz/BlueOnyx management scripts will rewrite the /etc/sysconfig/iptables rules file each time a new site is added or deleted. And then it will reload the IP Tables firewalling software after that - using the newly changed rules file.
<br />
<br />I've gotten around that somewhat by putting the changes in the /etc/sysconfig/iptables rules file and then making it immutable. Once that file attribute is set - not even the root user can change that file. So the management scripts can't change the file and the reload just restarts the firewall. So, how do you do that?
<br />
<br />Edit /etc/sysconfig/iptables. It will look something like this:
<br />
<br /><font size="2"># /etc/sysconfig/iptables
<br /># This file is automatically generated by log_traffic.
<br /># Any manual changes will be lost
<br />*filter
<br />:INPUT ACCEPT [0:0]
<br />:FORWARD ACCEPT [0:0]
<br />:OUTPUT ACCEPT [0:0]
<br />:acctin - [0:0]
<br />:acctout - [0:0]
<br />-A INPUT -j acctin
<br />-A OUTPUT -j acctout
<br />-A acctin -d 216.136.nnn.nnn/32
<br />-A acctout -s 216.136.nnn.nnn/32
<br />-A acctin -d 216.54.nnn.nnn/32
<br />-A acctout -s 216.54.nnn.nnn/32
<br />-A acctin -d 216.54.nnn.nnn/32
<br />-A acctout -s 216.54.nnn.nnn/32
<br />-A acctin -d 216.54.nnn.nnn/32
<br />-A acctout -s 216.54.nnn.nnn/32
<br />-A acctin -d 127.0.0.1/32
<br />-A acctout -s 127.0.0.1/32
<br />COMMIT</font>
<br />
<br />Put your new rules in above all the "acctin" rules already there. Those existing rules allow anyone in with any traffic to those IP addresses, so your block has to go in first to be effective. Using the previously discussed IPs, it would look something like:
<br />
<br />-A acctin -s 41.210.0.0/16 -j DROP
<br />
<br />Save the modified file and make it immutable (unchangeable) with the command: "chattr +i iptables" while in the /etc/sysconfig directory. You can see if the change took effect with "lsattr" command in the /etc/sysconfig directory. You'll see a little "i" in the list of file attributes in front of the iptables file.
<br />
<br />That's it. Reload IP Tables with "service iptables restart" and your new rule is in effect. And it won't go away this way.
<br />
<br />BUT! The drawback - if you add another site/IP to your server, the management scripts can't put in a allow for that new IP address. Ooops! You've got to manually add it to the /etc/sysconfig/iptables file. Sorry. But it does keep your firewall rules you want permanent from being overwritten.
<br />
<br />Oh, yea - remove the immutable file attribute with "chattr -i iptables". Once you've removed that attribute - you can edit/modify the file.
<br />
<br />
<br />I'll admit - its kinda ungainly. And believe me - I'd prefer a different method. Maybe a secondary file in the /etc/sysconfig directory where you could put user-defined firewall rules you want permanent. And when the BlueOnyx management scripts rewrote the /etc/sysconfig/iptables ruleset - it could put those user-defined rules in first. But that would be a major change that could only be done by the BlueOnyx group. Plus, it may not get done because that would start to cut in to the Solarspeed APF/BFD firewall package.
<br />
<br />That's an idea for you Hugo. If you're uncomfortable with command-line changes to the firewall, you should consider the firewall package from Solarspeed. Its supposed to detect those username/password guessing attempts and automatically block them. You wouldn't have to figure out where its coming from and add a firewall rule - it does it for you.
<br />
<br />Good luck and I hope that provides some help.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br /><font size="2"><b>---------- Original Message
-----------</b>
<br />
From: Hugo Sesma <hsesma@gmail.com>
<br />
To: BlueOnyx General Mailing List <blueonyx@blueonyx.it>
<br />
Sent: Mon, 7 Jun 2010 19:48:06 -0500
<br />
Subject: [BlueOnyx:04710] Re: send mail Relay exploit
<br />
<br />> Chuk,
<br />>
<br />> thanks for your info I'm checking to use it
with webmin and see if they are permanet
<br />>
<br />> Regards
<br />>
<br />> On Mon, Jun 7, 2010 at 6:49 PM, Chuck Tetlow <span dir="ltr"><<a href="mailto:chuck@tetlow.net">chuck@tetlow.net</a>></span> wrote:
<br />>
<blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">
<br />>
<font size="2">And while you're at it - block their further attempts to
find/exploit another
username/password.
<br />>
<br />> The easiest way to do it - block it with IP Tables. Use this
to block that oneI
IP:
<br />> /sbin/iptables -I acctin 1 -d <a target="_blank" href="http://41.210.18.88/32">41.210.18.88/32</a> -j
DROP
<br />>
<br />> But since changing their IP is easy, I'd recommend
blocking at least the whole /24 network they are on.
Use
<br />> /sbin/iptables -I acctin 1 -d <a target="_blank" href="http://41.210.18.0/24">41.210.18.0/24</a> -j
DROP
<br />>
<br />> In my own case, I couldn't care less about e-mails from
Ghana. I'd lock out the entire block of IPs assigned to that country
with
<br />> /sbin/iptables -I acctin 1 -d <a target="_blank" href="http://41.210.0.0/16">41.210.0.0/16</a> -j
DROP
<br />>
<br />> Any of these rules will block further traffic from that IP or
their networks. But remember - this is temporary. The next time you boot the
server, or create a website - IP Tables are reloaded and your temp rule is
gone. Then they're back at your server. Making the rule permanent is a bit
more
involved.
<br />>
<br />>
Chuck
<br />>
<br />> </font><font size="2">
<br />>
<br />> <b>---------- Original
Message
-----------</b>
<br />>
From: Michael Stauber <<a target="_blank" href="mailto:mstauber@blueonyx.it">mstauber@blueonyx.it</a>>
<br />>
To: BlueOnyx General Mailing List <<a target="_blank" href="mailto:blueonyx@blueonyx.it">blueonyx@blueonyx.it</a>>
<br />>
Sent: Tue, 8 Jun 2010 01:25:00 +0200
<br />>
Subject: [BlueOnyx:04707] Re: send mail Relay exploit
<br />>
<br />> > Hi Hugo,
<br />> >
<br />> >
> since friday our server has been exploited as a relay for several domains
<br />> >
> who are spammers
<br />> >
<br />> >
Do you have SMTP-Auth enabled? If not, enable it. But from what I see it in
<br />> >
your logs it should be on already. With SMTP-Auth enabled only users
<br />> >
authenticated with their username and password can send emails through your
<br />> >
server.
<br />> >
<br />> >
> Here is some logs
<br />> >
<br />> >
>From those log lines only one entry indicates the actual relaying of emails
<br />> >
through your server:
<br />> >
<br />> >
Jun 7 16:23:14 ns1 sendmail[23694]: o57LMj4U023694:
<br />> >
from=<<a target="_blank" href="mailto:tbent@wanadoo.co.uk">tbent@wanadoo.co.uk</a>>, size=1509, class=0, nrcpts=50,
<br />> >
msgid=<<a target="_blank" href="mailto:201006072122.o57LMj4U023694@ns1.abaco.net.mx">201006072122.o57LMj4U023694@ns1.abaco.net.mx</a>>,
proto=ESMTP,
daemon=MTA,
<br />> >
relay=<a target="_blank" href="http://adsl1888.4u.com.gh/">adsl1888.4u.com.gh</a>
[41.210.18.88]
<br />> >
<br />> >
Someone from the IP [41.210.18.88] sent a 1509 byte large mail to 50
<br />> >
recipients in one go. The line "proto=ESMTP" indicates that he used
SMTP-Auth
<br />> >
to authenticate against Sendmail and that was apparently done with a valid
<br />> >
username and password.
<br />> >
<br />> >
Then the next snippet shows how four of the 50 generated emails were sent out:
<br />> >
<br />> >
Jun 7 16:23:16 ns1 sendmail[23755]: o57LMj4U023694:
<br />> >
to=<<a target="_blank" href="mailto:fultonmr@aol.com">fultonmr@aol.com</a>>,<<a target="_blank" href="mailto:fultimeslackervb@aol.com">fultimeslackervb@aol.com</a>>,<<a target="_blank" href="mailto:fulmoon19@aol.com">fulmoon19@aol.com</a>>,<<a target="_blank" href="mailto:fulltipz@aol.com">fulltipz@aol.com</a>>,
<br />> >
delay=00:00:27, xdelay=00:00:02, mailer=esmtp, pri=1591509,
<br />> >
relay=<a target="_blank" href="http://mailin-02.mx.aol.com/">mailin-02.mx.aol.com</a>. [205.188.155.110], dsn=2.0.0,
stat=Sent (2.0.0 Ok:
<br />> >
queued as 3EC3F38000CAD)
<br />> >
<br />> >
This went to some AOL users in one go.
<br />> >
<br />> >
So it appears someone has guessed, sniffed or brute forced the login details
<br />> >
of one of your email users.
<br />> >
<br />> >
How to find out which account that's from?
<br />> >
<br />> >
Check /var/log/maillog and find the entries immediately above this one:
<br />> >
<br />> >
Jun 7 16:23:14 ns1 sendmail[23694]: o57LMj4U023694:
<br />> >
from=<<a target="_blank" href="mailto:tbent@wanadoo.co.uk">tbent@wanadoo.co.uk</a>> [...]
<br />> >
<br />> >
There should be a line like this:
<br />> >
<br />> >
Jun 7 16:23:14 ns1 sendmail[XXX]: AUTH=server,
relay=<a target="_blank" href="http://adsl1888.4u.com.gh/">adsl1888.4u.com.gh</a>
<br />> >
[41.210.18.88], authid=USERNAME, mech=PLAIN, bits=0
<br />> >
<br />> >
That shows "authid=" and the username they used to send the email.
<br />> >
<br />> >
Or you can use cat and grep to search for it like this:
<br />> >
<br />> >
cat /var/log/maillog | grep AUTH=server | grep 41.210.18.88
<br />> >
<br />> >
That searches for "AUTH=server" (which identifies the SMTP-Auth
logins) and
<br />> >
for the IP address of the sender of the email. That will return all matching
<br />> >
log entries and the "authid=" part will reveal the compromised
username.
<br />> >
<br />> >
--
<br />> >
With best regards
<br />> >
<br />> >
Michael Stauber
<br />> >
<br />> >
_______________________________________________
<br />> >
Blueonyx mailing list
<br />> >
<a target="_blank" href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a>
<br />> >
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br />> <b>------- End of Original Message
-------</b>
<br />>
</font>
<br />> _______________________________________________
<br />>
Blueonyx mailing list
<br />>
<a href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a>
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br />>
<br />> </blockquote>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>