Tag: Debian

Simplifying iptables management on a Debian (Squeeze) server

My basic management concept for iptables (easy to maintain when you're the owner and administrator of a server). I don't like native iptables management way, so with little help from Google I've recently figured out an alternative way to handle rules loading and applying. Here's how it's done.

First, create (as a su) iptables file which will contain all our rules. File must be executable:

# Rules from this file will be applied on system boot
touch /etc/iptables.rules
chmod +x /etc/iptables.rules

Stuff from the file above will be loaded on system boot. To tell the OS, that he needs to load them, lets use /etc/network/interfaces file. Edit it and paste:

# vim /etc/network/interfaces
# Load our rules automatically
pre-up iptables-restore < /etc/iptables.rules

Now still as a su, create in your home dir file called iptables.rules. Yup - with the same name (but different directory!) as a first one:

touch /home/mylogin//iptables.rules
chmod +x /home/mylogin//iptables.rules

Now let's put our rules into /home/mylogin/iptables.rules:

# vim ~/iptables.rules
# Reset all (block all) and start from zero
# Warning! If you apply only those 3, you're screwed! So watch out!
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
 
# Reject incoming traffic
iptables -P INPUT DROP
 
# Reject forwarded traffic
iptables -P FORWARD DROP

# Accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -o lo -j ACCEPT

# Accept all connections started by us 
# (this can be dangerous if you install shitty stuff on your server)
iptables -P OUTPUT ACCEPT
 
# Accept data related to our requests 
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
  
# http port can be setup with limits or without - here's the example with:
# (not used right now so commented out - 2 lines, should be in 2):
# iptables -A INPUT -p tcp --dport 80 -m state --state NEW 
# -m limit --limit 50/minute --limit-burst 5 -j ACCEPT

# Open ports related to our services (http, https, ssh, etc)
iptables -A INPUT -p tcp --dport 10000 -j ACCEPT # Example: webmin port
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Example: ssh port
iptables -A INPUT -p tcp --dport 80 -j ACCEPT # Example: http port

# After executing and checking, to save rules, perform (as su) command:
# iptables-save > /etc/iptables.rules

In order to check your settings. you can use nmap, a simple (yet powerful) port scanner:

sudo apt-get install nmap
nmap IP/domain

Starting Nmap 5.21 ( http://nmap.org ) at 2012-02-04 15:17 CET
Nmap scan report for domain (IP)
Host is up (0.032s latency).
Not shown: 998 filtered ports
PORT      STATE  SERVICE
80/tcp    open   http

Nmap done: 1 IP address (1 host up) scanned in 8.89 seconds

If everything is ok, save your rules permanently (execute as su):

iptables-save > /etc/iptables.rules

Making Munin work with Mysql on Debian

Easier than I thought (all stuff as SU or using SUDO):

First we need to install some Mysql-Munin perl libraries:

apt-get install libipc-sharelite-perl

Also some Perl stuff will be needed:

perl -MCPAN -eshell
install IPC::ShareLite

Next let's activate Munin Mysql plugin:

# Assuming you have already installed both munin & mysql
ln -s /usr/share/munin/plugins/mysql_* /etc/munin/plugins

Create a user for a Mysql database (so Munin will be able to get stats as this user):

mysql> CREATE USER `munin` @`localhost` IDENTIFIED BY 'somepassword';
mysql> GRANT SUPER ON *.* TO `munin` @`localhost`;
mysql> FLUSH PRIVILEGES;

Edit /etc/munin/plugin-conf.d/munin-node file and find [mysql*] section:

[mysql*]
user root
env.mysqlopts --defaults-file=/etc/mysql/debian.cnf
env.mysqluser munin

Let's also disable WARN: MySQL InnoDB free tablespace information (in most cases it is not valid):

Create a file /etc/munin/plugin-conf.d/mysql_innodb and place following lines into it:

[mysql_innodb]
env.warning 0
env.critical 0

or if You don't need InnoDB part, just turn it off by removing the symlink:

rm /etc/munin/plugins/mysql_innodb

Restart both Apache & Munin:

/etc/init.d/apache2 restart
/etc/init.d/munin-node restart
su munin -c /usr/bin/munin-cron

Wait until charts regenerate and You're ready to go! Example (generated for the first time):

Copyright © 2024 Closer to Code

Theme by Anders NorenUp ↑