I followed this guide https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-setting_and_controlling_ip_sets_using_firewalld to create an ipset with ip to block.
This is my ip list.
204.48.27.45
36.255.84.59
144.217.99.65
185.246.128.147
46.35.226.16
68.144.0.0/13
158.69.0.0/16
149.56.16.0/20
167.114.0.0/16
192.99.0.0/16
188.92.77.15
216.196.92.101
217.0.0.0/8
54.93.0.0/16
220.0.0.0/8
165.22.0.0
95.236.242.22
87.4.246.61
159.138.0.0/16
181.234.22.88
185.198.56.133
195.103.133.46
38.0.0.0/8
61.0.0.0/8
58.0.0.0/8
49.0.0.0/8
182.0.0.0/8
171.0.0.0/8
163.0.0.0/8
153.0.0.0/8
144.255.0.0/16
140.255.0.0/16
14.0.0.0/8
125.0.0.0/8
124.0.0.0/8
121.0.0.0/8
119.0.0.0/8
118.0.0.0/8
116.0.0.0/8
115.0.0.0/8
113.0.0.0/8
112.0.0.0/8
110.0.0.0/8
111.0.0.0/8
106.0.0.0/8
175.0.0.0/8
117.0.0.0/8
114.0.0.0/8
180.0.0.0/8
183.0.0.0/8
120.0.0.0/8
104.148.105.5
60.0.0.0/8
101.0.0.0/8
123.0.0.0/8
59.0.0.0/8
39.0.0.0/8
47.96.0.0/15
47.92.0.0/14
191.31.72.6
85.93.89.25
154.83.29.101
178.156.202.190
51.0.0.0/8
34.64.0.0/10
178.159.102.4
138.200.0.0/15
138.198.0.0/15
159.69.0.0/16
199.59.91.34
87.247.136.147
95.211.209.158
188.241.192.137
95.160.35.21
109.254.254.111
93.105.187.11
185.234.217.32
(people trying to copy my sites, access restricted areas, etc.)
Everything seems to work, but then my sites go offline and I can no longer even access my server via ssh.
And there seems to be nothing to do, the only solution is to clear the ip list and restart the server, and everything starts working again.
What's not working? There doesn't seem to be anything difficult or strange, and the guide is on redhat.com, it should be reliable... but it doesn't work tragically...
I just want to prevent those ip's from accessing my server, am I doing something wrong? Am I doing it right? Are there better ways to do it?
---------------------update---------------------
Today I get this errors:
firewalld[845]: ERROR: '/usr/sbin/nft add rule inet firewalld raw_PREROUTING_ZONES index 0 ip saddr #blacklist goto raw_PRE_drop' failed:
firewalld[845]: ERROR: '/usr/sbin/nft add rule inet firewalld raw_PREROUTING_ZONES index 0 ip saddr #blacklist goto raw_PRE_drop' failed:
firewalld[845]: ERROR: '/usr/sbin/nft insert rule inet firewalld raw_PREROUTING_ZONES iifname "ens3" goto raw_PRE_public' failed: Error: Could not process rule: No such file or directory
insert rule inet firewalld raw_PREROUTING_ZONES iifname "ens3" goto raw_PRE_public
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
firewalld[845]: ERROR: '/usr/sbin/nft insert rule inet firewalld raw_PREROUTING_ZONES iifname "ens3" goto raw_PRE_public' failed: Error: Could not process rule: No such file or directory
insert rule inet firewalld raw_PREROUTING_ZONES iifname "ens3" goto raw_PRE_public
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
firewalld[845]: ERROR: COMMAND_FAILED: '/usr/sbin/nft insert rule inet firewalld raw_PREROUTING_ZONES iifname "ens3" goto raw_PRE_public' failed: Error: Could not process rule: No such file or directory
insert rule inet firewalld raw_PREROUTING_ZONES iifname "ens3" goto raw_PRE_public
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
And with this, I found this: https://bugs.centos.org/view.php?id=16518
I'm not sure it's the same, but it looks a lot like...
I was almost thinking of disabling firewalld and using nftables directly, but will it be the same?
Related
I have the following router in my exim.conf:
my_redirect_router:
driver = redirect
data = ${lookup{$local_part#$domain}lsearch{/etc/exim/file}}
The /etc/exim/file used by lsearch has the following lines:
asdfqwerty#domain.com: asdf-qwerty#domain.com
asdf-qwerty#domain.com: abc#domain1.com,def#domain2.com,ghi#domain3.com
In the past, when an email is sent to asdfqwerty#domain.com, exim would be able to redirect to asdf-qwerty#domain.com, for which exim would then forward the email to the emails listed in the expansion. With the exim 4.89 that I have installed, this "recursive" lsearch expansion does not work anymore. When it receives mail for asdfqwerty#domain.com, it returns this error:
** asdf-qwerty#domain.com <asdfqwerty#domain.com>: Unknown user
I haven't changed my exim.conf file in 5+ years. What should I do to get this behavior again? Thanks!
Run a debug session using the -bt switch and see what it gives you:
exim -d -bt asdf-qwerty#domain.com
It should show you where the lookup is failing.
I work with cloudstack4.9.2.0, have add a kvm host, the agent has started but it always crashed with log message:
[cloud.agent.Agent] (AgentShutdownThread:null) (logid:) Stopping the agent: Reason = sig.kill
and there is no more useful error message.
But when I use dmesg, I see these:
[18343.770338] libvirtd[5320]: segfault at 7fd34826c313 ip 00007fd34826c313 sp 00007fd343deacf0 error 14 in libnss_sss.so.2[7fd349a0f000+8000]
[18493.759889] libvirtd[10687]: segfault at 7f2d3ad17313 ip 00007f2d3ad17313 sp 00007f2d5016bcf0 error 14
[18642.749523] libvirtd[16073]: segfault at 7f098e654313 ip 00007f098e654313 sp 00007f09a4114cf0 error 14 in libnss_sss.so.2[7f098fdf7000+8000]
[18792.739096] libvirtd[21469]: segfault at 7f374ed17313 ip 00007f374ed17313 sp 00007f374e8dccf0 error 14
[18926.729704] libvirtd[26724]: segfault at 7fbaf62a9313 ip 00007fbaf62a9313 sp 00007fbaf5e6ecf0 error 14
does anyone know what is going on?
Looks like agent is being killed for some reason.
Can you check if Kvm host is able to access 8250 port of cloudstack server ?
I am trying to implement the default setting provided by OWASP.
Link:https://www.modsecurity.org/CRS/Documentation/quickstart.html
When restarting apache I am getting eror
Syntax error on line 45 of
/etc/modsecurity/rules/REQUEST-910-IP-REPUTATION.conf: Internal Error:
Failed to add rule to the ruleset. Action 'configtest' failed. The
Apache error log may have more information. ...fail!
The code for the relevant section is
SecRule TX:DO_REPUT_BLOCK "#eq 1" \
"msg:'Request from Known Malicious Client (Based on previous traffic violations).',\
logdata:'Previous Block Reason: %{ip.reput_block_reason}',\
severity:'CRITICAL',\
id:910000,\
phase:request,\
block,\
t:none,\
tag:'application-multi',\
tag:'language-multi',\
tag:'platform-multi',\
tag:'attack-reputation-ip',\
tag:'IP_REPUTATION/MALICIOUS_CLIENT',\
setvar:'tx.msg=%{rule.msg}',\
skipAfter:BEGIN_REQUEST_BLOCKING_EVAL,\
chain"
SecRule IP:REPUT_BLOCK_FLAG "#eq 1" \
"setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}"
whereas line 45 in the error refers to chain"
I don't have any idea about the syntax of these rules.
You are maybe affected by the Apache bug 55910
Handling of line wrapping is broken if "\" is the last character before buffer resizing.
[...]
This issue is also affecting ModSecurity.
Upgrade to Apache 2.4.11 to solve the issue.
I'm trying to start Pentaho server on Debian Jessie.
Pentaho crap itself by showing the following error:
15:55:24,198 WARN [PentahoSolutionSpringApplicationContext] Exception encountered during context initialization - cancelling refresh attempt
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.h2.tools.Server' defined in file [/opt/pentaho-biplatform-ce-6.1.0.1-196/biserver-ce/pentaho-solutions/system/GettingStartedDB-spring.xml]: Invocation of init method failed; nested exception is org.h2.jdbc.JdbcSQLException: Exception opening port "H2 TCP Server (tcp://localhost:9092)" (port may be in use), cause: "timeout" [90061-131]
Error is very clear - port 9092 is used by something else. The problem is that it is actually used by Pentaho, so it's complaining about the port which is currently used by itself...
To test that I've changed the port to 9093 in the following file:
./pentaho-solutions/system/GettingStartedDB.properties
The only difference between exceptions now was that port, which was 9093 this time, so it's definitely complaining about the port it is using, very weird.
Full log can be found here: http://ix.io/1ydv
Ideas?
Try to add the following attribute to the CATALINA_OPTS options in the start_pentaho.sh file :
CATALINA_OPTS="... -Dh2.bindAddress=ip_of_your_machine"
It helped me to remove the Exception opening port "H2 TCP Server (tcp://localhost:9092)" (port may be in use) error.
adding as follows in CATALINA_OPTS options in the start_pentaho.sh file is solving this issue:
CATALINA_OPTS="... -Dh2.bindAddress=localhost"
The root cause of the problem is that your server's hostname does not points to 127.0.0.1
Just add(edit) this line into your /etc/hosts:
127.0.0.1 localhost YOUR_HOST_NAME
Error message given by Apache:
[ pid=26810 thr=140719191291712 file=ext/apache2/Hooks.cpp:862 time=2014-01-27 10:57:06.221 ]:
Unexpected error in mod_passenger: Cannot connect to Unix socket
'/tmp/passenger.1.0.25998/generation-0/socket': Permission denied (13)
Backtrace: [Truncated...]
As a temporary fix, changing owner apache:apache of /tmp/passengerXXX solves the issue.
But when restart apache, this directory is owned by root and error.
Help me ##