Skip to content

Commit 44e905b

Browse files
TirsvadTirsvad
committed
first commit
0 parents  commit 44e905b

File tree

13 files changed

+3770
-0
lines changed

13 files changed

+3770
-0
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# LinuxServerSetup script Default Config
2+
It's download automatic by script if not applied with own config.

‎src/conf/iptables/v4

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
###############################################################################
2+
# The MIT License
3+
#
4+
# Copyright 2012-2014 Jakub Jirutka <jakub@jirutka.cz>.
5+
#
6+
# Permission is hereby granted, free of charge, to any person obtaining a copy
7+
# of this software and associated documentation files (the "Software"), to deal
8+
# in the Software without restriction, including without limitation the rights
9+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
# copies of the Software, and to permit persons to whom the Software is
11+
# furnished to do so, subject to the following conditions:
12+
#
13+
# The above copyright notice and this permission notice shall be included in
14+
# all copies or substantial portions of the Software.
15+
#
16+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22+
# THE SOFTWARE.
23+
#
24+
25+
###############################################################################
26+
#
27+
# Basic iptables/IPv4 template for an ordinary servers
28+
#
29+
# This file is in iptables-restore format. See the man pages for
30+
# iptables-restore(8) and iptables-save(8).
31+
#
32+
# The following is a set of firewall rules that should be applicable to Linux
33+
# servers running within departments. It is intended to provide a useful
34+
# starting point from which to devise a comprehensive firewall policy for
35+
# a host.
36+
#
37+
# Parts 1 and 3 of these rules are the same for each host, whilst part 2 can be
38+
# populated with rules specific to particular hosts. The optional part 4 is
39+
# prepared for a NAT rules, e.g. for port forwarding, redirect, masquerade...
40+
#
41+
# This template is based on http://jdem.cz/v64a3 from University of Leicester.
42+
#
43+
# For the newest version go to https://gist.github.com/jirutka/3742890.
44+
#
45+
# @author Jakub Jirutka <jakub@jirutka.cz>
46+
# @version 1.3.1
47+
# @date 2014-01-28
48+
#
49+
50+
###############################################################################
51+
# 1. COMMON HEADER #
52+
# #
53+
# This section is a generic header that should be suitable for most hosts. #
54+
###############################################################################
55+
56+
*filter
57+
58+
# Base policy
59+
:INPUT DROP [0:0]
60+
:FORWARD DROP [0:0]
61+
:OUTPUT ACCEPT [0:0]
62+
63+
# Loopback device.
64+
-A INPUT -i lo -j ACCEPT
65+
66+
# Continue connections that are already established or related to an established connection.
67+
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
68+
69+
# Drop non-conforming packets, such as malformed headers, etc.
70+
-A INPUT -m conntrack --ctstate INVALID -j DROP
71+
72+
# Block remote packets claiming to be from a loopback address.
73+
-A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
74+
75+
# Drop all packets that are going to broadcast, multicast or anycast address.
76+
-A INPUT -m addrtype --dst-type BROADCAST -j DROP
77+
-A INPUT -m addrtype --dst-type MULTICAST -j DROP
78+
-A INPUT -m addrtype --dst-type ANYCAST -j DROP
79+
-A INPUT -d 224.0.0.0/4 -j DROP
80+
81+
# Chain for preventing SSH brute-force attacks.
82+
# Permits 10 new connections within 5 minutes from a single host then drops
83+
# incomming connections from that host. Beyond a burst of 100 connections we
84+
# log at up 1 attempt per second to prevent filling of logs.
85+
-N SSHBRUTE
86+
-A SSHBRUTE -m recent --name SSH --set
87+
-A SSHBRUTE -m recent --name SSH --update --seconds 300 --hitcount 10 -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "iptables[SSH-brute]: "
88+
-A SSHBRUTE -m recent --name SSH --update --seconds 300 --hitcount 10 -j DROP
89+
-A SSHBRUTE -j ACCEPT
90+
91+
# Chain for preventing ping flooding - up to 6 pings per second from a single
92+
# source, again with log limiting. Also prevents us from ICMP REPLY flooding
93+
# some victim when replying to ICMP ECHO from a spoofed source.
94+
-N ICMPFLOOD
95+
-A ICMPFLOOD -m recent --set --name ICMP --rsource
96+
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "iptables[ICMP-flood]: "
97+
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
98+
-A ICMPFLOOD -j ACCEPT
99+
100+
###############################################################################
101+
# 2. HOST SPECIFIC RULES #
102+
# #
103+
# This section is a good place to enable your host-specific services. #
104+
# ! DO NOT FORGOT TO COPY THESE RULES TO firewall.ip6tables TO ALLOW IPV6 ! #
105+
###############################################################################
106+
107+
###############################################################################
108+
# 3. GENERAL RULES #
109+
# #
110+
# This section contains general rules that should be suitable for most hosts. #
111+
###############################################################################
112+
113+
# Accept worldwide access to SSH and use SSHBRUTE chain for preventing
114+
# brute-force attacks.
115+
-A INPUT -p tcp --dport 22 --syn -m conntrack --ctstate NEW -j SSHBRUTE
116+
117+
# Permit useful IMCP packet types.
118+
# Note: RFC 792 states that all hosts MUST respond to ICMP ECHO requests.
119+
# Blocking these can make diagnosing of even simple faults much more tricky.
120+
# Real security lies in locking down and hardening all services, not by hiding.
121+
-A INPUT -p icmp --icmp-type 0 -m conntrack --ctstate NEW -j ACCEPT
122+
-A INPUT -p icmp --icmp-type 3 -m conntrack --ctstate NEW -j ACCEPT
123+
-A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ICMPFLOOD
124+
-A INPUT -p icmp --icmp-type 11 -m conntrack --ctstate NEW -j ACCEPT
125+
126+
# Do not log packets that are going to ports used by SMB
127+
# (Samba / Windows Sharing).
128+
-A INPUT -p udp -m multiport --dports 135,445 -j DROP
129+
-A INPUT -p udp --dport 137:139 -j DROP
130+
-A INPUT -p udp --sport 137 --dport 1024:65535 -j DROP
131+
-A INPUT -p tcp -m multiport --dports 135,139,445 -j DROP
132+
133+
# Do not log packets that are going to port used by UPnP protocol.
134+
-A INPUT -p udp --dport 1900 -j DROP
135+
136+
# Do not log late replies from nameservers.
137+
-A INPUT -p udp --sport 53 -j DROP
138+
139+
# Good practise is to explicately reject AUTH traffic so that it fails fast.
140+
-A INPUT -p tcp --dport 113 --syn -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
141+
142+
# Prevent DOS by filling log files.
143+
-A INPUT -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "iptables[DOS]: "
144+
145+
COMMIT
146+
147+
###############################################################################
148+
# 4. HOST SPECIFIC NAT RULES #
149+
# #
150+
# Uncomment this section if you want to use NAT table, e.g. for port #
151+
# forwarding, redirect, masquerade... #
152+
###############################################################################
153+
154+
#*nat
155+
156+
# Base policy
157+
#:PREROUTING ACCEPT [0:0]
158+
#:POSTROUTING ACCEPT [0:0]
159+
#:OUTPUT ACCEPT [0:0]
160+
161+
# Redirect port 21 to local port 2121
162+
#-A PREROUTING -i eth0 -p tcp --dport 21 -j REDIRECT --to-port 2121
163+
164+
# Forward port 8080 to port 80 on host 192.168.1.10
165+
#-A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80
166+
167+
#COMMIT

‎src/conf/iptables/v6

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
###############################################################################
2+
# The MIT License
3+
#
4+
# Copyright 2012-2014 Jakub Jirutka <jakub@jirutka.cz>.
5+
#
6+
# Permission is hereby granted, free of charge, to any person obtaining a copy
7+
# of this software and associated documentation files (the "Software"), to deal
8+
# in the Software without restriction, including without limitation the rights
9+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
# copies of the Software, and to permit persons to whom the Software is
11+
# furnished to do so, subject to the following conditions:
12+
#
13+
# The above copyright notice and this permission notice shall be included in
14+
# all copies or substantial portions of the Software.
15+
#
16+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22+
# THE SOFTWARE.
23+
#
24+
25+
###############################################################################
26+
#
27+
# Basic ip6tables/IPv6 template for an ordinary servers
28+
#
29+
# This file is in iptables-restore format. See the man pages for
30+
# ip6tables-restore(8) and ip6tables-save(8).
31+
#
32+
# The following is a set of firewall rules that should be applicable to Linux
33+
# servers running within departments. It is intended to provide a useful
34+
# starting point from which to devise a comprehensive firewall policy for
35+
# a host.
36+
#
37+
# Parts 1 and 3 of these rules are the same for each host, whilst part 2 can be
38+
# populated with rules specific to particular hosts.
39+
#
40+
# This template is based on http://jdem.cz/v64a3 from University of Leicester.
41+
#
42+
# For the newest version go to https://gist.github.com/jirutka/3742890.
43+
#
44+
# @author Jakub Jirutka <jakub@jirutka.cz>
45+
# @version 1.3.1
46+
# @date 2014-01-28
47+
#
48+
49+
###############################################################################
50+
# 1. COMMON HEADER #
51+
# #
52+
# This section is a generic header that should be suitable for most hosts. #
53+
###############################################################################
54+
55+
*filter
56+
57+
# Base policy
58+
:INPUT DROP [0:0]
59+
:FORWARD DROP [0:0]
60+
:OUTPUT ACCEPT [0:0]
61+
62+
# Don't attempt to firewall internal traffic on the loopback device.
63+
-A INPUT -i lo -j ACCEPT
64+
65+
# Continue connections that are already established or related to an established
66+
# connection.
67+
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
68+
69+
# Drop non-conforming packets, such as malformed headers, etc.
70+
-A INPUT -m conntrack --ctstate INVALID -j DROP
71+
72+
# Block remote packets claiming to be from a loopback address.
73+
-A INPUT -s ::1/128 ! -i lo -j DROP
74+
75+
# Chain for preventing SSH brute-force attacks.
76+
# Permits 10 new connections within 5 minutes from a single host then drops
77+
# incomming connections from that host. Beyond a burst of 100 connections we
78+
# log at up 1 attempt per second to prevent filling of logs.
79+
-N SSHBRUTE
80+
-A SSHBRUTE -m recent --name SSH --set
81+
-A SSHBRUTE -m recent --name SSH --update --seconds 300 --hitcount 10 -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "ip6tables[SSH-brute]: "
82+
-A SSHBRUTE -m recent --name SSH --update --seconds 300 --hitcount 10 -j DROP
83+
-A SSHBRUTE -j ACCEPT
84+
85+
# Chain for preventing ping flooding - up to 6 pings per second from a single
86+
# source, again with log limiting. Also prevents us from ICMP REPLY flooding
87+
# some victim when replying to ICMP ECHO from a spoofed source.
88+
-N ICMPFLOOD
89+
-A ICMPFLOOD -m recent --set --name ICMP --rsource
90+
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "ip6tables[ICMP-flood]: "
91+
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
92+
-A ICMPFLOOD -j ACCEPT
93+
94+
95+
###############################################################################
96+
# 2. HOST SPECIFIC RULES #
97+
# #
98+
# This section is a good place to enable your host-specific services. #
99+
###############################################################################
100+
101+
# Accept HTTP and HTTPS
102+
#-A INPUT -p tcp -m multiport --dports 80,443 --syn -m conntrack --ctstate NEW -j ACCEPT
103+
104+
105+
###############################################################################
106+
# 3. GENERAL RULES #
107+
# #
108+
# This section contains general rules that should be suitable for most hosts. #
109+
###############################################################################
110+
111+
# Accept worldwide access to SSH and use SSHBRUTE chain for preventing
112+
# brute-force attacks.
113+
-A INPUT -p tcp --dport 22 --syn -m conntrack --ctstate NEW -j SSHBRUTE
114+
115+
# Permit needed ICMP packet types for IPv6 per RFC 4890.
116+
-A INPUT -p ipv6-icmp --icmpv6-type 1 -j ACCEPT
117+
-A INPUT -p ipv6-icmp --icmpv6-type 2 -j ACCEPT
118+
-A INPUT -p ipv6-icmp --icmpv6-type 3 -j ACCEPT
119+
-A INPUT -p ipv6-icmp --icmpv6-type 4 -j ACCEPT
120+
-A INPUT -p ipv6-icmp --icmpv6-type 133 -j ACCEPT
121+
-A INPUT -p ipv6-icmp --icmpv6-type 134 -j ACCEPT
122+
-A INPUT -p ipv6-icmp --icmpv6-type 135 -j ACCEPT
123+
-A INPUT -p ipv6-icmp --icmpv6-type 136 -j ACCEPT
124+
-A INPUT -p ipv6-icmp --icmpv6-type 137 -j ACCEPT
125+
-A INPUT -p ipv6-icmp --icmpv6-type 141 -j ACCEPT
126+
-A INPUT -p ipv6-icmp --icmpv6-type 142 -j ACCEPT
127+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 130 -j ACCEPT
128+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 131 -j ACCEPT
129+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 132 -j ACCEPT
130+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 143 -j ACCEPT
131+
-A INPUT -p ipv6-icmp --icmpv6-type 148 -j ACCEPT
132+
-A INPUT -p ipv6-icmp --icmpv6-type 149 -j ACCEPT
133+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 151 -j ACCEPT
134+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 152 -j ACCEPT
135+
-A INPUT -s fe80::/10 -p ipv6-icmp --icmpv6-type 153 -j ACCEPT
136+
137+
# Permit IMCP echo requests (ping) and use ICMPFLOOD chain for preventing ping
138+
# flooding.
139+
-A INPUT -p ipv6-icmp --icmpv6-type 128 -j ICMPFLOOD
140+
141+
# Do not log packets that are going to ports used by SMB
142+
# (Samba / Windows Sharing).
143+
-A INPUT -p udp -m multiport --dports 135,445 -j DROP
144+
-A INPUT -p udp --dport 137:139 -j DROP
145+
-A INPUT -p udp --sport 137 --dport 1024:65535 -j DROP
146+
-A INPUT -p tcp -m multiport --dports 135,139,445 -j DROP
147+
148+
# Do not log packets that are going to port used by UPnP protocol.
149+
-A INPUT -p udp --dport 1900 -j DROP
150+
151+
# Do not log late replies from nameservers.
152+
-A INPUT -p udp --sport 53 -j DROP
153+
154+
# Good practise is to explicately reject AUTH traffic so that it fails fast.
155+
-A INPUT -p tcp --dport 113 --syn -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
156+
157+
# Prevent DOS by filling log files.
158+
-A INPUT -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "ip6tables[DOS]: "
159+
160+
COMMIT

‎src/conf/nginx/nginx.conf

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Ideally # of worker processes = # of CPUs or cores
2+
# Set to auto to autodetect
3+
# max_clients = worker_processes * worker_connections
4+
worker_processes 1;
5+
6+
# Maximum number of open file descriptors per process
7+
# should be > worker_connections
8+
worker_rlimit_nofile 10240;
9+
10+
events {
11+
# Use epoll on Linux 2.6+
12+
use epoll;
13+
# Max number of simultaneous connections per worker process
14+
worker_connections 1024;
15+
# Accept all new connections at one time
16+
multi_accept on;
17+
}
18+
19+
http {
20+
# Hide nginx version information
21+
server_tokens off;
22+
23+
# Speed up file transfers by using sendfile() to copy directly
24+
# between descriptors rather than using read()/write()
25+
sendfile on;
26+
27+
# Tell Nginx not to send out partial frames; this increases throughput
28+
# since TCP frames are filled up before being sent out (adds TCP_CORK)
29+
# Send the response header and the beginning of a file in one packet
30+
# Send a file in full packets
31+
tcp_nopush on;
32+
33+
# Tell Nginx to enable the Nagle buffering algorithm for TCP packets
34+
# which collates several smaller packets together into one larger packet
35+
# thus saving bandwidth at the cost of a nearly imperceptible increase to latency
36+
tcp_nodelay off;
37+
38+
include /etc/nginx/mime.types;
39+
default_type application/octet-stream;
40+
41+
##
42+
# SSL Settings
43+
##
44+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
45+
ssl_prefer_server_ciphers on;
46+
47+
##
48+
# Gzip Settings
49+
##
50+
gzip on;
51+
52+
# gzip_vary on;
53+
# gzip_proxied any;
54+
# gzip_comp_level 6;
55+
# gzip_buffers 16 8k;
56+
# gzip_http_version 1.1;
57+
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
58+
59+
##
60+
# Virtual Host Configs
61+
##
62+
include /etc/nginx/conf.d/*.conf;
63+
include /etc/nginx/sites-enabled/*;
64+
}

0 commit comments

Comments
 (0)