Differences

This shows you the differences between two versions of the page.

--- wiki:firewall [2023/06/08 22:23] – guidebeacon
+++ wiki:firewall [2023/10/05 19:29] (current) – guidebeacon
@@ Line 2: / Line 2: @@
 The cPanel servers make use of various firewalling features
-''dev.beacontechnology.com'' uses ''CSF'' to manage the Linux firewall (iptables).
 ''chost.beacontechnology'' uses ''Host Access Control'' to manage the Linux firewall (nftables).
-===== CSF =====
+===== cPHulk =====
+''cPHulk'' is part of cPanel and will ban IPs that log too many login failures. ''cPHulk'' does not normally completely firewall off blocked IPs, and instead only blocks them from logging in. This is fixed by a custom script that imports these rules into nftables on a schedule.
-==== Whitelisting IPs ====
+''cPHulk'' has a whitelist, blacklist and country management feature. These are managed by the user.
-IPs can be whitelisted two different ways, either via the web interface or SSH
+The script that dumps the whitelist and country blacklist, and imports them into ''nftables''.
-If using the web interface:
+''/etc/cron.daily/update_firewall.sh''
-  - Go to WHM > ConfigServer Security & Firewall
+==== Whitelist Management  ====
-  - Click "csf" tab near the top, under the banners
-  - Under "csf - ConfigServer Firewall" click "Firewall Allow IPs"
-  - Add IP and comment to list how the rest are
-  - Click Change
-  - Click Restart csf+lfd
-If using shell/ssh
+In general it is a good idea to whitelist administrative IPs to avoid getting banned.
-  - Edit ''/etc/csf/csf.allow''
+To do so:
-  - Add entries like the others and save the file
-  - Run: ''csf -ra'' to restart/reload CSF
-==== Removing Banned IPs ====
+  - Go to WHM > cPHulk Brute Force Protection
+  - Click on Whitelist Management tab
+  - If logging in from an IP not on the list, there might be a popup with a button that can be pressed to add the current IP to the list.
+  - If not, add the IP to the box and put a comment with # character if needed.
+  - When done, click "Add"
-=== CSF ===
+To remove an IP from the whitelist, just click delete from the same interface.
-While the server only allows whitelisted IPs to connect, it might be possible that the server can ban someone that is on the list if they try to log in too many times.
+Do not forget to update the firewall by running the script: ''/etc/cron.daily/update_firewall.sh''
-  - Under WHM > ConfigServer Security & Firewall
+The script runs daily, but running it now will immediately update the firewall.
-  - Go to: csf - ConfigServer Firewall
-  - Where it says: Search for IP, type in their IP and click Search.
-  - If something comes back, click Return
-  - Go to: csf - Quick Actions
-  - Type in the IP to Quick Unblock and click the button
+**Do not forget to add the IP to each of the 2 accounts, master on chost and beacontechnology on kingscpw01.**
-=== cPHulk ===
+[[wiki:firewall#allowing_ips_to_locked_down_cpanel_accounts|Click here to learn more]]
-cPHulk can also block IPs for various reasons.
+==== Blacklist Management ====
-To find blacklisted IPs:
+Sometimes the user might be banned, or can't connect to a specific service for some unknown reason. It could be cPHulk blocking them.
-Go to: WHM > cPHulk Brute Force Protection
+To unblock:
-Click "Blacklist Management"
-You should see all IPs block by cPHulk on this page
-If you want to remove an IP from the list, just click Delete and Continue
-You can also whitelist in cPHulk as well by going to the "Whitelist Management page". If you are whitelisting yourself from your current machine, you can just click "Add to Whitelist" on the red box.
+  - Go to WHM > cPHulk Brute Force Protection
+  - Click on Blacklist Management tab
+  - Search for the IP in question, if the IP is unknown, ask the user to go to: ipecho.net and read the IP back.
+  - When the record is located, click "Delete"
+==== Troubleshooting ====
-===== Installation General Information =====
+It may  be the case that sometimes the script gives an error for various reasons, here are some steps to try to fix it:
-Two main things need to be set up
+  - Try rebooting server
+  - Try making a change in cpHulk like adding/removing an IP and trying again
-  - CSF needs to be configured to not allow any ports
+  - Try this command: ''nft flush set inet filter ccblockset'' and try again
-  - IPs need to be added to the ''csf.allow'' list
+  - try this command: WARNING, may result in getting locked out, add your IP to ''/etc/sysconfig/nftables.conf'' before proceeding... ''nft flush set inet filter adminwhitelist''
-==== Installation ====
-The administrative security policy requires that only specified Ips are allow to connect to the dev server. CSF is one of the most popular cPanel plugins to somewhat easily control the linux firewall.
-[[https://docs.cpanel.net/knowledge-base/security/additional-security-software/#configserver-software|Click Here]] for the documentation to set up CSF.
-Otherwise, run these commands:
-<code>
-cd /root
-wget https://download.configserver.com/csf.tgz
-tar -xzf csf.tgz
-cd csf
-./install.cpanel.sh
-# reboot server
-sed -ibak 's/^TESTING = "1"/TESTING = "0"/'
-sed -r -ibak 's/^TCP_IN = "[0-9,]+"/TCP_IN = ""/' /etc/csf/csf.conf
-sync; csf -ra
-</code>
 ===== Host Access Control =====
@@ Line 109: / Line 78: @@
   - When the WHM Host Access Control page is reloaded, the changes should now be reflected.
-===== cPHulk =====
+Also note that rules are dynamically loaded into nftables by ''update_firewall.sh''.
-''cPHulk'' is part of cPanel and will ban IPs that log too many login failures.
+===== update_firewall.sh =====
-==== Whitelist Management  ====
+This script help managing nftables
-In general it is a good idea to whitelist administrative IPs to avoid getting banned.
+<code bash update_firewall.sh>
+#!/bin/bash
-To do so:
+# this script extends cpHulk to assist managing nftables.
-  - Go to WHM > cPHulk Brute Force Protection
+# country codes selected in CPhulk will be banned at the IP level
-  - Click on Whitelist Management tab
+# whitelisted ips will be included as administratively allowed
-  - If logging in from an IP not on the list, there might be a popup with a button that can be pressed to add the current IP to the list.
-  - If not, add the IP to the box and put a comment with # character if needed.
-  - When done, click "Add"
-To remove an IP from the whitelist, just click delete from the same interface.
+set -e
+trap 'catch $? $LINENO' EXIT
-==== Blacklist Management ====
+catch() {
+  if [ "$1" != "0" ]; then
+    echo failed to update firewall rules
+    echo "Error $1 occurred on $2"
+  fi
+}
-Sometimes the user might be banned, or can't connect to a specific service for some unknown reason. It could be cPHulk blocking them.
+geoipdir='/usr/local/cpanel/3rdparty/share/geoipfree/country-cidrs'
-To unblock:
+whitelist=$(mktemp)
+blacklist=$(mktemp)
-  - Go to WHM > cPHulk Brute Force Protection
+# get list of CCs that are blocked
-  - Click on Blacklist Management tab
+cclist=$( whmapi1 --output=json load_cphulk_config |
-  - Search for the IP in question, if the IP is unknown, ask the user to go to: ipecho.net and read the IP back.
+          jq -r '.data.cphulk_config.country_blacklist' )
-  - When the record is located, click "Delete"
+# loop over list and concat all subnets from cpanel free geoip
+for i in ${cclist//,/ }; do
+  grep -oP '(\d+\.){3}\d+/\d+' $geoipdir/$i | tr '\n' ',' >> $blacklist
+done
+# write list of whitelist ips to temp file
+whmapi1 --output=json read_cphulk_records list_name='white' |
+        jq -r '.data.ips_in_list | keys[]' | grep -oP '(\d+\.){3}\d+' > $whitelist
+# generate new rules for nftables
+{
+  echo 'flush set inet filter ccblockset'
+  echo 'flush set inet filter adminwhitelist'
+  # create whitelist set
+  echo -n 'add element inet filter adminwhitelist { '
+  cat $whitelist | tr '\n' ','
+  echo ' }'
+  # create blacklist set
+  echo -n 'add element inet filter ccblockset { '
+  cat $blacklist | tr '\n' ','
+  echo ' }'
+} | nft -f -
+echo firewall was successfully updated
+</code>
+===== Allowing IPs to locked down cpanel accounts =====
+On some accounts, there is htaccess that whitelists IPs for extra security.
+The htaccess is normally at: ''/home/username/public_html/.htaccess''
+The area you are looking for looks something like this:
+<code>order allow,deny
+allow from xxx.xxx.xxx.xxx
+allow from xxx.xxx.xxx.xxx
+allow from xxx.xxx.xxx.xxx
+allow from xxx.xxx.xxx.xxx</code>
+Just add a similar new entry below the last one in the list