Guide

User Tools

Site Tools

Trace:
wiki:firewall

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
wiki:firewall [2023/07/24 22:20] – guidebeaconwiki:firewall [2023/10/05 19:29] (current) – guidebeacon
Line 2: Line 2:
  
 The cPanel servers make use of various firewalling features The cPanel servers make use of various firewalling features
- 
-''dev.beacontechnology.com'' uses ''CSF'' to manage the Linux firewall (iptables). 
  
 ''chost.beacontechnology'' uses ''Host Access Control'' to manage the Linux firewall (nftables). ''chost.beacontechnology'' uses ''Host Access Control'' to manage the Linux firewall (nftables).
Line 31: Line 29:
 To remove an IP from the whitelist, just click delete from the same interface. To remove an IP from the whitelist, just click delete from the same interface.
  
-Additionally, IPs added to the whitelist may be included as administratively allowed IPs in nftables by the ''/etc/cron.daily/update_firewall.sh'' script.+Do not forget to update the firewall by running the script: ''/etc/cron.daily/update_firewall.sh'' 
 + 
 +The script runs daily, but running it now will immediately update the firewall. 
 + 
 +**Do not forget to add the IP to each of the 2 accounts, master on chost and beacontechnology on kingscpw01.** 
 + 
 +[[wiki:firewall#allowing_ips_to_locked_down_cpanel_accounts|Click here to learn more]]
  
 ==== Blacklist Management ==== ==== Blacklist Management ====
Line 43: Line 47:
   - Search for the IP in question, if the IP is unknown, ask the user to go to: ipecho.net and read the IP back.   - Search for the IP in question, if the IP is unknown, ask the user to go to: ipecho.net and read the IP back.
   - When the record is located, click "Delete"   - When the record is located, click "Delete"
 +
 +==== Troubleshooting ====
 +
 +It may  be the case that sometimes the script gives an error for various reasons, here are some steps to try to fix it:
 +
 +  - Try rebooting server
 +  - Try making a change in cpHulk like adding/removing an IP and trying again
 +  - Try this command: ''nft flush set inet filter ccblockset'' and try again
 +  - try this command: WARNING, may result in getting locked out, add your IP to ''/etc/sysconfig/nftables.conf'' before proceeding... ''nft flush set inet filter adminwhitelist''
  
 ===== Host Access Control ===== ===== Host Access Control =====
Line 67: Line 80:
 Also note that rules are dynamically loaded into nftables by ''update_firewall.sh''. Also note that rules are dynamically loaded into nftables by ''update_firewall.sh''.
  
-===== CSF =====+===== update_firewall.sh =====
  
-**chost does not use CSF**+This script help managing nftables
  
-**chost does not use CSF**+<code bash update_firewall.sh> 
 +#!/bin/bash
  
-**chost does not use CSF**+# this script extends cpHulk to assist managing nftables.
  
-CSF is a third party addon for cPanel.+# country codes selected in CPhulk will be banned at the IP level 
 +# whitelisted ips will be included as administratively allowed
  
-==== Whitelisting IPs ====+set -e 
 +trap 'catch $? $LINENO' EXIT
  
-IPs can be whitelisted two different ways, either via the web interface or SSH+catch() { 
 +  if [ "$1" != "0" ]; then 
 +    echo failed to update firewall rules 
 +    echo "Error $1 occurred on $2" 
 +  fi 
 +}
  
-If using the web interface:+geoipdir='/usr/local/cpanel/3rdparty/share/geoipfree/country-cidrs'
  
-  - Go to WHM > ConfigServer Security & Firewall +whitelist=$(mktemp) 
-  - Click "csf" tab near the top, under the banners +blacklist=$(mktemp)
-  - Under "csf - ConfigServer Firewall" click "Firewall Allow IPs" +
-  - Add IP and comment to list how the rest are +
-  - Click Change +
-  - Click Restart csf+lfd+
  
-If using shell/ssh+# get list of CCs that are blocked 
 +cclist=$( whmapi1 --output=json load_cphulk_config | 
 +          jq -r '.data.cphulk_config.country_blacklist' )
  
-  - Edit ''/etc/csf/csf.allow'' +# loop over list and concat all subnets from cpanel free geoip 
-  - Add entries like the others and save the file +for i in ${cclist//,/ }; do 
-  - Run: ''csf -ra'' to restart/reload CSF+  grep -oP '(\d+\.){3}\d+/\d+' $geoipdir/$i | tr '\n' ',' >> $blacklist 
 +done
  
-==== Removing Banned IPs ====+# write list of whitelist ips to temp file 
 +whmapi1 --output=json read_cphulk_records list_name='white' | 
 +        jq -r '.data.ips_in_list | keys[]' | grep -oP '(\d+\.){3}\d+' > $whitelist
  
-=== CSF ===+# generate new rules for nftables 
 +{ 
 +  echo 'flush set inet filter ccblockset' 
 +  echo 'flush set inet filter adminwhitelist'
  
-While the server only allows whitelisted IPs to connect, it might be possible that the server can ban someone that is on the list if they try to log in too many times.+  # create whitelist set 
 +  echo -n 'add element inet filter adminwhitelist { ' 
 +  cat $whitelist | tr '\n' ',' 
 +  echo ' }'
  
-  - Under WHM > ConfigServer Security & Firewall +  # create blacklist set 
-  - Go to: csf - ConfigServer Firewall +  echo -n 'add element inet filter ccblockset { ' 
-  - Where it says: Search for IP, type in their IP and click Search. +  cat $blacklist | tr '\n' ',' 
-  - If something comes back, click Return +  echo ' }' 
-  - Go to: csf - Quick Actions +} | nft -f -
-  - Type in the IP to Quick Unblock and click the button+
  
-=== cPHulk ===+echo firewall was successfully updated 
 +</code>
  
-cPHulk can also block IPs for various reasons.+===== Allowing IPs to locked down cpanel accounts =====
  
-To find blacklisted IPs:+On some accounts, there is htaccess that whitelists IPs for extra security.
  
-Go to: WHM > cPHulk Brute Force Protection +The htaccess is normally at: ''/home/username/public_html/.htaccess''
-Click "Blacklist Management" +
-You should see all IPs block by cPHulk on this page +
-If you want to remove an IP from the list, just click Delete and Continue+
  
-You can also whitelist in cPHulk as well by going to the "Whitelist Management page". If you are whitelisting yourself from your current machine, you can just click "Add to Whitelist" on the red box.+The area you are looking for looks something like this:
  
-===== Installation General Information =====+<code>order allow,deny 
 +allow from xxx.xxx.xxx.xxx 
 +allow from xxx.xxx.xxx.xxx 
 +allow from xxx.xxx.xxx.xxx 
 +allow from xxx.xxx.xxx.xxx</code>
  
-Two main things need to be set up +Just add a similar new entry below the last one in the list
- +
-  - CSF needs to be configured to not allow any ports +
-  - IPs need to be added to the ''csf.allow'' list +
- +
-==== Installation ==== +
- +
-The administrative security policy requires that only specified Ips are allow to connect to the dev server. CSF is one of the most popular cPanel plugins to somewhat easily control the linux firewall. +
- +
-[[https://docs.cpanel.net/knowledge-base/security/additional-security-software/#configserver-software|Click Here]] for the documentation to set up CSF. +
- +
-Otherwise, run these commands: +
- +
-<code> +
-cd /root +
-wget https://download.configserver.com/csf.tgz +
-tar -xzf csf.tgz +
-cd csf +
-./install.cpanel.sh +
- +
-# reboot server +
- +
-sed -ibak 's/^TESTING = "1"/TESTING = "0"/' +
-sed -r -ibak 's/^TCP_IN = "[0-9,]+"/TCP_IN = ""/' /etc/csf/csf.conf +
- +
-sync; csf -ra +
-</code>+
wiki/firewall.1690237248.txt.gz · Last modified: 2023/07/24 22:20 by guidebeacon
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki