The Planet Forums > HOWTO: KISS My Firewall 2.0!

Full Version: HOWTO: KISS My Firewall 2.0!

The Planet Forums > Security > General Security

Pages: 1, 2, 3

Steve

Nov 20 2003, 12:37 AM

[/COLOR]

[COLOR=green]Brief Summary

KISS My Firewall is a FREE iptables script designed for a typical web server. It takes advantage of the latest firewall technologies including stateful packet inspection and connection tracking. It also contains some preventative measures for port scanning, DoS attacks, and IP spoofing, among other things.

KISS My Firewall 2 is very easy to install and does not require any initial configuration. It will work with any stock installation of Ensim WEBppliance Basic & Pro, Plesk, and Webmin. Cpanel installations require some modifications.

HOW TO: Install KISS My Firewall

When logged in as root ( "su -" ), type:

cd /usr/bin
wget http://www.geocities.com/steve93138/kiss-2.0.1.tar.gz
tar zxvf kiss-2.0.1.tar.gz

That's it! To get it running anywhere on the command line, you simply type:

kiss start

To stop the firewall, type:

kiss stop

To get status information, type:

kiss status

If you want to block an offenders IP address/subnet, simply edit the BLOCK_LIST variable in the /usr/bin/kiss file. You can separate IP addresses and subnet's with a space. Once you are finished, simply restart KISS by typing:

kiss restart

Last, but not least, it is recommended that you configure the firewall to allow only for needed ports. Using trusted IP addresses/subnets is also recommended. These variables are located near the beginning of the /usr/bin/kiss file and are self-explanatory. Once you make changes, you should always restart KISS for the changes to take effect:

kiss restart

What's New in Version 2?

The biggest change is that it does not require any initial configuration. With version 2, you won't automatically lock yourself out of your server unless you set some of the variables incorrectly. It also does extensive error checking and is distributed as a tar file. This solves a lot of the issues that were present with the older version. In addition, version 2 is highly configurable and was tested to work with the latest version of iptables - version 1.2.8.

Let me know if you have any questions or problems.

Happy Firewalling!

Joor

Nov 20 2003, 01:18 AM

Hello RDATE, here I come!!!!

Thanks Steve, installing in the morning, version 1.4 has done a splendid job but time for 2.0.

netrecruitments

Nov 20 2003, 02:17 AM

When trying to initialize the new version i am getting the following error:

[root@secure bin]# kiss start
/usr/bin/kiss: ifconfig: command not found
Could not determine MAIN_IP. Firewall script aborted!

Please advise me on how to correct this?

LighthousePoint

Nov 20 2003, 02:22 AM

You do have ifconfig, right?

netrecruitments

Nov 20 2003, 02:24 AM

Yep -i've got ifconfig

I have also got the firewall started. I located where ifconfig was written in and added /sbin/ - saved the file and started the firewall, everything seems to be working now.

LighthousePoint

Nov 20 2003, 02:27 AM

ah, perhaps you did:

su

instead of:

su -

Without the ' -' you don't have root's paths exported, so you have to reference things by full pathname.

TDI

Nov 20 2003, 05:42 AM

can someone tell me what modifications are needed for cpanel/blackorb to update properly.

And do I need to change anything for redhat network?

Steve

Nov 21 2003, 01:42 PM

QUOTE

Originally posted by TDI
can someone tell me what modifications are needed for cpanel/blackorb to update properly.

I don't use cPanel but I think all you need to do is add "2082:2083 2086:2087 2095:2096" to the TCP_IN variable in the /usr/bin/kiss file. It would look something like this:

TCP_IN="20 21 25 53 80 110 143 443 995 2082:2083 2086:2087 2095:2096 3306"

This would open the needed inbound ports for cPanel (See: http://forums.cpanel.net/showthread.php?s=...&threadid=13834).

I think you also need to add "873" (RSYNC) and "2089" (cPanel License) on the output chain:

TCP_OUT="21 22 25 37 43 53 80 443 873 2089"

Let me know if this works for you.

blueice

Nov 22 2003, 04:38 AM

Hi,
is there any more configuration to autorun this script at boot time?

TDI

Nov 22 2003, 02:04 PM

cPanel users:

http://forums.cpanel.net/showthread.php?s=...light=firewalls

I found that - should make getting KISS up and running a bit quicker.

TDI

Nov 23 2003, 05:19 PM

Ok - I'm having issues with this.

First - here's what I've done to the file. Added ports. Added server IP's, and added a trusted IP. (nothing in block list)

Now, I thought everything was running just fine. Until someone says to me they can't see my site for about a week. (they're in Peru)

long story short - I shut off KISS and he can see the site immedietly after. I start it back up and he can STILL see my site.

But then I get curious - so I ask a friend in Australia to check the site. She can not see it. Again - I shut off KISS and RIGHT AFTER she can hit my site again, no problems....

What do I do?

Steve

Nov 23 2003, 10:34 PM

TDI,

To be honest, I think the problems you are having are due to the way in which your OS is set up. I run KISS on *many* servers from RedHat 7.3 to RedHat 9, iptables 1.2.5 to 1.2.8 and don't have any issues with it. I have customers from all around the world.

If you have upgraded iptables (which I never recommend) then it may not work 100% with your kernel. If you didn't do that, it may have somthing to do with certain modules not being installed correctly.

What version of RedHat and iptables are you running?

Also, what do you mean that "they can not connect"? For example, can they connect to port 80 (HTTP) but not connect to their control panel, etc...

Also, it would be helpful if I could see your list of variables.

Thanks,
Steve

TDI

Nov 23 2003, 10:48 PM

Right right - I never meant for it to sound like a problem with your script.

I'm running linux 7.3 - iptables 1.2.8

What I mean by can not connect is that the user can not see my website - these aren't clients, just users trying to view my site via web browser.

variables (only things I've changed in the KISS file):
# Optional KISS Configurtion Variables:
#
BLOCK_LIST=""
TCP_IN="20 21 25 26 37 53 80 110 143 443 873 995 2082 2083 2086 2087 2095
2096 3306 6666 8080 8443 8998 9999 10000"
TCP_OUT="21 25 26 37 43 53 80 443 873 2082 2083 2086 2087 2095 2096 6666 8080 8443 8999 9999 55000"
UDP_IN="53"
UDP_OUT="53"
TCP_IN_TRUSTED="8999"
TRUSTED_IPS="0.0.0.0/0 216.118.116.106"
SERVER_IPS="207.44.194.6 207.44.194.129 207.44.194.130 207.44.194.131"

The trusted IP is for cpanel updates. Wasn't sure if I needed it there so I added it to be safe. Otherwise I just added ports that I require open. I've adjusted ssh to use port 8999 so that's why I changed that in
TCP_IN_TRUSTED="8999"

Any help is greatly appreciated.
Thanks!
TDI

Steve

Nov 25 2003, 12:37 PM

TDI,

Have you tried adding 113 to TCP_OUT? That might help...

Also want to mention that since you said you are running SSH on port 8999 and since you put your trusted IP in the TRUSTED_IPS variable, you should probably remove the 0.0.0.0/0 from TRUSTED_IPS.

Putting "0.0.0.0/0" into TRUSTED_IPS means that any (all) IP addresses are trusted so no matter what other IP's you put in there, it will have no effect. It was set to "any" by default but should either be replaced by a trusted IP or left as-is.

Hope that helps.

Steve

Nov 25 2003, 12:46 PM

QUOTE

Originally posted by blueice
Hi,
is there any more configuration to autorun this script at boot time?

Yes, additional work is needed to start the firewall automatically on reboot. Here's how you can do that:

Edit the file /etc/rc.d/rc.local and add the following line to the end of the file:

/usr/bin/kiss start

That should do it.

revolution

Nov 26 2003, 12:44 AM

not a linux expert, so maybe this isn't a concern:

will adding it to /etc/rc.d/rc.local work if one hasn't modified the script where ifconfig is referenced as root's paths are needed by KISS? are root's paths used when everything in /etc/rc.d/rc.local is run on boot? I don't feel like rebooting to find out =).

... well, i added the /sbin/ in anyways on line 62 i think it was, but i figured if this was an issue some other people might like to know.

thanks.

Dave#

Nov 27 2003, 07:39 AM

Nice update - like it.

I'd like to seee a UDP_IN_TRUSTED as well as an TCP_TRUSTED

Great work though

Cornelius

Nov 29 2003, 07:03 PM

dunno if this is documented anywhere, but i thought i'd post what i found cause it sure cause some grief...

my box has main ip and 1 additional ip... putting the main ip first would cause the main to be recognised, but the additional ip would not show up

on a whim, i swapped the order (extra ip first, main ip second) and everything works..

hope this helps someone out...

mo7al

Dec 9 2003, 05:14 AM

i download it, and its working fine accept cpanel things,

i saw this page:

http://forums.cpanel.net/showthread.php?s=...ight=firewalls&

and i understand that i need to open all of these ports,

who can i open it?? from where do i have to configre???

TDI

Dec 9 2003, 05:19 AM

ssh to your server as your admin account -
then su - to get to root.

cd to the directory where KISS is located.

use: pico -w kiss
to open the editor, place the needed ports in the the TCP_IN and TCP_OUT fields as I have done a few posts up.

cyc

Dec 9 2003, 10:08 PM

does anyone know how to fix this error?

# kiss start
lsmod: QM_MODULES: Function not implemented

Since the ip_tables, ipt_state, and/or ipt_multiport modules do not exist, KISS can not function. Firewall script aborted!

thanks

revolution

Dec 9 2003, 11:07 PM

Yo!

this is gonna help some people in another forum, that's for sure. i'll post it there next.

KISS 2.0 has the following commented out at the bottom of the script by default:

CODE

##############################################################################

# Uncomment to allow DNS zone transfers

#

#$IPTABLES -A INPUT -i eth0 -p udp --sport 53 --dport 53 -m state --state NEW -j ACCEPT

#$IPTABLES -A INPUT -i eth0 -p tcp --sport 53 --dport 53 -m state --state NEW -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p udp --sport 53 --dport 53 -m state --state NEW -j ACCEPT

#$IPTABLES -A OUTPUT -o eth0 -p tcp --sport 53 --dport 53 -m state --state NEW -j ACCEPT

leaving that commented out will make it so EARTHLINK / MINDSPRING DNS SERVERS WILL NOT BE ABLE TO SEE YOU. why? i haven't the slightest idea, i'm a php geek and dumpster diver, not a sysadmin.

anyways, i'd suggest making a note of that as i saw it affecting domains on the servers of the company i work for in addition to those on my own. multiple Earthlink/Mindspring dns servers were tried and all experienced this problem, along with everyone i knew who had earthlink. now it seems the problem is solved.

p.s. i spent 2 hours on the phone complaining to earthlink this week insisting they were messed up. ah, well.

mo7al

Dec 10 2003, 12:58 AM

can i know what are the common ports to disable???

and i want to disable the ping, so no one can ping me?

who can i do it plz?

Steve

Dec 11 2003, 11:44 AM

QUOTE

Originally posted by revolution
Yo!

this is gonna help some people in another forum, that's for sure. i'll post it there next.

KISS 2.0 has the following commented out at the bottom of the script by default:

code:
[B]#############################################################################
#
# Uncomment to allow DNS zone transfers
#
#$IPTABLES -A INPUT -i eth0 -p udp --sport 53 --dport 53 -m state --state NEW -j ACCEPT
#$IPTABLES -A INPUT -i eth0 -p tcp --sport 53 --dport 53 -m state --state NEW -j ACCEPT
#$IPTABLES -A OUTPUT -o eth0 -p udp --sport 53 --dport 53 -m state --state NEW -j ACCEPT
#$IPTABLES -A OUTPUT -o eth0 -p tcp --sport 53 --dport 53 -m state --state NEW -j ACCEPT

leaving that commented out will make it so EARTHLINK / MINDSPRING DNS SERVERS WILL NOT BE ABLE TO SEE YOU. why? i haven't the slightest idea, i'm a php geek and dumpster diver, not a sysadmin.

anyways, i'd suggest making a note of that as i saw it affecting domains on the servers of the company i work for in addition to those on my own. multiple Earthlink/Mindspring dns servers were tried and all experienced this problem, along with everyone i knew who had earthlink. now it seems the problem is solved.

p.s. i spent 2 hours on the phone complaining to earthlink this week insisting they were messed up. ah, well. [/B]

Actually, the comment is wrong in the file. It is not for "Zone Transfers" but is actually for nameserver to nameserver transfers on older systems running something like Bind 4.x. Unless you setup your DNS servers to allow source port 53 connections, uncommenting these lines should have no real affect on anything...

I doubt that Earthlink/Mindspring DNS servers use a source port of 53 for getting DNS data from your servers. That would make their DNS servers practically useless. The destination port would of course be 53, but the source port is a high port 1024-65535 and that's already taken care of in the KISS script. I would recommened that you don't uncomment these lines...

revolution

Dec 11 2003, 12:22 PM

I'm guessing steve is right because i did what i did because it solved the problem, not because i knew what i was doing. regardless...

=> if you are using KISS 2.0, find yourself an earthlink user to look at a new site that just changed to your nameservers. --- or just drop in some of their dns servers for your internet connection and see for yourself. (try 207.69.188.187 and 207.69.188.186)

so, yeah, if you aren't having problems don't do anything, but if you are, remember this warning. as i said, no other isp's dns servers anywhere had a problem, but earthlink/mindspring did and this solved it for multiple newly transferred domains on multiple servers--- one with plesk6/redhat9/bind-9.2.1-16, the other with ensim3.5/redhat7.3/bind-9.2.1-1.7x.2 , neither of which has had any customization done to the dns servers (it's all default config).

steve: thanks for the info on what this is because, as i said, i didn't really know.

Gliebster

Dec 15 2003, 07:39 PM

Thanks for the great script!

I see the trusted tcp ports and IP's feature. I am wondering if there is a way to allow access to all tcp/udp ports, in and out, from a specific privileged IP or list of IP's?

PWR

Dec 18 2003, 06:46 AM

To prevent users to send UCE from server you can add 1 line at the begining of OUTPUT rules:
$IPTABLES -A OUTPUT -o eth0 -p tcp --dport 25 -j REJECT -m owner ! --uid-owner 0

(for ensim only)

damatrix

Dec 19 2003, 08:41 AM

Here is my problem.. I am installing Kiss onto rhe 3 with cpanel

I believe that i have followed the instructions, and opened the needed ports up,

But as soon as i start it up.. I am unable to login to whm (i havent tested anything else)

Any ideas?

Gliebster

Dec 19 2003, 12:33 PM

Open these ports for cPanel/WHM:
873 2080 2081 2082 2083 2086 2087 2089 2095 2096

There might be more. Read this:
http://forums.cpanel.net/showthread.php?s=...&threadid=13834

TDI

Dec 19 2003, 02:30 PM

2080 & 2081 ?

Danieliang

Dec 23 2003, 02:43 AM

How to upgrade from version 1 to version 2?

TDI

Dec 23 2003, 02:56 AM

Upload v2

configure v2

stop v1

delete v1

start v2

I think that's it...

Danieliang

Dec 23 2003, 03:12 AM

However, the http://www.geocities.com/steve93138/ site only has version 2's information now. I don't even remember where I installed version 1 and don't remember how to stop it.

TDI

Dec 23 2003, 03:26 AM

oh good point..I had that same trouble when I upgraded...

try:

locate kiss

via SSH to find where you have it.

And if you had followed all directions along with v1 there should be a file called "flush"

that would clear your iptables. Although I could be wrong. So you may want to ignore that part....Wouldn't want to lock you out of your box....

MOVING ON!

ok - if you can use "locate kiss" to find it - check out the readme or similar file. I know the stopping instruction are located along with v1.

Hope this helps.

Cornelius

Dec 23 2003, 01:07 PM

i believe according to his original instructions,

the script was here: /etc/rc.d/rc.firewall

the file to start it up at bootup: /etc/rc.d/rc.local

HTH

Danieliang

Dec 23 2003, 09:59 PM

Yes, the file is at /etc/rc.d/rc.firewall, but I don't remember how to stop the version 1.4. And after I stop it, I just simply delete rc.firewall?

GXX

Dec 24 2003, 12:34 AM

here's how you stop V1:

create a file, call it whatever you want.

put this in it:

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -F

close, save. chmod to 755.

then execute it.

V1 cleared. delete rc.firewall, install V2, and you're done.

gaelos

Dec 24 2003, 06:53 AM

is fxp working with this new version of kiss ? It was not with the old one.

thanks

dvdepot

Dec 30 2003, 06:22 PM

QUOTE

Originally posted by revolution
I'm guessing steve is right because i did what i did because it solved the problem, not because i knew what i was doing. regardless...

=> if you are using KISS 2.0, find yourself an earthlink user to look at a new site that just changed to your nameservers. --- or just drop in some of their dns servers for your internet connection and see for yourself. (try 207.69.188.187 and 207.69.188.186)

steve: thanks for the info on what this is because, as i said, i didn't really know.

your right on this - for whatever reason .. did an nslookup with mindspring isp with this #'d and it died out .. removed it and it worked... for whatever reason.

Great Ver 2 - steve .. you may want to make a note somewhere in the script how to setup multiple values .. like server ips's, banned ip's .. to serperate by "spaces" and not commas or something else.. it had me wondering.. unless I missed something

xee

Jan 6 2004, 09:54 AM

I've installed this using the HOW-TO.
But when I started kiss all ports lock down.

What is me doing wrong?

CODE

[root@blue /]# kiss start

Chain INPUT (policy DROP)

target prot opt source destination

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID

Chain INPUT (policy DROP)

target prot opt source destination

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID

etc...

etc...

ehost

Jan 9 2004, 01:17 PM

I've set up firewall and it works fine

but when I use ws_ftp to connect my web site, it takes a while to do so .. about 5~10 seconds longer than before.

I just wonder if any of you also has this problem?

update : I just turned off kiss firewall to do the test and I am sure now it's caused by kiss firewall. Is it possible to improve this situation?

WreckRman2

Jan 10 2004, 09:57 AM

I've installed KISS 2.0 and listed all my server IP's with a space in between each one.

Problem is when I have the firewall running I can do a tracert to the first IP listed but I can't do a tracert to the other IP's listed. This has caused DNS problems with mail bouncing etc. If I stop KISS the problems go away.

Any suggestions?

ehost

Jan 12 2004, 02:09 AM

I suddenly can't view my web site
it's blocked by the firewall....

once I turned off kiss then turned it back on again, it's ok.

so weird

Habby

Jan 12 2004, 05:06 AM

I installed it and everything works fine, except one thing. The firewall keeps on disabling every so often. I keep on having to start it up. It usually diables within 12 hours or so...

Ronny

Jan 18 2004, 02:21 PM

Does this work with rh 9?

Ronny

Jan 18 2004, 02:21 PM

Does this work with rh 9?

siteThing

Jan 18 2004, 03:23 PM

yes. works with RH9.

GraphicsGuy

Jan 18 2004, 10:16 PM

How about RHEL?

WreckRman2

Jan 18 2004, 10:20 PM

QUOTE

Originally posted by WreckRman2
I've installed KISS 2.0 and listed all my server IP's with a space in between each one.

Problem is when I have the firewall running I can do a tracert to the first IP listed but I can't do a tracert to the other IP's listed. This has caused DNS problems with mail bouncing etc. If I stop KISS the problems go away.

Any suggestions?

Anybody?

Ronny

Jan 19 2004, 03:23 PM

This is what happens on a rh 9 server:

root@server [/usr/bin]# kiss start
Since the ip_tables, ipt_state, and/or ipt_multiport modules do not exist, KISS can not function. Firewall script aborted!

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.