![Bastion IPTABLES
DENY!!!!!
/etc/sysconfig/iptables
...
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [237:32957]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
COMMIT](https://image.slidesharecdn.com/buildingamoat-bastionserver-130117145344-phpapp01/85/Building-a-moat-bastion-server-10-320.jpg)
![Protected Server
Iptables
...
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
...
-A INPUT -s <moat’s IP address> -p tcp -m tcp --dport 22 -j ACCEPT
# HTTP and HTTPS
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
COMMIT](https://image.slidesharecdn.com/buildingamoat-bastionserver-130117145344-phpapp01/85/Building-a-moat-bastion-server-13-320.jpg)
Building a moat bastion server
- 3. What does it do? Provides a secure, single point of entry to your application servers
- 4. Why do you care?
- 5. What’s it look like? Service Requests SSH
- 6. Bastion System Setup wget ruby* MySQL* curl postgresql* xorg* nginx net-snmp-libs jasper-libs Uninstall telnet everything! php* automake *X11 monit gcc DNS Name Server Mail Server ftp neon *devel* finger fetchmail net-snmp-libs
- 7. Bastion System Setup install netcat
- 8. Bastion System Setup update everything that remains! sudo yum upgrade
- 9. Bastion SSH Config Change Port from 22 Port 2222 Disable password logins/auth PasswordAuthentication no Disable PAM UsePAM no
- 10. Bastion IPTABLES DENY!!!!! /etc/sysconfig/iptables ... *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [237:32957] -A INPUT -i lo -j ACCEPT -A INPUT -m state --state ESTABLISHED -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A INPUT -p icmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT COMMIT
- 11. Bastion User Create a secure user group sudo /usr/sbin/groupadd moat Create a “keymaster” Generate and upload an SSH key
- 12. Other Users Generate ssh-keys, use passphrases! sudo /usr/sbin/useradd -G moat -m new_user sudo mkdir -p /home/new_user/.ssh sudo mv ~/.new_user_ssh.pub /home/new_user/.ssh/authorized_keys sudo chmod -R 700 /home/new_user/.ssh sudo chown -R new_user:new_user /home/new_user/.ssh echo Any_r@nd0m_p@55w04D | sudo passwd new_user --stdin
- 13. Protected Server Iptables ... *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] ... -A INPUT -s <moat’s IP address> -p tcp -m tcp --dport 22 -j ACCEPT # HTTP and HTTPS -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT COMMIT
- 14. SSH Proxy through moat to access remote machines Host app001 Hostname app-001.blackboxservers.com User app_user ProxyCommand ssh -q -p 2222 $MOAT_USER@moat-001.blackboxservers.com nc %h 22 To SSH, just export your name and go! $> export MOAT_USER=george $> ssh app001 george@app-001.blackboxservers.com's password: