Login to your server through SSH and su to the root user.<\/p>\n
1. cd \/root\/downloads or another temporary folder where you store your files.
\n2. wget http:\/\/www.rfxnetworks.com\/downloads\/apf-current.tar.gz
\n3. tar -xvzf apf-current.tar.gz
\n4. cd apf-0.9.5-1\/ or whatever the latest version is.
\n5. Run the install file: .\/install.sh<\/p>\n
You will receive a message saying it has been installed<\/p>\n
Installing APF 0.9.5-1: Completed.<\/p>\n
Installation Details:
\n Install path: \/etc\/apf\/
\n Config path: \/etc\/apf\/conf.apf
\n Executable path: \/usr\/local\/sbin\/apf
\n AntiDos install path: \/etc\/apf\/ad\/
\n AntiDos config path: \/etc\/apf\/ad\/conf.antidos
\n DShield Client Parser: \/etc\/apf\/extras\/dshield\/<\/p>\n
Other Details:
\n Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,2082,2083,2086,2087,2095,2096,3306
\n Listening UDP ports: 53,55880
\n Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.<\/p>\n
6. Lets configure the firewall: pico \/etc\/apf\/conf.apf
\nWe will go over the general configuration to get your firewall running. This isn’t a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.<\/p>\n
We like to use DShield.org’s “block” list of top networks that have exhibited
\nsuspicious activity.
\nFIND: USE_DS=”0″
\nCHANGE TO: USE_DS=”1″<\/p>\n
7. Configuring Firewall Ports:<\/p>\n
Cpanel Servers
\nWe like to use the following on our Cpanel Servers<\/p>\n
Common ingress (inbound) ports
\n# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
\nIG_TCP_CPORTS=”21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500″
\n#
\n# Common ingress (inbound) UDP ports
\nIG_UDP_CPORTS=”53″<\/p>\n
Common egress (outbound) ports
\n# Egress filtering [0 = Disabled \/ 1 = Enabled]
\nEGF=”1″<\/p>\n
# Common egress (outbound) TCP ports
\nEG_TCP_CPORTS=”21,25,80,443,43,2089″
\n#
\n# Common egress (outbound) UDP ports
\nEG_UDP_CPORTS=”20,21,53″<\/p>\n
Ensim Servers
\nWe have found the following can be used on Ensim Servers – although we have not tried these ourselves as I don’t run Ensim boxes.<\/p>\n
Common ingress (inbound) ports
\n# Common ingress (inbound) TCP ports
\nIG_TCP_CPORTS=”21,22,25,53,80,110,143,443,19638″
\n#
\n# Common ingress (inbound) UDP ports
\nIG_UDP_CPORTS=”53″<\/p>\n
Common egress (outbound) ports
\n# Egress filtering [0 = Disabled \/ 1 = Enabled]
\nEGF=”1″<\/p>\n
# Common egress (outbound) TCP ports
\nEG_TCP_CPORTS=”21,25,80,443,43″
\n#
\n# Common egress (outbound) UDP ports
\nEG_UDP_CPORTS=”20,21,53″<\/p>\n
Save the changes: Ctrl+X then Y<\/p>\n
8. Starting the firewall
\n\/usr\/local\/sbin\/apf -s<\/p>\n
Other commands:
\nusage .\/apf [OPTION]
\n-s|–start ……………………. load firewall policies
\n-r|–restart ………………….. flush & load firewall
\n-f|–flush|–stop ……………… flush firewall
\n-l|–list …………………….. list chain rules
\n-st|–status ………………….. firewall status
\n-a HOST CMT|–allow HOST COMMENT … add host (IP\/FQDN) to allow_hosts.rules and
\n immediately load new rule into firewall
\n-d HOST CMT|–deny HOST COMMENT …. add host (IP\/FQDN) to deny_hosts.rules and
\n immediately load new rule into firewall<\/p>\n
9. After everything is fine, change the DEV option
\nStop the firewall from automatically clearing itself every 5 minutes from cron.
\nWe recommend changing this back to “0” after you’ve had a chance to ensure everything is working well and tested the server out.<\/p>\n
vim \/etc\/apf\/conf.apf<\/p>\n
FIND: DEVM=”1″
\nCHANGE TO: DEVM=”0″<\/p>\n
10. Configure AntiDOS for APF
\nRelatively new to APF is the new AntiDOS feature which can be found in: \/etc\/apf\/ad
\nThe log file will be located at \/var\/log\/apfados_log so you might want to make note of it and watch it!<\/p>\n
pico \/etc\/apf\/ad\/conf.antidos<\/p>\n
There are various things you might want to fiddle with but I’ll get the ones that will alert you by email.<\/p>\n
# [E-Mail Alerts]
\nUnder this heading we have the following:<\/p>\n
# Organization name to display on outgoing alert emails
\nCONAME=”Your Company”
\nEnter your company information name or server name..<\/p>\n
# Send out user defined attack alerts [0=off,1=on]
\nUSR_ALERT=”0″
\nChange this to 1 to get email alerts<\/p>\n
# User for alerts to be mailed to
\nUSR=”your@email.com”
\nEnter your email address to receive the alerts<\/p>\n
Save your changes! Ctrl+X then press Y
\nRestart the firewall: \/usr\/local\/sbin\/apf -r<\/p>\n
11. Checking the APF Log<\/p>\n
Will show any changes to allow and deny hosts among other things.
\ntail -f \/var\/log\/apf_log<\/p>\n
Example output:
\nAug 23 01:25:55 ocean apf(31448): (insert) deny all to\/from 185.14.157.123
\nAug 23 01:39:43 ocean apf(32172): (insert) allow all to\/from 185.14.157.123<\/p>\n
12. New – Make APF Start automatically at boot time
\nTo autostart apf on reboot, run this:<\/p>\n
chkconfig –level 2345 apf on<\/p>\n
To remove it from autostart, run this:<\/p>\n
chkconfig –del apf<\/p>\n
13. Denying IPs with APF Firewall (Blocking)
\nNow that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I’ll show you 2 of the easier methods.<\/p>\n
A) \/etc\/apf\/apf -d IPHERE COMMENTHERENOSPACES
\n> The -d flag means DENY the IP address
\n> IPHERE is the IP address you wish to block
\n> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
\nThese rules are loaded right away into the firewall, so they’re instantly active.
\nExample:<\/p>\n
.\/apf -d 185.14.157.123 TESTING<\/p>\n
To block complete range<\/p>\n
apf -d 192.0.0.0\/8 from 192.0.0.0 to 192.255.255.255
\napf -d 192.168.0.0\/16 from 192.168.0.0 to 192.168.255.255
\napf -d 192.168.0.0\/24 from 192.168.0.0 to 192.168.0.255<\/p>\n
apf -d 192.168.0.1 single ip
\n—————————<\/p>\n
pico \/etc\/apf\/deny_hosts.rules<\/p>\n
Shows the following:<\/p>\n
# added 185.14.157.123 on 08\/23\/05 01:25:55
\n# TESTING
\n185.14.157.123<\/p>\n
B) pico \/etc\/apf\/deny_hosts.rules<\/p>\n
You can then just add a new line and enter the IP you wish to block. Before this becomes active though you’ll need to reload the APF ruleset.<\/p>\n
\/etc\/apf\/apf -r<\/p>\n
14. Allowing IPs with APF Firewall (Unblocking)<\/p>\n
I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
\nA)
\npico \/etc\/apf\/deny_hosts.rules<\/p>\n
Find where the IP is listed and remove the line that has the IP.
\nAfter this is done save the file and reload apf to make the new changes active.<\/p>\n
\/etc\/apf\/apf -r<\/p>\n
B) If the IP isn’t already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules<\/p>\n
\/etc\/apf\/apf -a IPHERE COMMENTHERENOSPACES
\n> The -a flag means ALLOW the IP address
\n> IPHERE is the IP address you wish to allow
\n> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they’re instantly active.
\nExample:<\/p>\n
.\/apf -a 185.14.157.123 UNBLOCKING
\nTo unblock IP or remove from firewall<\/p>\n
apf -u 192.168.0.1<\/p>\n
vim \/etc\/apf\/allow_hosts.rules<\/p>\n
# added 185.14.157.123 on 08\/23\/05 01:39:43
\n# UNBLOCKING
\n185.14.157.123<\/p>\n
for ip in $(cat \/etc\/apf\/deny_hosts.rules | awk ‘!\/#\/’| awk ‘\/[a-zA-Z]\/’); do apf -u $ip;done
\nThis will take out all the addresses in the deny_hosts file which are not real IPs.<\/p>\n
-s start
\n-r restart
\n-f flush – stop
\n-l list
\n-st status
\n-a HOST allow HOST
\n-d HOST deny HOST<\/p>\n","protected":false},"excerpt":{"rendered":"
Login to your server through SSH and su to the root user. 1. cd \/root\/downloads or another temporary folder where you store your files. 2. wget http:\/\/www.rfxnetworks.com\/downloads\/apf-current.tar.gz 3. tar -xvzf apf-current.tar.gz 4. cd apf-0.9.5-1\/ or whatever the latest version is. 5. Run the install file: .\/install.sh You will receive a message saying it has been… <\/p>\n