Iptables en Ubuntu

Nos basamos de los scripts de iRedMail para esta configuración.

vim /etc/init.d/iptables

#!/usr/bin/env bash

#---------------------------------------------------------------------

# This file is part of iRedMail, which is an open source mail server

# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.

#

# iRedMail is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# iRedMail is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.

#---------------------------------------------------------------------

#

### BEGIN INIT INFO

# Provides:          iptables

# Required-Start:    $network $syslog

# Required-Stop:     $network $syslog

# Default-Start:     2 3 4 5

# Default-Stop:      0 1 6

# Short-Description: Control iptables firewall.

### END INIT INFO

#

# This init.d script is used to control iptables, based on

# /etc/init.d/iptables on Red Hat Enterprise Linux 5.3, modified

# by Zhang Huangbin (michaelbibby@gmail.com), iRedMail project

# (http://www.iredmail.org/).

#

#

# config: /etc/default/iptables

# config: /etc/default/iptables-config

# Source function library.

. /lib/lsb/init-functions

IPTABLES='iptables'

IPTABLES_DATA="/etc/default/$IPTABLES"

IPTABLES_CONFIG="/etc/default/${IPTABLES}-config"

IPV="${IPTABLES%tables}" # ip for ipv4 | ip6 for ipv6

PROC_IPTABLES_NAMES="/proc/net/${IPV}_tables_names"

VAR_SUBSYS_IPTABLES="/var/lock/subsys/$IPTABLES"

[ -d $(dirname ${VAR_SUBSYS_IPTABLES}) ] || mkdir -p $(dirname ${VAR_SUBSYS_IPTABLES})

if [ ! -x /sbin/$IPTABLES ]; then

    log_daemon_msg "/sbin/$IPTABLES does not exist." "iptables"

    exit 0

fi

if lsmod 2>/dev/null | grep -q ipchains ; then

    log_daemon_msg  "ipchains and $IPTABLES can not be used together." "iptables"

    exit 0

fi

# Old or new modutils

/sbin/modprobe --version 2>&1 | grep -q module-init-tools \

    && NEW_MODUTILS=1 \

    || NEW_MODUTILS=0

# Default firewall configuration:

IPTABLES_MODULES=""

IPTABLES_MODULES_UNLOAD="yes"

IPTABLES_SAVE_ON_STOP="no"

IPTABLES_SAVE_ON_RESTART="no"

IPTABLES_SAVE_COUNTER="no"

IPTABLES_STATUS_NUMERIC="yes"

# Load firewall configuration.

[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"

rmmod_r() {

    # Unload module with all referring modules.

    # At first all referring modules will be unloaded, then the module itself.

    local mod=$1

    local ret=0

    local ref=

    # Get referring modules.

    # New modutils have another output format.

    [ $NEW_MODUTILS = 1 ] \

&& ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \

|| ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`

    # recursive call for all referring modules

    for i in $ref; do

rmmod_r $i

let ret+=$?;

    done

    # Unload module.

    # The extra test is for 2.6: The module might have autocleaned,

    # after all referring modules are unloaded.

    if grep -q "^${mod}" /proc/modules ; then

modprobe -r $mod > /dev/null 2>&1

let ret+=$?;

    fi

    return $ret

}

flush_n_delete() {

    # Flush firewall rules and delete chains.

    [ -e "$PROC_IPTABLES_NAMES" ] || return 1

    # Check if firewall is configured (has tables)

    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`

    [ -z "$tables" ] && return 1

    log_daemon_msg "Flushing firewall rules" "iptables"

    ret=0

    # For all tables

    for i in $tables; do

        # Flush firewall rules.

$IPTABLES -t $i -F;

let ret+=$?;

        # Delete firewall chains.

$IPTABLES -t $i -X;

let ret+=$?;

# Set counter to zero.

$IPTABLES -t $i -Z;

let ret+=$?;

    done

    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1

    return $ret

}

set_policy() {

    # Set policy for configured tables.

    policy=$1

    # Check if iptable module is loaded

    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1

    # Check if firewall is configured (has tables)

    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`

    [ -z "$tables" ] && return 1

    log_daemon_msg "Setting chains to policy $policy"

    ret=0

    for i in $tables; do

        echo -n " $i"

        case "$i" in

            raw)

                $IPTABLES -t raw -P PREROUTING $policy \

                && $IPTABLES -t raw -P OUTPUT $policy \

                || let ret+=1

            ;;

            filter)

                $IPTABLES -t filter -P INPUT $policy \

                && $IPTABLES -t filter -P OUTPUT $policy \

                && $IPTABLES -t filter -P FORWARD $policy \

                || let ret+=1

            ;;

            nat)

            $IPTABLES -t nat -P PREROUTING $policy \

                && $IPTABLES -t nat -P POSTROUTING $policy \

                && $IPTABLES -t nat -P OUTPUT $policy \

                || let ret+=1

            ;;

            mangle)

                $IPTABLES -t mangle -P PREROUTING $policy \

                && $IPTABLES -t mangle -P POSTROUTING $policy \

                && $IPTABLES -t mangle -P INPUT $policy \

                && $IPTABLES -t mangle -P OUTPUT $policy \

                && $IPTABLES -t mangle -P FORWARD $policy \

                || let ret+=1

            ;;

            *)

                let ret+=1

            ;;

        esac

    done

    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1

    return $ret

}

start() {

    # Do not start if there is no config file.

    [ -f "$IPTABLES_DATA" ] || return 1

    log_daemon_msg "Applying $IPTABLES firewall rules"

    OPT=

    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    $IPTABLES-restore $OPT $IPTABLES_DATA

    if [ $? -eq 0 ]; then

        log_end_msg 0

    else

        log_end_msg 1; return 1

    fi

    

    # Load additional modules (helpers)

    if [ -n "$IPTABLES_MODULES" ]; then

echo -n "Loading additional $IPTABLES modules"

ret=0

for mod in $IPTABLES_MODULES; do

   echo -n "$mod "

   modprobe $mod > /dev/null 2>&1

   let ret+=$?;

done

[ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1

    fi

    

    touch $VAR_SUBSYS_IPTABLES

    return $ret

}

stop() {

    # Do not stop if iptables module is not loaded.

    [ -e "$PROC_IPTABLES_NAMES" ] || return 1

    flush_n_delete

    set_policy ACCEPT

    

    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then

echo -n "Unloading $IPTABLES modules"

ret=0

rmmod_r ${IPV}_tables

let ret+=$?;

rmmod_r ${IPV}_conntrack

let ret+=$?;

[ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1

    fi

    

    rm -f $VAR_SUBSYS_IPTABLES

    return $ret

}

save() {

    # Check if iptable module is loaded

    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1

    # Check if firewall is configured (has tables)

    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`

    [ -z "$tables" ] && return 1

    echo -n "Saving firewall rules to $IPTABLES_DATA"

    OPT=

    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    ret=0

    TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \

&& chmod 600 "$TMP_FILE" \

&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \

&& size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \

|| ret=1

    if [ $ret -eq 0 ]; then

if [ -e $IPTABLES_DATA ]; then

   cp -f $IPTABLES_DATA $IPTABLES_DATA.save \

&& chmod 600 $IPTABLES_DATA.save \

|| ret=1

fi

if [ $ret -eq 0 ]; then

   cp -f $TMP_FILE $IPTABLES_DATA \

&& chmod 600 $IPTABLES_DATA \

       || ret=1

fi

    fi

    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1

    echo

    rm -f $TMP_FILE

    return $ret

}

status() {

    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`

    # Do not print status if lockfile is missing and iptables modules are not 

    # loaded.

    # Check if iptable module is loaded

    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$tables" ]; then

echo "Firewall is stopped."

return 1

    fi

    # Check if firewall is configured (has tables)

    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then

echo "Firewall is not configured. "

return 1

    fi

    if [ -z "$tables" ]; then

echo "Firewall is not configured. "

return 1

    fi

    NUM=

    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"

    VERBOSE= 

    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"

    COUNT=

    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

    for table in $tables; do

echo "Table: $table"

$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo

    done

    return 0

}

restart() {

    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save

    stop

    start

}

case "$1" in

    start)

stop

start

RETVAL=$?

;;

    stop)

[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save

stop

RETVAL=$?

;;

    restart)

restart

RETVAL=$?

;;

    condrestart)

[ -e "$VAR_SUBSYS_IPTABLES" ] && restart

;;

    status)

status

RETVAL=$?

;;

    panic)

flush_n_delete

set_policy DROP

RETVAL=$?

        ;;

    save)

save

RETVAL=$?

;;

    *)

echo "Usage: $0 {start|stop|restart|condrestart|status|panic|save}"

exit 1

;;

esac

exit $RETVAL

Se le asignan permisos de ejecución.

chmod +x /etc/init.d/iptables

Agregamos las reglas en el archivo de configuración

vim /etc/default/iptables

#---------------------------------------------------------------------

# This file is part of iRedMail, which is an open source mail server

# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.

#

# iRedMail is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# iRedMail is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.

#---------------------------------------------------------------------

#

# Sample iptables rules. It should be localted at:

#   /etc/sysconfig/iptables

#

# Shipped within iRedMail project:

#   * http://iRedMail.googlecode.com/

#

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [0:0]

# Keep state.

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# http/https, smtp/smtps, pop3/pop3s, imap/imaps, ssh

#-A INPUT -p tcp -m multiport --dport 80,443,25,465,110,995,143,993,587,465,2222 -j ACCEPT

# Loop device.

-A INPUT -i lo -j ACCEPT

######## Cacti/Nagios

-A INPUT -s [IP address] -p udp -m udp --dport 161 -j ACCEPT

-A INPUT -s [IP address] -p udp -m udp --sport 161 -j ACCEPT

-A INPUT -s [IP address] -p tcp -m tcp --dport 199 -j ACCEPT

-A INPUT -s [IP address] -p tcp -m tcp --dport 3306 -j ACCEPT

-A INPUT -s [IP address] -p tcp -m tcp --dport 11211 -j ACCEPT

-A INPUT -s [IP address] -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

# Allow PING from remote hosts.

#-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# ejabberd

#-A INPUT -p tcp -m multiport --dport 5222,5223,5280 -j ACCEPT

# http

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

# https

#-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

# Apache

#-A INPUT -p tcp -m tcp --dport 81 -j ACCEPT

# smtp/smtps/smtp(submission)

#-A INPUT -p tcp -m multiport --dport 25,465,587 -j ACCEPT

# pop3/pop3s

#-A INPUT -p tcp -m multiport --dport 110,995 -j ACCEPT

# imap/imaps

#-A INPUT -p tcp -m multiport --dport 143,993 -j ACCEPT

# ldap/ldaps

#-A INPUT -p tcp -m multiport --dport 389,636 -j ACCEPT

# ftp.

#-A INPUT -p tcp -m multiport --dport 21,20 -j ACCEPT

# ssh

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

# Limit the number of incoming tcp connections

# # Interface 0 incoming syn-flood protection
-N syn_flood
-A INPUT -p tcp --syn -j syn_flood
-A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN

-A syn_flood -j DRO

COMMIT

Por ultimo reiniciamos iptables

/etc/init.d/iptables restart

Percona Server con XtraDB en Ubuntu

Para instalar en ubuntu lucid

gpg --keyserver  hkp://keys.gnupg.net --recv-keys 1C4CBDCDCD2EFD2A
gpg -a --export CD2EFD2A | sudo apt-key add -

sudo vim /etc/apt/sources.list


# Percona
deb http://repo.percona.com/apt lucid main
deb-src http://repo.percona.com/apt lucid main


sudo apt-get update
sudo apt-get install percona-server-server-5.5 tinyca bsd-mailx
sudo apt-get autoremove


sudo vim /etc/mysql/my.cnf

Comentamos bind-address para poder conectarnos mediante cacti, siempre y cuando se tenga un firewall filtrando las peticiones.
#bind-address = 127.0.0.1

Verificamos que el thread_stack sea 192K,

thread_stack = 192K

Activamos el registro de búsquedas lentas descomentando la siguiente linea, esto es solo para la puesta a punto, terminada la prueba se desactiva.

slow-query-log          = 1

slow-query-log-file     = /var/log/mysql/mysql-slow.log

Agregamos la configuración para un uso eficiente de innodb

vim  /etc/mysql/conf.d/xtradb.cnf 

[mysqld]

innodb_log_file_size=1900M

innodb_buffer_pool_size=2G

innodb_flush_log_at_trx_commit=2

innodb_flush_method=O_DIRECT

innodb_io_capacity=1000

innodb_use_sys_malloc=0

innodb_read_io_threads=4

innodb_write_io_threads=4

innodb_max_dirty_pages_pct=20

innodb_ibuf_max_size=200M

innodb_ibuf_active_contract=1

innodb_ibuf_accel_rate=400

innodb_doublewrite=0

innodb_file_per_table

innodb_thread_concurrency=0

Borramos los archivos de log de innoddb para que genere unos nuevos de acuerdo a la nueva configuración.

rm -rf /var/lib/mysql/ib_logfile*

Iniciamos mysql

/etc/init.d/mysql start

Revisamos en los logs, que no exista problemas, si todo esta bien, por ultimo verificamos que el servicio inicie junto con el reinicio del sistema

sysv-rc-conf