Ask Ubuntu General Room

Nathan Osman

7:01 PM

I did a bit of work with PAM.

Let me try to find the source code...

bazaar.launchpad.net/~george-edison55/jetftp/trunk/view/head:/…

It begins around line 238.

Other than that, I don't know anything about PAM :P

Serg

^_^''''''

all i really need is to ban a user after 3 strikes in ssh

cl-netbox

@A.B. - maybe @Serg does mean Pamela Anderson's "modules" - got it ? =)

Nathan Osman

@Serg fail2ban, maybe?

A.B.

@cl-netbox ^_^

cl-netbox

@Serg - am I right ?

@Serg - hello - are you sleeping ? (maybe between Pam's modules) ? =)

Serg

7:09 PM

@cl-netbox ha, Pamela Anderson's modules sound tempting, but unfortunately I am only only only into Asian ladies :)

cl-netbox

@Serg I have seen some with big ones as well :) - anyway better than boring software, right ? =)

Nathan Osman

This conversation has really derailed...

A.B.

ufw/iptables specialists here?

Discussion between A.B. and alexus

Imported from a comment discussion on askubuntu.com/questions/...

Serg

@NathanOsman that's what one of the answers mentions it already, but isn't pam supposed to be working for that ? Like there is /etc/pam.d/sshd , it's just not working :/

Nathan Osman

I honestly have no idea...

Serg

7:18 PM

@cl-netbox Oh, yes. Check out Hitomi Tanaka, Nana Aoyama, Rin Aoki, Rui Akikawa. There are all well endowed ladies :)

user139252

One of my students is trying to convince the others that college is worthless because all a college degree is for is material gain which doesn't matter in the end.

cl-netbox

@Serg you nasty nasty boy you - oh oh oh ... =)

user139252

I am disappointed in the next generation.

Serg

@HeatherBrown material gain pays bills and sustains your living

therefore college degree sustains your living once you get it

A.B.

@HeatherBrown o/

Serg

7:23 PM

or to be more exact it's one of the methods

alexus

hi

A.B.

@HeatherBrown are you good with ufw/iptables?

@alexus needs some help… and me -_-

@Serg he master of nmcli

Serg

@A.B. kinda, not really :)

alexus

nmcli is part of redhat not ubuntu or am I wrong?

user139252

IPTables... mostly

Serg

7:26 PM

@alexus nope

user139252

UFW... never really used it

alexus

ufw is just wrapper

front end

it uses iptables

A.B.

@alexus network-manager: /usr/bin/nmcli

user139252

Oh. I can do IPTables the old fashioned way.

user139252

What needs done?

alexus

7:28 PM

@HeatherBrown do you mind taking a look at pastebin.com/diXtMyRN

A.B.

@HeatherBrown great

Serg

@alexus nmcli is like a command line version of network manager. But in ubuntu prior to 14.04 they had different nmcli than on redhat or fedora. Now as of 15.04 ubuntu is switching to systemd, so they now use same one as on redhat/ffedora

alexus

@serg right, i know what nmcli is) just came back from redhat training, one of new things i learned)

Serg

@alexus ah. How was the raining ?

alexus

@HeatherBrown it looks by default it should deny all incoming connections, but it doesn't look like that's what it's doing...

@Serg mine was like for super duper admins, everyone in my group had 20+ years of Linux hands on experience

A.B.

7:30 PM

2015 and 20+ years?

alexus

people who attended it, start using linux in 1995 and been using it until today 2015

user139252

You want to deny ALL incoming connections?

A.B.

Ok the first kernel: 17. September 1991

alexus

@HeatherBrown according to output that's what it should be doing

root@alexus:~# ufw status verbose | grep ^Default
Default: deny (incoming), allow (outgoing), deny (routed)
root@alexus:~#

user139252

So, how do you know that incoming connections are slipping through?

alexus

7:33 PM

'cause whenever I try to connect, it actually connects

i also used nmap and it reports as port being open

Serg

@alexus just out of curriosity, what exactly you're trying to do ?

user139252

have you tried just typing sudo iptables -A INPUT -j REJECT?

alexus

@Serg, so I have this host running Ubuntu and start running few services, I need to keep them firewalled

so that's the end goal

user139252

The command I said will allow outgoing and currently established connections, but nothing incoming.

alexus

@HeatherBrown I'm not looking to reject everything)

I'm looking to disallow from everywhere, except certain IPs

with default behavior it should've already take care of first part, but according to my test that's not the case

Serg

7:41 PM

@alexus look into fail2ban . I'm just learning this thingy, but apparently it's like a firewall that bans ips except for certain ones

user139252

sudo iptables -I INPUT -p tcp ! -s XXX.XXX.XXX -j DROP

user139252

That will block all incoming traffic from any IP other than XXX.XXX.XXX.XXX

user139252

All TCP traffic, at least. You could do the same for UDP as well.

Ask Ubuntu Meta

2

Q: What's up with the late answers queue?

It looks like we currently have 4400+ late answers awaiting review: Obviously that's not possible, so what's up with that review queue? Looks like a server-side issue, however using Google Chrome 45.0.2454.93.