APF firewall and Brute Force Detection
APF firewall is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux.
BFD(Brute Force Detection) is a modular shell script for parsing applicable logs and checking for authentication failures. There is not much complexity or detail to BFD yet and likewise it is very straight-forward in its installation, configuration and usage. The reason behind BFD is very simple; the fact there is little to no authentication and brute force auditing programs in the linux community that work in conjunction with a firewall or real-time facility to place bans.
APF Firewall feature
- simple & well commented configuration files
- layered firewall with independent ingress and egress filtering system
- uid based egress filtering via simple configuration variables
- global tcp/udp ports & icmp types configurtion
- configurable policies for each ip on the system with convenience vars
- prerouting rules for optimal network responce; TOS (type of service)
- icmp based rate limiting to prevent common icmp 'dos' abuses
- antidos subsystem to stop attacks before they become a significant threat
- dshield.org block list support to ban networks exhibiting suspicious activity
- advanced set of sysctl parameters for tcp/ip stack hardening
- advanced set of filter rules to remove undesired traffic
- advanced use of kernel features such as abort_on_overflow & tcp syncookies
- easy to use firewall managment script
- trust based rule files (allow/deny); with advanced syntax support
- 3rd party addon projects that compliment APF features
Installation Guide
Install APF Firewall
To install APF, SSH into server and login as root.
At command prompt type: cd /root/
At command prompt type: wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
At command prompt type: tar -xvzf apf-current.tar.gz
At command prompt type: rm -f apf-current.tar.gz
At command prompt type: cd apf-0.9.4-6
At command prompt type: sh ./install.sh
After APF has been installed, you need to edit the configuration file.
At command prompt type: cd /etc/apf
At command prompt type: pico -w conf.apf
Scroll down and find
USE_DS="0"
change it to
USE_DS="1"
Now scroll down and configure the Ports.
PS: open the port that suitable for your server
PS: if you change your SSH default port, u must open it in the firewall also!!!
Common ingress (inbound) TCP ports
IG_TCP_CPORTS="22,80,443"
Common ingress (inbound) UDP ports
IG_UDP_CPORTS=""
Common ICMP (inbound) types
IG_ICMP_TYPES="3,5,11,0,30,8"
Common egress (outbound) TCP ports
EG_TCP_CPORTS="53,80,443"
Common egress (outbound) UDP ports
EG_UDP_CPORTS="53"
Common ICMP (outbound) types
EG_ICMP_TYPES="all"
---------------------------------------------
To start APF
At command prompt type: /usr/local/sbin/apf -s
APF commands are:
-s start
-r restart
-f flush - stop
-l list
-st status
-a HOST allow HOST
-d HOST deny HOST
Log out of SSH and then login again.
After you are sure everything is working fine, change the DEV option
At command prompt type: cd /etc/apf
At command prompt type: pico -w conf.apf
Scroll down and find
DEVM="1"
change it to
DEVM="0"
Save changes, exit and then restart firewall,
At command prompt type: /usr/local/sbin/apf -r
PS: Type "iptables --list" , you will see a list of danger ip range are blocked(using DShield setting)
----------------------------------------------------
Install BFD (Brute Force Detection)
To install BFD, SSH into server and login as root.
At command prompt type: cd /root/
At command prompt type: wget http://www.rfxnetworks.com/downloads/bfd-current.tar.gz
At command prompt type: tar -xvzf bfd-current.tar.gz
At command prompt type: cd bfd-0.4
At command prompt type: ./install.sh
After BFD has been installed, you need to edit the configuration file.
At command prompt type: pico /usr/local/bfd/conf.bfd
Under Enable brute force hack attempt alerts:
Find
ALERT_USR="0"
and change it to
ALERT_USR="1"
Find
EMAIL_USR="root"
and change it to
EMAIL_USR="your@email.com"
Save the changes then exit.
To start BFD
At command prompt type: /usr/local/sbin/bfd -s
----------------------------------------------------
log checking, here are the log files generated by apf and bfd
/var/log/apf_log
/var/log/bfd_log
check it daily~
