572
edits
Changes
→Part 3: Making iptables Policies Persistent
:'''Perform the following steps:'''
Some tasks in this part of the investigation '''require you to be connected to Seneca's VPN'''.
*If you are running your installation through VMWare, then you can use [https://insidestudents.senecacollege.ca/itsspaces/186/it-services/wiki/view/1025/student-vpn/studentvpn.html the instructions provided by ITS] to connect to it from your Windows machine (your c7host and its nested VMs will use the VPN through the windows machine without further configuration).
*If you installed your c7host '''directly onto a machine without using VMWare''' as an intermediary (or the steps above do not work for you), use the following instructions:
::*Install the package openconnect
# Delete the rule in the INPUT chain that allows ICMP traffic from <b>anyone</b>, and replace it with one that only allows ssh traffic sent by your other machine.
# Delete the rule in your '''INPUT''' and '''FORWARD''' chains that '''REJECT'''s any traffic you haven't '''ACCEPT''ed. You are better protected by the default '''DROP''' policy you set.
#To make the iptables rules '''persistent''' (i.e. keeps rules when system restarts), you issue the command: <b><code><span style="color:#3366CC;font-size:1.2em;">sudo sh -c 'iptables-save > /etc/sysconfig/iptables'</span></code></b>(NOTE: redirections happen before the actual command execution and don't run with the elevated sudo privileges, therefore we need to use 'sh -c')<!-- [Ahad Mammadov] Added sh -c to skip the next step, and kept it here in case it's needed to be restored#You will notice that even when running the command with sudo, it isn't letting you write to <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/sysconfig/iptables</span></code></b>. Use <b><code><span style="color:#3366CC;font-size:1.2em;">sudo -i</span></code></b>, then try to save them again.When done, log out of root user (exit sudo).-->
# Verify that the file '''/etc/sysconfig/iptables''' exists.
# Restart your iptables service and test your configuration.
# Make certain ALL of your VMs are running.
# Switch to your '''c7host''' VM and change to your user's '''bin''' directory.
# Issue the Linux command: <b><code><span style="color:#3366CC;font-size:1.2em;">wget https://ictraw.senecacollegegithubusercontent.cacom/~peter.callaghanOPS245/ops245labs/labsmain/lab7-check.bash</span></code></b>
# Give the '''lab7-check.bash''' file execute permissions (for the file owner).
# Run the shell script and if there are any warnings, make fixes and re-run shell script until you receive "congratulations" message.
