How to: Open Ssh Port 22 on Linux APF Firewall under CentOS / RHEL

Posted on in Categories , , , , , , , last updated December 7, 2007

Q. I’d like to change ssh port from 22 to 2346. I changes the ssh port and reloaded OpenSSH but didn’t get through my firewall. I’m using APF firewall script under cPanel control panel? How do I open port 2346?

A. By default APF configured via /etc/apf/conf.apf file. All you have to do is login as the root and specify port number.

Open port 2346 using APF

Login as the root

Open config file /etc/apf/conf.apf
# vi /etc/apf/conf.apf
Find line that read as follows:
Add port 2346 (keep all other ports):
Close and save the file. Restart firewall:
# /etc/init.d/apf restart

What is the difference between UDP and TCP internet protocols?

Posted on in Categories , , , last updated December 16, 2007

Q. Can you explain the difference between UDP and TCP internet protocol (IP) traffic and its usage with an example?
A. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)is a transportation protocol that is one of the core protocols of the Internet protocol suite. Both TCP and UDP work at transport layer TCP/IP model and both have very different usage.

Difference between TCP and UDP

Reliability: TCP is connection-oriented protocol. When a file or message send it will get delivered unless connections fails. If connection lost, the server will request the lost part. There is no corruption while transferring a message.Reliability: UDP is connectionless protocol. When you a send a data or message, you don’t know if it’ll get there, it could get lost on the way. There may be corruption while transferring a message.
Ordered: If you send two messages along a connection, one after the other, you know the first message will get there first. You don’t have to worry about data arriving in the wrong order.Ordered: If you send two messages out, you don’t know what order they’ll arrive in i.e. no ordered
Heavyweight: – when the low level parts of the TCP “stream” arrive in the wrong order, resend requests have to be sent, and all the out of sequence parts have to be put back together, so requires a bit of work to piece together.Lightweight: No ordering of messages, no tracking connections, etc. It’s just fire and forget! This means it’s a lot quicker, and the network card / OS have to do very little work to translate the data back from the packets.
Streaming: Data is read as a “stream,” with nothing distinguishing where one packet ends and another begins. There may be multiple packets per read call.Datagrams: Packets are sent individually and are guaranteed to be whole if they arrive. One packet per one read call.
Examples: World Wide Web (Apache TCP port 80), e-mail (SMTP TCP port 25 Postfix MTA), File Transfer Protocol (FTP port 21) and Secure Shell (OpenSSH port 22) etc.Examples: Domain Name System (DNS UDP port 53), streaming media applications such as IPTV or movies, Voice over IP (VoIP), Trivial File Transfer Protocol (TFTP) and online multiplayer games etc

Further readings

Iptables is not sending LOG to syslog file

Posted on in Categories , , , last updated November 22, 2007

Q. I am running SSH/MySQL/Webserver and setup iptables based firewall. But my logs are send to console rather than the system log files. How do make sure that iptables LOG target messages are send to /var/log/messages file?

A. IPTABLES LOG module turns on kernel logging of matching packets. When this option is set for a rule, the Linux kernel will print some information on all matching packets (like most IP header fields) via the kernel log where it can be read with
dmesg or syslogd.

You can configure level of logging with an option called –log-level level. For example, drop and LOG all incoming port 22 TCP, message:
iptables -I OUTPUT -j LOG --log-level crit -p tcp --dport 22

Read man pages of iptables and syslog.conf for more info.