Home Explore Help
Register Sign In
svaksha
/
aksh
Watch 1
Star 1
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: 771fbba7ba
Branches Tags
aksh
/
cs-os-devops.md

cs-os-devops.md 11 KB
History Raw

====

AMQP

Celery

ZeroMQ

RabbitMQ

AWS

HELP

SO

DEVOPS

Automation

Batch Jobs

  • Luigi :: A Python module that helps you build complex pipelines of batch jobs. It handles dependency resolution, workflow management, visualization etc. It also comes with Hadoop support built in.

CI

LibCloud

DOCKER

DELL

mixcoatl

Wiki

Bugs

Monitoring

System Disk Monitoring tools

Chef

(.rb)

Puppet

(.rb)

Vagrant

(.rb)

Cobbler

(.py)

OpenStack

UserExample

Rackspace

HEROKU

NEWS

Random Papers

OpenShift

SECURITY

Firewalls

Each line should start with $ipt (which is your variable that points to the iptables binary with complete path). This shows your second line starting with "ESTABLISHED" & third line with "$WAN_IFACE".

Did you check your linefeeds and command formatting?

Alternately flush your tables and load each command manually to see where/if you have script errors! Just cut/copy/paste each line into your tables, then display the full recipe with "iptables_save" and/or pipe via STOUT to a text file to compare or import at startup. Depending on your distro, iptables startup config and version, your templates might conflict. Many stock firewalls, VPN solutions and Virtualized servers use bridging, TUN or null devices with DNAT/SNAT and or EBTABLES.

Just pulling partial iptables out of your scripts tool bin for use, while replacing the complete startup UFW config firewall, might be a quick solution, however security threats today demand that you use a complete solution or build upon modern tools, like SHOREWALL: http://shorewall.net/bridge-Shorewall-perl.html

Other appliance based SOHO firewalls include: SMOOTHWALL: http://www.smoothwall.org IPCOP: http://www.ipcop.org

Also don't forget to check your kernel values! In order to support iptables in bridging mode (which you are not doing but might consider), your Linux kernel needs to be compiled with CONFIG_BRIDGE_NETFILTER=1, and your /etc/sysctl.conf file either needs to not contain any entries for the following settings or have them set to “1”:

net.bridge.bridge-nf-call-arptables=0 net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0

Traditionally, Ubuntu and other Debian derivatives store network interface configurations in the file /etc/network/interfaces. However, GNOME's Network Manager system automatically configures any interface not explicitly described in that file.

In theory, this should mean that if you specify interface and bridge configurations in /etc/network/interfaces, you shouldn't have to worry about Network Manager overriding or otherwise conflicting with those settings. But in practice, most Admins agree, you're better off disabling Network Manager altogether in the System→Preferences→Startup Applications applet, if you want to set up a bridged iptable configuration in /etc/network/interfaces.

To completely disable Network Manager, you also need to open the System→Preferences→Network Connections control panel and delete all connection profiles under the Wired tab. Even if Network Manager is disabled as a startup service, Ubuntu will read network configuration information set by this control panel, resulting in strange interactions with /etc/network/interfaces.

Even after disabling the Network Manager service, setting up /etc/network/interfaces and stopping and restarting /etc/init.d/networking, ethernet devices can show up in the routing table with the same IP address as the bridge (which is why we asked you what your route was showing). You must kill all processes and restart the Daemon.

Since most of us really need something "bigger" than say as SOHO router (even something running a ddwrt /openwrt solution), I would suggest adding a nice appliance instead?

This is a pretty tight solution: REDWALL, http://redwall.sourceforge.net/features.html

Web, basic port firewalling

  • https://www.owasp.org/index.php/Main_Page, is a good place to start for Web, aimed more towards the Development side (applications).
  • Linux server hardening, http://www.tecmint.com/linux-server-hardening-security-tips/ Keep in mind those tips are for PRODUCTION SERVERS rather than Development machines or Workstations. For example, it is best practices NOT to have GUI desktops on most Production Linux Servers (there are some exceptions), but for Workstations, most Developers would prefer to have a GUI development environment.

Yaksha ToDo