topic bastille and IPFilter issues in Operating System - HP-UX

bastille and IPFilter issues

jreypo — Wed, 21 Oct 2009 13:16:05 GMT

Hi all,

I just added some custom IPFilter rules to a bastilled server, of course I added them in /etc/opt/sec_mgmt/bastille/ipf.customrules.

The I re-applied the bastille config with bastille -b and everything seems OK.

I checked with ipfstat -io and the new rules where there, I also look into ipf.conf and it was OK too but after a reboot of the server when I do an ipfstat -io the new rules aren't there.

Any ideas, am I doing something wrong?

Thx and rgds,
JMR

Re: bastille and IPFilter issues

jreypo — Wed, 21 Oct 2009 13:22:45 GMT

More info:

If I perform:

mad_svr01 # /sbin/init.d/ipfboot stop
mad_svr01 # /sbin/init.d/ipfboot start

The new rules are correctly loaded It seems that the problem is only after a reboot of the server.

Rgrds,

Re: bastille and IPFilter issues

Fred K. Abell Jr._1 — Thu, 22 Oct 2009 13:34:44 GMT

I that the reason is the rules are not in the ipf.conf file. When the system is restarting, ipfilter looks at the ipf.conf file for rules, and the custom rules you added were only added to an up and running system, not to the start-up routine. There are better admins than I who could tell you with more confidence.

If your additional rules work, then why not add them to your ipf.conf file. Not only will they be there at reboot, but if your system has lots of ip traffic, you can customize the rule order to make your ipfilter more efficient. For example, you might want to put your "block in quick ..." rules before your "pass out ..." rules so incoming packets can be dropped quicker, instead of progressing down the rule list eating up system resources.

Fred

Re: bastille and IPFilter issues

jreypo — Thu, 22 Oct 2009 15:03:33 GMT

Hi Fred.

I agree with you about the ipf.conf, but Bastille manual specifically say to put the new custom rules in the /etc/opt/sec_mgmt/bastille/ipf.customrules file.

Anyway I decided to revert the server to the so-called pre-bastille state and to setup its secuity manually, including IPFilter, password policies, etc.

Thx for your answer.

Rgrds,
---
JMR