How to setup HN firewall

[anthonysomerset]

hi there

my first post here! i am a fairly new proxmox user, i chose it due to the fact that other VPS solutions were either costly or had other cons such as management interface restrictions (ESXi - Windows only management anyone?) and a variety of other reasons

i started building my first production server (well first public one anyway) last week using proxmox and debian containers for mail, web and dns.

the reason i am here is because i have searched high and low to solve my problem, i have googled, checked the wiki and everything.

there was some info provided here - http://wiki.openvz.org/Setting_up_an_iptables_firewall

but for my requirements i found the instructions a bit cryptic. so i shall describe my setup and requirements and perhaps someone can help.

i have a /29 public ip range and only one nic on the server, each of the containers and proxmox have there own IP. all the debian boxes have webmin and there own copy of csf installed to firewall each container (i have modded the vz.conf file to enable the required ip tables modules) this is great for the containers

however before i sign off the server for full scale production use rather than testing i want to make sure the Host Node (proxmox) is secure, i want to setup a firewall on the HN without affecting access to the containers.

does anyone have any suggestions of there solutions on how to secure the HN in this way, even if its just a human translation of the instructions in the link above.

ps i do understand that firewalling each container seperately sounds wierd i had set these up before reading some of the openVZ articles and dont like the thought of undoing all my work on this side of things

also i assume to secure ssh and change its port i can just edit the conf file and restart the ssh service?

thoughts very much appreciated

 

[anthonysomerset]

UPDATE

editing /etc/ssh/sshd_config
and running /etc/init.d/ssh reload or restart

opens the new ssh port for connections, but 22 still responds???

 

[anthonysomerset]

UPDATE

editing /etc/ssh/sshd_config
and running /etc/init.d/ssh reload or restart

opens the new ssh port for connections, but 22 still responds???

a physical restart of the server was what was needed to get ssh to respond on the correct port only.

still stumped on a firewalling solution, i mean its easy to setup webmin and csf+lfd on the Host machine but what i am unsure about is how that will affect the containers and that is what i want to avoid

 

[Jorem]

Firewall How-To I used and works great: http://www.montanalinux.org/node/1098
Don't forget to restart the firewall after every newly added container.

I setup SSH in the cluster so that only the other nodes in my cluster can access each other with root.
edit /etc/pam.d/sshd and add the following:

account required pam_access.so


Edit /etc/security/access.conf and add the following 6 lines and change them to your settings:


+ : root : yourip
+ : root : 127.0.0.1
+ : root : sub.domain.com
- : root : ALL
+ : username : ALL
- : ALL : ALL


Explenation;

+ : root : yourip ; Root acces for this ip: 192.168.0. You do not need the last one because it takes the whole range now.
+ : root : 127.0.0.1 ; localhost access
+ : root : sub.domain.com ; ip is enough, but also added the domain
- : root : ALL ; deny for all other sources
+ : username : ALL ; the user that can access SSH from all sources
- : ALL : ALL ; deny everbody else

 

[anthonysomerset]

Firewall How-To I used and works great: http://www.montanalinux.org/node/1098
Don't forget to restart the firewall after every newly added container.

I setup SSH in the cluster so that only the other nodes in my cluster can access each other with root.
edit /etc/pam.d/sshd and add the following:

account required pam_access.so


Edit /etc/security/access.conf and add the following 6 lines and change them to your settings:


+ : root : yourip
+ : root : 127.0.0.1
+ : root : sub.domain.com
- : root : ALL
+ : username : ALL
- : ALL : ALL


Explenation;

+ : root : yourip ; Root acces for this ip: 192.168.0. You do not need the last one because it takes the whole range now.
+ : root : 127.0.0.1 ; localhost access
+ : root : sub.domain.com ; ip is enough, but also added the domain
- : root : ALL ; deny for all other sources
+ : username : ALL ; the user that can access SSH from all sources
- : ALL : ALL ; deny everbody else

thanks for this, the guide you posted is in real english and much easier to understand and actually provides some real setup info rather than just a few config lines expecting a user to understand it fully first time through without explanation, thanks for the root suggestions, i fully intend turning off root ssh access outside of the box except for a couple of trusted IP's and probably via public key interchange as well only.