Nic-systems: Created page with "There are several basic steps necessary to getting a new host up and running on the OACISS research network. == 0 - Security == The following few iptables commands will set u..."

2020-02-04T02:05:31Z

Created page with "There are several basic steps necessary to getting a new host up and running on the OACISS research network. == 0 - Security == The following few iptables commands will set u..."

New page

There are several basic steps necessary to getting a new host up and running on the OACISS research network.

== 0 - Security ==
The following few iptables commands will set up a basic firewall for input: Local loopback is unfiltered, established connection packets are allowed, SSH is allowed from the OACISS network (128.223.202/24).

If the host is on the storage network, the 4th line permits all traffic from the 172.17.0.0/16 network on the private interface (note that you probably need to set the correct -i INTERFACE). If it isn't, don't copy this line.

Finally anything not matching these rules disappears into the howling binary void, i.e. the host may as well not exist so far as the rest of the Interbutts are concerned and we're okay with that.

<pre>
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -s 128.223.202.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 172.17.0.0/24 -i enP1p3s0f2 -j ACCEPT
iptables -A INPUT -j DROP
iptables-save
</pre>

== 1 - Network services ==

* Authentication setup: Follow the steps outlined for new LDAP clients at [[ Procedure:New_LDAP_Client ]]
* NFS setup: Follow the steps at [[ Procedure:New host filesystems ]]

Procedure:New Host / Reinstallation setup - Revision history

Nic-systems: Created page with "There are several basic steps necessary to getting a new host up and running on the OACISS research network. == 0 - Security == The following few iptables commands will set u..."