Circumvent vulnerabilities by restricting ip through whitelist iptables

Antecedents:

The system scanned two vulnerabilities. 1: database oracle vulnerability. 2:openssh vulnerability.

Linux operating system redhat4.7 Enterprise Edition, oracle11g

The solution is as follows:

1 oracle patches are generally charged, and vulnerabilities do not have much impact on the database, so patches are not recommended.

2 upgrade openssh, but the operating system version is too old. Customers are required to upgrade ssh to the latest version 8.3, not to mention whether the operating system of 4.7 supports ssh of 8.3, even if it does, upgrading ssh depends on zlib, ssl, perl, gcc and so on.

Later, I installed redhat4.8 on my virtual machine, and eventually the ssh8.3 upgrade was successful, as described in another article.

Solution:

Allow specified ip access to 1521 and 22 by adding a whitelist to avoid scanning

Edit vi / etc/sysconfig/iptables# New report list

-N whitelist

# two ip allow access to 1521

-An INPUT-p tcp-s 73.XX.XX.137-- dport 1521-j ACCEPT

-An INPUT-p tcp-s 137.XX.XX.0/24-- dport 1521-j ACCEPT # because Internet access is aggregated into a network gate, which is a network segment of 0-24

# An ip allows access to 22

-An INPUT-p tcp-s 73.XX.XX7.137-- dport 22-j ACCEPT

-An INPUT-p tcp-j whitelist

-An INPUT-p udp-j whitelist

-An INPUT-m state-- state RELATED,ESTABLISHED-j ACCEPT

-An INPUT-p icmp-j ACCEPT

-An INPUT-I lo-j ACCEPT

-An INPUT-j REJECT-- reject-with icmp-host-prohibited

-A FORWARD-j REJECT-- reject-with icmp-host-prohibited

COMMIT

# Completed on Fri Aug 7 08:51:17 2020

Restart after saving

Service iptables restart