Der perfekte Rootserver (Support Thread)

#!/bin/bash
if [ $# -eq 1 ]
NM=`uname -a && date`
NAME=`echo $NM | md5sum | cut -f1 -d" "`
then
        ppa_name=`echo "$1" | cut -d":" -f2 -s`
        if [ -z "$ppa_name" ]
        then
                echo "PPA name not found"
                echo "Utility to add PPA repositories in your debian machine"
                echo "$0 ppa:user/ppa-name"
        else
                echo "$ppa_name"
                echo "deb http://ppa.launchpad.net/$ppa_name/ubuntu xenial main" >> /etc/apt/sources.list
                apt-get update >> /dev/null 2> /tmp/${NAME}_apt_add_key.txt
                key=`cat /tmp/${NAME}_apt_add_key.txt | cut -d":" -f6 | cut -d" " -f3`
                apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $key
                rm -rf /tmp/${NAME}_apt_add_key.txt
        fi
else
        echo "Utility to add PPA repositories in your debian machine"
        echo "$0 ppa:user/ppa-name"
fi

/add_repository.sh ppa:ondrej/apache2

./add_repository.sh ppa:ondrej/php

OPEN_TCP="xxx, 25, 80, 110, 143, 443, 465, 587, 993, 995, 20, 21, 22"

c) Now we configure what ports should be open for the outside world. If you
      eg. are running an HTTP-server(port 80), an SSH-server(port 22), and/or
      an FTP-server (port 21) which should be accessible from the internet you
      should configure the OPEN_TCP / OPEN_UDP variables like this:
      OPEN_TCP="21 22 80"
      OPEN_UDP=""

arno-iptables-firewall restart

root@mail:~# arno-iptables-firewall restart
Arno's Iptables Firewall Script v2.0.1g-DEVEL
-------------------------------------------------------------------------------
Platform: Linux 3.16.0-4-amd64 x86_64
Stopping (user) plugins...
 Unloaded 0 plugin(s)...
Checking/probing Iptables modules:
 Loaded kernel module ip_tables.
 Loaded kernel module nf_conntrack.
 Loaded kernel module nf_conntrack_ftp.
 Loaded kernel module xt_conntrack.
 Loaded kernel module xt_limit.
 Loaded kernel module xt_state.
 Loaded kernel module xt_multiport.
 Loaded kernel module iptable_filter.
 Loaded kernel module iptable_mangle.
 Loaded kernel module ipt_REJECT.
 Loaded kernel module xt_LOG.
 Loaded kernel module xt_TCPMSS.
 Loaded kernel module iptable_nat.
 Module check done...
Configuring general kernel parameters:
 Setting the max. amount of simultaneous connections to 16384
  net.nf_conntrack_max = 16384
  net.netfilter.nf_conntrack_udp_timeout = 60
  net.netfilter.nf_conntrack_acct = 1
Configuring kernel parameters:
 Disabling send redirects
  net.ipv4.conf.all.send_redirects = 0
  net.ipv4.conf.default.send_redirects = 0
  net.ipv4.conf.eth0.send_redirects = 0
  net.ipv4.conf.lo.send_redirects = 0
 Enabling protection against source routed packets
  net.ipv4.conf.all.accept_source_route = 0
  net.ipv4.conf.default.accept_source_route = 0
  net.ipv4.conf.eth0.accept_source_route = 0
  net.ipv4.conf.lo.accept_source_route = 0
  net.ipv4.icmp_echo_ignore_broadcasts = 1
  net.ipv4.icmp_ignore_bogus_error_responses = 1
 Enabling packet forwarding
  net.ipv4.conf.all.forwarding = 1
  net.ipv4.conf.default.forwarding = 1
  net.ipv4.conf.eth0.forwarding = 1
  net.ipv4.conf.lo.forwarding = 1
 Setting some kernel performance options
  net.ipv4.tcp_window_scaling = 1
  net.ipv4.tcp_timestamps = 1
  net.ipv4.tcp_sack = 1
  net.ipv4.tcp_dsack = 1
  net.ipv4.tcp_fack = 1
  net.ipv4.tcp_low_latency = 0
 Enabling reduction of the DoS'ing ability
  net.ipv4.tcp_fin_timeout = 30
  net.ipv4.tcp_keepalive_time = 1800
  net.ipv4.tcp_syn_retries = 3
  net.ipv4.tcp_synack_retries = 2
  net.ipv4.tcp_rfc1337 = 1
  net.ipv4.ip_local_port_range = 32768 61000
 Enabling SYN-flood protection via SYN-cookies
  net.ipv4.tcp_syncookies = 1
 Enabling strict anti-spoof with rp_filter
  net.ipv4.conf.all.rp_filter = 1
  net.ipv4.conf.default.rp_filter = 1
  net.ipv4.conf.eth0.rp_filter = 1
  net.ipv4.conf.lo.rp_filter = 1
  net.ipv4.icmp_echo_ignore_all = 0
 Disabling the logging of martians
  net.ipv4.conf.all.log_martians = 0
  net.ipv4.conf.default.log_martians = 0
  net.ipv4.conf.eth0.log_martians = 0
  net.ipv4.conf.lo.log_martians = 0
 Disabling the acception of ICMP-redirect messages
  net.ipv4.conf.all.accept_redirects = 0
  net.ipv4.conf.default.accept_redirects = 0
  net.ipv4.conf.eth0.accept_redirects = 0
  net.ipv4.conf.lo.accept_redirects = 0
 Disabling ECN (Explicit Congestion Notification)
  net.ipv4.tcp_ecn = 0
 Disabling kernel support for dynamic IPs
  net.ipv4.ip_dynaddr = 0
 Enabling PMTU discovery
  net.ipv4.ip_no_pmtu_disc = 0
 Setting default TTL=64
  net.ipv4.ip_default_ttl = 64
 Flushing route table
  net.ipv4.route.flush = 1
 Kernel setup done...
Reinitializing firewall chains
 Setting all default policies to DROP while "setting up firewall rules"
IPv4 mode selected but IPv6 available, DROP all IPv6 packets
Blocking (blackhole) direction: Inbound and Outbound
(Re)loading list of BLOCKED hosts from /etc/arno-iptables-firewall/blocked-hosts...
 0%.........20%.........40%.........60%.........80%.........100%.........32015 host line(s) read
Using loglevel "info" for syslogd

Setting up firewall rules:
-------------------------------------------------------------------------------
Enabling setting the maximum packet size via MSS
Logging of stealth scans (nmap probes etc.) enabled
Logging of packets with bad TCP-flags enabled
Logging of INVALID TCP packets disabled
Logging of INVALID UDP packets disabled
Logging of INVALID ICMP packets disabled
Logging of fragmented packets enabled
Logging of access from reserved nets disabled
Reading custom rules from /etc/arno-iptables-firewall/custom-rules
Checking for (user) plugins in /usr/local/share/arno-iptables-firewall/plugins...
 Loaded 0 plugin(s)...
Setting up external(INET) INPUT policy
 Logging of ICMP flooding enabled
 Logging of explicitly blocked hosts enabled
 Logging of denied local output connections enabled
 Packets will NOT be checked for reserved source addresses
 Enabling protection against DRDOS-abuse
 Allowing ANYHOST for TCP port(s): 25,
 Allowing ANYHOST for TCP port(s): 80,
 Allowing ANYHOST for TCP port(s): 110,
 Allowing ANYHOST for TCP port(s): 143,
 Allowing ANYHOST for TCP port(s): 443,
 Allowing ANYHOST for TCP port(s): 465,
 Allowing ANYHOST for TCP port(s): 587,
 Allowing ANYHOST for TCP port(s): 993,
 Allowing ANYHOST for TCP port(s): 995,
 Allowing ANYHOST for TCP port(s): 21,
 Allowing ANYHOST for TCP port(s): 22
 Allowing ANYHOST to send IPv4 ICMP-requests (ping)
 Logging of possible stealth scans enabled
 Logging of (other) packets to PRIVILEGED TCP ports enabled
 Logging of (other) packets to PRIVILEGED UDP ports enabled
 Logging of (other) packets to UNPRIVILEGED TCP ports enabled
 Logging of (other) packets to UNPRIVILEGED UDP ports enabled
 Logging of IGMP packets enabled
 Logging of dropped ICMP-request(ping) packets enabled
 Logging of dropped other ICMP packets enabled
 Logging of other IP protocols (non TCP/UDP/ICMP/IGMP) packets enabled
Setting up external(INET) OUTPUT policy
Applying external(INET) policy to interface: eth0Security is ENFORCED for external interface(s) in the FORWARD chain
 Logging of dropped FORWARD packets enabled

Jun 01 12:13:55 All firewall rules applied.

 Allowing ANYHOST for TCP port(s): 25
 Allowing ANYHOST for TCP port(s): 80
 Allowing ANYHOST for TCP port(s): 110
 Allowing ANYHOST for TCP port(s): 143
 Allowing ANYHOST for TCP port(s): 443
 Allowing ANYHOST for TCP port(s): 465
 Allowing ANYHOST for TCP port(s): 587
 Allowing ANYHOST for TCP port(s): 993
 Allowing ANYHOST for TCP port(s): 995
 Allowing ANYHOST for TCP port(s): 21
 Allowing ANYHOST for TCP port(s): 22