Limiting access to your Linux Machine via PAM

I need to limit access to some of services on my Linux box. I'm going to do it via PAM.
I'm using CentOS, so PAM I think installed by default. if not, yum install pam should do.

Limiting SSH Users. Since I have hundreds of users on this box.
>You should be able to edit /etc/pam.d/sshd (meaning, you should be root here). Below is the original file.

#%PAM-1.0
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session required pam_loginuid.so

then just append the line below on that file.

#%PAM-1.0
auth required pam_listfile.so item=user sense=allow file=/etc/listfile/sshusers onerr=fail

Note: the /etc/listfile/sshusers is the file that contains the users list, those whom allowed to access ssh service on the host machine.

If you cant avoid to use telnet service. then append the entry below:

auth required pam_listfile.so item=user sense=allow file=/etc/listfile/loginusers onerr=fail

to the /etc/pam.d/remote file, which the original contents are below:

auth required pam_securetty.so
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_stack.so service=system-auth
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should be the last session rule
session required pam_selinux.so open

and as usual, the file

/etc/listfile/loginusers

are the ones allowed.

As so with other service, its almost the same entry that you should add, just on different file for different service.

Just to remember when doing it again....

IPTABLES script used for chillispot

Got here a backup of iptables for chillispot. Also included and allowed acces to tftp port



#!/bin/bash
IPTABLES="/sbin/iptables"
EXTIF="eth0"
INTIF="eth1"

#Flush all rules
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle

#Set default behaviour
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

#Allow related and established on all interfaces (input)
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 20 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 69 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -p udp -m udp --dport 69 -j ACCEPT


#Allow releated, established and ssh on $EXTIF. Reject everything else.
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 1812 --syn -j ACCEPT

$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --dport 1813 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
$IPTABLES -A INPUT -i eth0 -p udp -m udp --dport 1813 -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -j REJECT

#Allow related and established from $INTIF. Drop everything else.
$IPTABLES -A INPUT -i $INTIF -j DROP

#Allow http and https on other interfaces (input).
#This is only needed if authentication server is on same server as chilli
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT

#Allow 3990 on other interfaces (input).
$IPTABLES -A INPUT -p tcp -m tcp --dport 3990 --syn -j ACCEPT

#Allow ICMP echo on other interfaces (input).
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#Allow everything on loopback interface.
#$IPTABLES -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG

$IPTABLES -A INPUT -i lo -j ACCEPT

# Drop everything to and from $INTIF (forward)
# This means that access points can only be managed from ChilliSpot
$IPTABLES -A FORWARD -p TCP --sport 80 -i $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -j DROP
$IPTABLES -A FORWARD -o $INTIF -j DROP

#Enable NAT on output device
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE