Instalacion de un Brute Force Detection Centos

how to install APF (Advanced Policy Firewall)

-:( what is ):-
please take a look at this.


-:( installing apf ):-

[root@centoz ~]# mkdir download
[root@centoz ~]# cd download
[root@centoz download]# wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
[root@centoz download]# tar -xzf apf-current.tar.gz
[root@centoz download]# cd apf-9.7-1/
[root@centoz apf-9.7-1]# ./install.sh

-:( configuring apf ):-

[root@centoz apf-9.7-1]# vi /etc/apf/conf.apf

++++[ example in and outbound ]+++++

# Common inbound (ingress) TCP ports
IG_TCP_CPORTS="21,22,25,53,80,443,110,143,6000_7000"

# Common inbound (ingress) UDP ports
IG_UDP_CPORTS="53"

# Outbound (egress) filtering
EGF="1"

# Common outbound (egress) TCP ports
EG_TCP_CPORTS="21,25,80,443,43"

# Common outbound (egress) UDP ports
EG_UDP_CPORTS="20,21,53"

++++++++++++++++++++


-:( starting apf service ):-

[root@centoz apf-9.7-1]# /usr/local/sbin/apf -s

after apf started, please set DEVEL_MODE="1" to "0" for automatically clearing stop firewall every 5 minutes from cron.

[root@centoz apf-9.7-1]# vi /etc/apf/conf.apf

+++++++++

DEVEL_MODE="0"

++++++++


-:( configure apf rules ):-

[root@centoz apf-9.7-1]# vi /etc/apf/deny_hosts.rules

+++[ add ip address for denied ]++++

# deny ip host
10.100.100.2

# deny ssh connection
tcp:in:d=22:s=0/0
out:d=22:d=0/0

++++++++++

[root@centoz apf-9.7-1]# vi /etc/apf/allow_hosts.rules

++++[ add ip address for allowed ]++++

# allow ip host
10.100.100.33

# allow ssh connection from host
tcp:in:d=22:s=10.100.100.33
out:d=22:d=10.100.100.33

++++++++++++++++


-:( restart apf service ):-

[root@centoz apf-9.7-1]# /usr/local/sbin/apf -r

-:( add apf service on booting ):-

[root@centoz apf-9.7-1]# chkconfig --level 2345 apf on

-:( take a look apf log ):-

[root@centoz apf-9.7-1]# tail -f /var/log/apf_log