Tag: only

RANCID with Junos Read-Only User

Here is the setting for a Junos device to create a user with read only privileges to allow RANCID to work.

[plain]
set system login class RANCID permissions access
set system login class RANCID permissions admin
set system login class RANCID permissions firewall
set system login class RANCID permissions flow-tap
set system login class RANCID permissions interface
set system login class RANCID permissions network
set system login class RANCID permissions routing
set system login class RANCID permissions secret
set system login class RANCID permissions security
set system login class RANCID permissions snmp
set system login class RANCID permissions storage
set system login class RANCID permissions system
set system login class RANCID permissions trace
set system login class RANCID permissions view
set system login class RANCID permissions view-configuration

set system login user rancid full-name RANCID
set system login user rancid class RANCID
set system login user rancid authentication encrypted-password “xxx”
[/plain]

IPTables Template

So I thought I would share a good IPTables starting template, all tested on Ubuntu 10.10.

[plain]

# Cooper Lees IPTables Rules
# Last Updated 20110409

# Drop by default
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
#ICMP is Good
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
# Only allow 4 new SSH connection per minute from a certain IP address
iptables -A INPUT -p tcp –dport 22 -m state –state NEW -m recent –set
iptables -A INPUT -p tcp –dport 22 -m state –state NEW -m recent –update –second 60 –hitcount 4 -j DROP
iptables -A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
# Handy if you have a IPv4 to IPv6 Tunnel …
iptables -A INPUT -p 41 -s ${IPv4-Tunnel-Address} -j ACCEPT
# Handy for debuging what is getting blocked …
iptables -A INPUT -j LOG –log-level debug –log-prefix "iptables INPUT: "
iptables -A INPUT -j REJECT –reject-with icmp-host-prohibited

[/plain]
– Load from CLI then use iptables-save > /etc/iptables.up.rules
– In Ubuntu add to /etc/network/interfaces “pre-up iptables-restore < /etc/iptables.up.rules" on to the loopback interface