I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. I already disabled all shell access attempts from php. But in order to fully protect myself, my server and my users from downtime, script kiddies and other nasty things I want to disallow RFI. Actually I don't want to allow any traffic (TCP & UDP) going out from my server that I don't allow to. For this task I want to make a transparent proxy that retrieves all packages before they are sent, making decisions if the packages should be allowed or not. I want to use Python for the task of making the decisions as it is easy to fetch allowed URL's from the local database. Like I want to allow certain API's / OAuth sources.

How do I configure iptables to send all data (including destination ip and port), to my python application? Or is there any better way of doing this?

My thought was just that if I can disable shell access and unauthorized network traffic I can sleep at night. Then no one can use my server as a bot in a botnet. And they can't email spam. What do you think?

I don't want to rely upon Suhosin, since I'm using PHP 5.4 and later.


As far as iptables is concerned:

## default policy for OUTPUT
iptables -P OUTPUT DROP

## allow related/established traffic, e.g. for incoming connections

## whitelist some APIs (here
## or package repositories, or your DNS (here, ...
iptables -A OUTPUT -p udp --dport 53 -d -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -d -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -d -j ACCEPT

## other TCP packages go to your script (probably not needed anyway)
iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination

You may also have a look at apparmor to filter out outgoing traffic from PHP instead of writing a proxy script yourself.

Your Answer

