Crontab Example

Making crontab running is easy only . Here I am going to say how to run crontab jobs. It is useful for anyone who is stuck on crontab. */1 * * * * cd /home/hacks && sh notify.sh To make the script executable, we have to do: chmod +x home/hacks/notify.sh Here i run this script for every one minute ... By doing below script, you can write it in a log file to find whether its working write log */1 * * * * cd /home/hacks && sh notify.sh>>test.log send mail */1 * * * * cd /home/hacks && sh notify.sh>>test.log | mail -s "Hi this is example" user@domain.com

Remove Create Account Link From Login Page/Form on MediaWiki

How can i remove the line "Don't have an account? Create an account." from the login page of my new MediaWiki install.

I want to restrict viewing on my wiki so i have done so, it then makes all users redirect to login form which has a create account link on it. I want people to be able to make accounts but only if they are following the inbound create account link from my main website.

I was wondering the same thing, and eventually found it here:

Your URL/mediawiki/index.php?title=MediaWiki:Userlogin&action=edit


$wgGroupPermissions['*']['createaccount'] = false;

on your LocalSettings.php

/tmp on Linux

I know /tmp as it named is a temporary dircory, Debian policy is to clean /tmp at boot. However, I'd like to configure my Ubuntu Server to stop deleting files from /tmp on boot due to custom configuration issue. How do I configure behavior of boot scripts to stop deleting files on boot?

Users should not store files in /tmp, use /home or other partition, if you would like to keep the files. The behavior of boot scripts is controlled via a special configuration file called /etc/default/rcS. Open this file and modify TMPTIME variable.

On boot the files in /tmp will be deleted if their modification time is more than TMPTIME days ago. A value of 0 means that files are removed regardless of age. If you don't want the system to clean /tmp then set TMPTIME to a negative value(-1) or to the word infinite.

Configuration /etc/default/rcS

Open /etc/default/rcS file, enter:$ sudo vi /etc/default/rcS
Set TMPTIME to 60 so that files in /tmp will deleted if their modification time is more than 60 days ago.TMPTIME=60
Close and save the file. This configuration is used by /etc/init.d/bootclean script on boot to clean /tmp and other directories under all Debian based Linux distros.

Clear memory cache on linux

drop_caches
Writing to this will cause the kernel to drop clean caches, dentries and
inodes from memory, causing that memory to become free.

To free pagecache:
 echo 1 > /proc/sys/vm/drop_caches
To free dentries and inodes:
 echo 2 > /proc/sys/vm/drop_caches
To free pagecache, dentries and inodes:
 echo 3 > /proc/sys/vm/drop_caches

As this is a non-destructive operation and dirty objects are not freeable, the
user should run `sync' first.

Reference : https://www.kernel.org/doc/Documentation/sysctl/vm.txt

Sysctl paramater to prevent DDOS

sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_recv=45

sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=332000

sysctl -w net.ipv4.tcp_fin_timeout=15

sysctl -w net.ipv4.tcp_synack_retries=5

sysctl -w net.ipv4.tcp_fin_timeout=15

sysctl -w net.ipv4.tcp_keepalive_time=1500

sysctl -w net.ipv4.tcp_sack=0

sysctl -w net.ipv4.tcp_max_tw_buckets=1440000

sysctl -w net.ipv4.tcp_max_syn_backlog=2048

sysctl -w net.ipv4.tcp_max_syn_backlog=4096

sysctl -w net.ipv4.tcp_fin_timeout=20

sysctl -w net.ipv4.tcp_keepalive_time=1800

sysctl -w net.ipv4.tcp_fin_timeout=20

sysctl -w net.ipv4.tcp_keepalive_time=1800

sysctl -w net.ipv4.tcp_keepalive_intvl=40

sysctl -w net.ipv4.tcp_tw_recycle=1

sysctl -w net.ipv4.tcp_tw_reuse=1

sysctl -w net.ipv4.tcp_max_syn_backlog=4096

sysctl -w net.ipv4.inet_peer_gc_maxtime=240

sysctl -w net.ipv4.inet_peer_maxttl=500

sysctl -w net.ipv4.inet_peer_minttl=80

Secure server with bash script

#!/bin/bash
#
# modified: 18.08.2013 11:49 AM
#
# sys_tweaks, program check and "permissive rules" are from
# http://www.emoticode.net/bash/iptables-firewall.html

firewall="/sbin/iptables"
net_interface="wlan0"
tcp_ports="21,53,80,443,587,993,6697,7000,9600,9418,51000"
udp_ports="53,80,443,51000"


user_check() {
if [ "$(id -u)" != "0" ]; then
  echo "ERROR: This script must be run as root" 1>&2
  exit 1
fi
}

program_check() {
#Check if firewall exists on system
lsmod 2>/dev/null | grep -q -c ip_tables
if [ $? -ne 0 ]; then
  echo -e "ERROR: Can't find ip_tables module" && sleep 1
  echo "Trying to modprobe ip_tables..."
  modprobe ip_tables
  
  if [ $? -ne 0 ]; then
    tput sgr0
    exit 1
  fi

fi

# Check if firewall exists on system
#if [ ! -e "$firewall" ]
#  then
#    echo "ERROR: $firewall is not available. Do you have iptables or netfilter installed?"
#    exit 2
#  fi
}


sys_tweaks() {
# Try to prevent SYN floods
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# Disable response to ICMP broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Reject source-routed packets
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/default/accept_source_route
# Disable ICMP redirect acceptance
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/default/accept_redirects
# Enable bad error message protection
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Disable send ICMP redirects
echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects
echo "0" > /proc/sys/net/ipv4/conf/default/send_redirects
# Enable reverse path filtering
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter
# Log spoofed packets, source-routed packets, redirect packets
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/conf/default/log_martians
# Disable IP forwarding
echo "0" > /proc/sys/net/ipv4/ip_forward
}


permissive_rules() {
echo '[ .. ] Configuring iptables ports and services (permissive rules)...'

#user check
user_check
# Check if firewall exists on system
#program_check
# flush *all* rules
do_flush
# system tweaks
sys_tweaks

# Drop all incoming fragments
#$firewall -A INPUT -i $net_interface -f -j DROP
$firewall -A INPUT -f -j DROP

# Drop outside packets with localhost address - anti-spoofing measure
$firewall -A INPUT -s 127.0.0.0/255.0.0.0 -i !lo -j DROP

# Pass all locally-originating packets
$firewall -A INPUT -i lo -j ACCEPT
$firewall -A OUTPUT -o lo -j ACCEPT

# Allow inbound established and related outside communication
$firewall -A INPUT -m state --state ESTABLISHED,RELATED -i $net_interface -j ACCEPT

# Drop outside initiated connections
#$firewall -A INPUT -m state --state NEW -i $net_interface -j DROP
$firewall -A INPUT -m state --state NEW -j DROP

# Allow all outbound tcp + udp traffic with state
$firewall -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
$firewall -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
#$firewall -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
}


do_start () {
echo '[ .. ] Configuring iptables ports and services (Paranoia mode)...'

#user check
user_check
# Check if firewall exists on system
#program_check
# flush *all* rules
do_flush
# system tweaks
sys_tweaks

# ftp stuff
#modprobe ip_conntrack
#modprobe ip_conntrack_ftp

# *Do not allow anything*
$firewall -P INPUT DROP
$firewall -P OUTPUT DROP
$firewall -P FORWARD DROP
# Sometimes you can be nice
#$firewall -P FORWARD REJECT

# almighty localhost for web developing and testing
$firewall -A INPUT -i lo -j ACCEPT
$firewall -A OUTPUT -o lo -j ACCEPT

# allow specified ports for TCP and UDP
$firewall -A OUTPUT -p tcp -m multiport --dports $tcp_ports -j ACCEPT
$firewall -A OUTPUT -p udp -m multiport --dports $udp_ports -j ACCEPT
$firewall -A INPUT -p tcp -m multiport --sports $tcp_ports -m state --state RELATED,ESTABLISHED -j ACCEPT
$firewall -A INPUT -p udp -m multiport --sports $udp_ports -m state --state RELATED,ESTABLISHED -j ACCEPT

# Drop outside packets with localhost address - anti-spoofing measure
$firewall -A INPUT -s 127.0.0.0/255.0.0.0 -i !lo -j DROP

# allow all traffic in IP range
#$firewall -A INPUT -s 192.168.1.0/23 -j ACCEPT

#Prevent DDoS?
#$firewall -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# examples for explicitly denying all traffic on port
#$firewall -A INPUT -p udp --dport 22 -j DROP
#$firewall -A INPUT -p tcp --dport 22 -j DROP


# I repeat: *Do not allow anything*
$firewall -P INPUT DROP
$firewall -P OUTPUT DROP
$firewall -P FORWARD DROP
# Sometimes you can be nice
#$firewall -P FORWARD REJECT
}


do_flush () {
echo '[ .. ] Flushing all iptables rules...'

# Check if firewall exists on system
#program_check

$firewall -F
$firewall -X
$firewall -Z
$firewall -t nat -F
$firewall -t mangle -F
$firewall -t filter -F
$firewall -t nat -X
$firewall -t mangle -X
$firewall -t filter -X
$firewall -P INPUT ACCEPT
$firewall -P FORWARD ACCEPT
$firewall -P OUTPUT ACCEPT
}


help () {
echo "$0 - manage iptables rules
usage: $0 action

Actions:
  start      -  use defined (paranoia) iptables rules
  stop       -  flush iptables rules
  permissive -  use permissive mode
  *          -  displays this help and exits"
}


case $@ in
 start      ) do_start ;;
 permissive ) permissive_rules ;;
 stop       ) do_flush ;;
 *          ) help ;;
esac

exit 0

Manual init.d IPTables configuration

Another possibility is to manually configure your firewall rules through an init.d script that will run all the iptables commands. Take the following steps:

• Review the script below and adapt it to your needs.

• Test the script and review the syslog messages to see which traffic is being dropped. If you are testing from the network you will want to either run the sample shell snippet to remove the firewall (if you don't type anything in 20 seconds) or you might want to comment out the default deny policy definitions (-P INPUT DROP and -P OUTPUT DROP) and check that the system will not drop any legitimate traffic.

• Move the script to /etc/init.d/myfirewall

• Configure the system to run the script before any network is configured:
  

       #update-rc.d myfirewall start 40 S . stop 89 0 6 .
  

This is the sample firewall script:

     #!/bin/sh
     # Simple example firewall configuration.
     #
     # Caveats:
     # - This configuration applies to all network interfaces
     #   if you want to restrict this to only a given interface use
     #   '-i INTERFACE' in the iptables calls.
     # - Remote access for TCP/UDP services is granted to any host, 
     #   you probably will want to restrict this using '--source'.
     #
     # chkconfig: 2345 9 91
     # description: Activates/Deactivates the firewall at boot time
     #
     # You can test this script before applying with the following shell
     # snippet, if you do not type anything in 10 seconds the firewall
     # rules will be cleared.
     #---------------------------------------------------------------
     #  while true; do test=""; read  -t 20 -p "OK? " test ; \
     #  [ -z "$test" ] && /etc/init.d/myfirewall clear ; done
     #---------------------------------------------------------------
     
     PATH=/bin:/sbin:/usr/bin:/usr/sbin
     
     # Services that the system will offer to the network
     TCP_SERVICES="22" # SSH only
     UDP_SERVICES=""
     # Services the system will use from the network
     REMOTE_TCP_SERVICES="80" # web browsing
     REMOTE_UDP_SERVICES="53" # DNS
     # Network that will be used for remote mgmt
     # (if undefined, no rules will be setup)
     # NETWORK_MGMT=192.168.0.0/24
     # Port used for the SSH service, define this is you have setup a
     # management network but remove it from TCP_SERVICES
     # SSH_PORT="22"
     
     if ! [ -x /sbin/iptables ]; then  
         exit 0
     fi
     
     fw_start () {
     
       # Input traffic:
       /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
       # Services
       if [ -n "$TCP_SERVICES" ] ; then
       for PORT in $TCP_SERVICES; do
         /sbin/iptables -A INPUT -p tcp --dport ${PORT} -j ACCEPT
       done
       fi
       if [ -n "$UDP_SERVICES" ] ; then
       for PORT in $UDP_SERVICES; do
         /sbin/iptables -A INPUT -p udp --dport ${PORT} -j ACCEPT
       done
       fi
       # Remote management
       if [ -n "$NETWORK_MGMT" ] ; then
         /sbin/iptables -A INPUT -p tcp --src ${NETWORK_MGMT} --dport ${SSH_PORT} -j ACCEPT
       else 
         /sbin/iptables -A INPUT -p tcp --dport ${SSH_PORT}  -j ACCEPT
       fi
       # Remote testing
       /sbin/iptables -A INPUT -p icmp -j ACCEPT
       /sbin/iptables -A INPUT -i lo -j ACCEPT
       /sbin/iptables -P INPUT DROP
       /sbin/iptables -A INPUT -j LOG
     
       # Output:
       /sbin/iptables -A OUTPUT -j ACCEPT -o lo 
       /sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
       # ICMP is permitted:
       /sbin/iptables -A OUTPUT -p icmp -j ACCEPT
       # So are security package updates:
       # Note: You can hardcode the IP address here to prevent DNS spoofing
       # and to setup the rules even if DNS does not work but then you 
       # will not "see" IP changes for this service:
       /sbin/iptables -A OUTPUT -p tcp -d security.debian.org --dport 80 -j ACCEPT 
       # As well as the services we have defined:
       if [ -n "$REMOTE_TCP_SERVICES" ] ; then
       for PORT in $REMOTE_TCP_SERVICES; do
         /sbin/iptables -A OUTPUT -p tcp --dport ${PORT} -j ACCEPT
       done
       fi
       if [ -n "$REMOTE_UDP_SERVICES" ] ; then
       for PORT in $REMOTE_UDP_SERVICES; do
         /sbin/iptables -A OUTPUT -p udp --dport ${PORT} -j ACCEPT
       done
       fi
       # All other connections are registered in syslog
       /sbin/iptables -A OUTPUT -j LOG
       /sbin/iptables -A OUTPUT -j REJECT 
       /sbin/iptables -P OUTPUT DROP
       # Other network protections
       # (some will only work with some kernel versions)
       echo 1 > /proc/sys/net/ipv4/tcp_syncookies
       echo 0 > /proc/sys/net/ipv4/ip_forward 
       echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 
       echo 1 > /proc/sys/net/ipv4/conf/all/log_martians 
       echo 1 > /proc/sys/net/ipv4/ip_always_defrag
       echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
       echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
       echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
       echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
     
     }
     
     fw_stop () {
       /sbin/iptables -F
       /sbin/iptables -t nat -F
       /sbin/iptables -t mangle -F
       /sbin/iptables -P INPUT DROP
       /sbin/iptables -P FORWARD DROP
       /sbin/iptables -P OUTPUT ACCEPT
     }
     
     fw_clear () {
       /sbin/iptables -F
       /sbin/iptables -t nat -F
       /sbin/iptables -t mangle -F
       /sbin/iptables -P INPUT ACCEPT
       /sbin/iptables -P FORWARD ACCEPT
       /sbin/iptables -P OUTPUT ACCEPT
     }
     
     
     case "$1" in
       start|restart)
         echo -n "Starting firewall.."
         fw_stop 
         fw_start
         echo "done."
         ;;
       stop)
         echo -n "Stopping firewall.."
         fw_stop
         echo "done."
         ;;
       clear)
         echo -n "Clearing firewall rules.."
         fw_clear
         echo "done."
         ;;
       *)
         echo "Usage: $0 {start|stop|restart|clear}"
         exit 1
         ;;
       esac
     exit 0

Instead of including all of the iptables rules in the init.d script you can use the iptables-restore program to restore the rules saved using iptables-save. In order to do this you need to setup your rules, save the ruleset under a static location (such as /etc/default/firewall).

Reference : https://www.debian.org/doc/manuals/securing-debian-howto/

Speedtest CLI

$ wget -O speedtest-cli https://raw.github.com/sivel/speedtest-cli/master/speedtest_cli.py
$ chmod +x speedtest-cli
$ ./speedtest-cli
Retrieving speedtest.net configuration...
Retrieving speedtest.net server list...
Testing from Comcast Cable (x.x.x.x)...
Selecting best server based on ping...
Hosted by FiberCloud, Inc (Seattle, WA) [12.03 km]: 44.028 ms
Testing download speed........................................
Download: 32.29 Mbit/s
Testing upload speed..................................................
Upload: 5.18 Mbit/s

IPTables

Here is our iptable rules:

#Name Servers
DNS1=""
DNS2=""

#Default Deny
iptables -P INPUT DROP
iptables -P OUTPUT DROP

#Allow Loopback
iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT

#Deny Bad Pckets
iptables -A INPUT -f -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

#Deny Packets from Invalid Address Space
iptables -A INPUT -s 10.0.0.0/8 -j DROP
iptables -A INPUT -s 127.0.0.0/8 -j DROP
iptables -A INPUT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -s 192.168.0.0/16 -j DROP
iptables -A INPUT -s 224.0.0.0/3 -j DROP

#Allow ICMP(Ping)
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

#Allow DNS
iptables -A OUTPUT -p udp --sport 1024:65535 -d $DNS1 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -s $DNS1 --sport 53 --dport 1024:65535 -j ACCEPT
iptables -A OUTPUT -p udp --sport 1024:65535 -d $DNS2 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -s $DNS2 --sport 53 --dport 1024:65535 -j ACCEPT

iptables -A INPUT -i eth0 -p UDP --sport domain -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p TCP --sport domain -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p UDP --dport domain -m state --state NEW,ESTABLISHE D -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP --dport domain -m state --state NEW,ESTABLISHE D -j ACCEPT

## Allow Selective Inbound Connections

#DNS
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 53 --dport 1024:65535 -j ACCEPT

#HTTP (Web Server)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 --dport 1024:65535 -j ACCEPT

#HTTPS (Web Server)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 --dport 1024:65535 -j ACCEPT

#FTP
iptables -A INPUT -p tcp --dport 21 --sport 1024:65535 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 21 --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 --sport 1024:65535 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20 --dport 1024:65535 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000:3100 --sport 1024:65535 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3000:3100 --dport 1024:65535 -j ACCEPT

#SSH
iptables -A INPUT -p tcp --dport 4777 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 4777 --dport 1024:65535 -j ACCEPT

#SMTP
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 --dport 1024:65535 -j ACCEPT

#Secure SMTP
iptables -A INPUT -p tcp --dport 465 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 465 --dport 1024:65535 -j ACCEPT

#IMAP
iptables -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 143 --dport 1024:65535 -j ACCEPT

#Secure IMAP
iptables -A INPUT -p tcp --dport 993 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 993 --dport 1024:65535 -j ACCEPT

#POP3
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 110 --dport 1024:65535 -j ACCEPT

#Secure POP3
iptables -A INPUT -p tcp --dport 995 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 995 --dport 1024:65535 -j ACCEPT

#cPanel
iptables -A INPUT -p tcp --dport 2082 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2082 --dport 1024:65535 -j ACCEPT

#Secure cPanel
iptables -A INPUT -p tcp --dport 2083 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2083 --dport 1024:65535 -j ACCEPT

#Web Host Manager
iptables -A INPUT -p tcp --dport 2086 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2086 --dport 1024:65535 -j ACCEPT

#Secure Web Host Manager
iptables -A INPUT -p tcp --dport 2087 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2087 --dport 1024:65535 -j ACCEPT

iptables -A INPUT -p tcp -s 0.0.0.0/0 --dport 2087 -j ACCEPT

#Webmail
iptables -A INPUT -p tcp --dport 2095 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2095 --dport 1024:65535 -j ACCEPT

#Secure Webmail
iptables -A INPUT -p tcp --dport 2096 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 2096 --dport 1024:65535 -j ACCEPT

## Allow Selective Outbound Connections

#SMTP
iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --sport 25 --dport 1024:65535 -j ACCEPT

#HTTP
iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 --dport 1024:65535 -j ACCEPT

#HTTPS
iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 --dport 1024:65535 -j ACCEPT

#cPanel Licensing
iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 2089 -j ACCEPT
iptables -A INPUT -p tcp --sport 2089 --dport 1024:65535 -j ACCEPT

#WHOIS
iptables -A OUTPUT -p udp --sport 1024:65535 --dport 43 -j ACCEPT
iptables -A INPUT -p udp --sport 43 --dport 1024:65535 -j ACCEPT

any ideas what we need to change?