Firstly, the registration agency allows to use both methods parallel. But the authinfo method is much more secure. It decreases the risk to transfer domains to unauthorized persons, because of the generated authinfo password.

How does it work:

If you are the owner of a .de domain and want to transfer it from a webhoster to another, than you have to follow these steps:

• Send your present hoster a notice of cancellation with the intention to do a provider change. The present hoster needs this sheet to get the admission for unlocking the domain.
• The present hoster will send you an automatic generated password (authinfo)
• Take the order at the future contractor with the note, that the domain isn’t a new one but a transfer domain
• Put the authinfo code wich got from present hoster into the appropriate order field of the future hoster.
• The transfer will be done, when the two passwords matches

Image by DENIC

Helpful links:

• http://www.denic.de/de/denic/presse/press_91.html [german]
• http://www.denic.de/en/denic/presse/press_91.html [english]

Open your /etc/ssh/sshd_config
Changing the port:

# This is the sshd server system-wide configuration file. See sshd(8)
# for more information.

# change the port configuration – for example to 2233
Port 2233
Protocol 2

And blocking user root

#
PermitRootLogin without-password
PermitRootLogin no
#

You need to restart the sshd script with /etc/init.d/sshd restart Please stay logged in as root, before you’ve tested the new ssh – connect with a second console.

Now create an user account with lower permissions than root. Use this account to connect your server via ssh, followed by the “su” command to get root permissions.


useradd -u 999 -g 100 remotessh -d /home/remotessh -s /bin/bash


Connecting your server with the new port:

ssh -P 2233 yourserver.com -l remotessh


Setting up a firewall with iptables to improve systems security will bei shown in this article

Helpful links:

• Using keychains to avoid typing passwords again and again.
  http://blog.synatic.net/2008/3/29/easy-ssh-authentication-with-keychain.
• A nice how-to for creating strong passwords:
  http://www.thegeekstuff.com/2008/06/the-ultimate-guide-for-creating-strong-passwords/

First thing to do is installing neccessary packages, for Ubuntu / Debian:
apt-get update
apt-get install iptables

When the package is installed, create a file inside /etc/init.d/ called iptables (or whatever you want). Copy paste the lines below into.


########################################
#!/bin/sh
# iptables start/stop script
# location /etc/init.d/iptables
########################################

if ! [ -x $TABLEBIN ]; then
echo "IPTABLES does not exists"
exit 0
fi


With the INPUT/OUTPUT section, you’re able to define your services like http or smtp for remote access. Chmod file to 755 and ensure root to be the owner.


chmod 755 /etc/init.d/iptables
chown root:root /etc/init.d/iptables

Check and try the script. If iptables isn’t installed correctly, you wil get an error statement. Next step, calling iptables statements. Append following lines into the iptables script:


#
# start firewall
#
fw_start ()
{
# deny all
$TABLEBIN -P INPUT DROP
$TABLEBIN -P OUTPUT DROP
# common
$TABLEBIN -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$TABLEBIN -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

if [ -n "$OUT_UDP_SERVICES" ] ; then
for PORT in $OUT_UDP_SERVICES; do
$TABLEBIN -A OUTPUT -p udp --dport ${PORT} -j ACCEPT
done
fi
}


The ssh port is binded to another one, because of improving security.
The last step to complete the script is the stopping call:


#
# stop firewall
#
fw_stop ()
{
$TABLEBIN -F
$TABLEBIN -t nat -F
$TABLEBIN -t mangle -F
$TABLEBIN -P INPUT ACCEPT
$TABLEBIN -P FORWARD ACCEPT
$TABLEBIN -P OUTPUT ACCEPT
}

case "$1" in
start)
echo -n "starting firewall.."
fw_stop
fw_start
echo "done."
;;
stop)
echo -n "stopping firewall.."
fw_stop
echo "done."
;;
*)
echo "Usage: $0 {start|stop}"
exit 1
;;
esac
exit 0


Now you start your iptables script with
/etc/init.d/iptables start
/etc/init.d/iptables stop

To start the script on booting process, put into the runlevel configuration (Debian/Ubuntu):


update-rc.d timWall start 40 S . stop 89 0 6 .


Be careful!! Test it before manually, because you could block yourself out of the system. Firewall architecture with a DMZ:

Source: http://www.basic-security.com/MEDIA/US/RESEAU-DMZ.jpg

Useful links:

• (iptables – Die Firewall des Kernel 2.4 von Wolfgang Kinkeldei)
  http://www.pro-linux.de/NB3/artikel/2/print/761/6,6iptables-die-firewall-des-kernels-24.html
• (iptables script generator from Tarjei Mandt)
  http://www.mista.nu/iptables/