Where is the documentation for portsentry and iptables firewall rules in the most cur

[jteerman]

We have been using a rule set for an couple of years with no issue with cPanel. Since the upgrade to 11.25, something has been disabling the iptables firewall implemented on our network infrastructure. Does cPanel have documentation for these services are so we can adapt our long-established firewall rules to be compatible with what ever has been recently implemented in cpanel 11.25.

Thanks!

 

[jteerman]

service portsentry and iptables restarts not in cron

Additionally, we've done the following to determine what mechanism is causing this issue. We have an identically-configured server running centos5.4: both installed within the past week, the only difference being the one we're concerned about also has cpanel/whm 11.25 installed through the prescribed method.

[email protected] [~]# chkconfig --list | grep ip
ip6tables 0ff 1ff 2ff 3ff 4ff 5ff 6ff
iptables 0ff 1ff 2ff 3ff 4ff 5ff 6ff

[email protected] [~]# chkconfig --list | grep ports
portsentry 0ff 1ff 2ff 3ff 4ff 5ff 6ff

Because this process / service / implementation has been disabling our designed firewall, we chmod-ded /etc/init.d/iptables 000:
[email protected] [~]# ls -lrt /etc/init.d/ | grep iptables
---------- 1 root root 7460 Nov 2 07:18 iptables

This service has now been throwing the following error with subject line at 3, 23, and 43 minutes after the hour:
Subject: Cron <[email protected]> /sbin/service portsentry restart >/dev/null && /sbin/service iptables restart >/dev/null
iptables: unrecognized service

[email protected] [~]# grep -E 'portsentry|iptables' -rl /var/spool/cron
[email protected] [~]# crontab -l | grep -E 'portsentry|iptables'

There are no references in /etc/crontab or any other cronjob entries to jobs that start at 3, 23, and 43 minutes after the hour, but we're quite positive it is a cpanel cronjob that is doing this.

Our custom firewall runs fine. The only rules in existence that we have not flushed are the following:
Chain acctboth (0 references)
pkts bytes target prot opt in out source destination
99 5927 tcp -- !lo * www.xxx.yyy.zzz 0.0.0.0/0 tcp dpt:80
62 10583 tcp -- !lo * 0.0.0.0/0 www.xxx.yyy.zzz tcp spt:80

What causes this job to run? How do we disable it as we consider deploying additional cpanel hosts? Where is the documentation for the portsentry implementation on whm/cpanel 11.25?