Alex Scoble's IT Notes - An Information Technology Blog

Restoring a MySQL database from files

If you are a relative MySQL newbie like me, and someone tells you to backup your databases, you might make the same mistake that I did and copy the database files (all of those .frm, MYD and .MYT files) to a backup folder instead of using MySQL's built in backup method.

Of course, when you make this kind of mistake, often you are required to restore from backups, so you copy the files back to their original location and MySQL bombs on you when you try to start it.

In my case, I backed up the entire /var/lib/mysql directory to /tmp/mysql-backups. When I copied the /tmp/mysql-backups stuff back to /var/lib/mysql, nothing worked. Doing a 'cat /var/log/mysqld.log' showed a "Can't find file: './mysql/plugin.frm' (errno: 13)" error.

Turns out that you have to reset permissions on those files and do some work with SELinux to get that to allow the mysql account to access the databases.

This help is specific to MySQL using InnoDB on CentOS 6.x. I have no way of knowing if it will work for any other configurations.

Here's how to restore your databases and reset the permissions assuming that you have a backup of the entire /var/lib/mysql directory. I'm going to do a bunch of similar chown/chmod statements below just to be sure. You could do the same thing by doing
'chown -R mysql:mysql <directory>' and you'll want to do the separate commands for chmod since the directories and files should have different allowed operations.

rm -rf /var/lib/mysql
mkdir /var/lib/mysql
cp -r /tmp/mysql-backups/* /var/lib/mysql
chown mysql:mysql /var/lib/mysql
chown mysql:mysql /var/lib/mysql/*
chmod 660 /var/lib/mysql/*
chown mysql:mysql /var/lib/mysql/mysql
chmod 700 /var/lib/mysql/mysql
chown mysql:mysql /var/lib/mysql/mysql/*
chmod 660 /var/lib/mysql/mysql/*

Do the chown and chmod commands as shown for any other directories that you have under /var/lib/mysql

If you tried to start mysql right now, you'd still get the same error though if you have SELinux turned on, so now we have to fix that.

chcon -v --type=mysqld_db_t /var/lib/mysql
chcon -v --type=mysqld_db_t /var/lib/mysql/*
chcon -v --type=mysqld_db_t /var/lib/mysql/mysql
chcon -v --type=mysqld_db_t /var/lib/mysql/mysql/*

And so forth for any directories that you have under /var/lib/mysql

If you started mysql now, you'd see this error now "[ERROR] Can't start server : Bind on unix socket: Permission denied". SELinux is still blocking access so now you have to do the following:

semanage fcontext -a -t mysqld_db_t "/var/lib/mysql(/.*)?"
restorecon -Rv /var/lib/mysql

It is likely that you will only have to do the 'restorecon' command above, but I'm being thorough here.

You can now start the mysql service ('service mysqld start') and it should work without issues.

Patching is killing Windows (AKA the problem that Microsoft MUST solve in order to remain competitive)

I wrote a blog post back in 2005 on my Computerworld blog detailing 4 things that I thought that Microsoft needed to fix in Windows in order to remain competitive. Unfortunately, the biggest thing on that list, the land of a thousand reboots, hasn't gotten much better.

Right now, one of my main functions at my job is to manage patches for nearly a thousand Windows systems. "Pain in the ass" doesn't even begin to describe the difficulties of patching that many Windows servers and workstations.

First off, you can't do it without an enterprise tool like LANDesk, Secunia, GFI LANGuard, Microsoft SCCM, etc. These tools are big, complex, hard to manage and typically require agents which often have their own issues.

Second, the number of third party apps that you have to track and patch is significant and growing. Because of compliance requirements, some organizations have to assess every single "security patch" for applicability. To do this, you have to know every piece of software that you have installed in areas requiring compliance and you have to regularly search for security updates to all of those applications. Yes, it is as laborious and mind numbing as it sounds. I have a lot of fun at my job, but this area is totally not intellectually stimulating at all.

Third, because of the fact that Windows patches require a reboot, scheduling downtime of critical production systems can be a total nightmare.

I should mention right now that Linux does all of this far better. If you pick your tools right (limit the tools that can't be installed from a repository), you manage all of your patching from one place. Yum for RedHat/CentOS or Aptitude for Debian. If your server is headless (who needs a GUI that takes up all of those resources and adds another 200 packages that need to be updated), patching a brand new server up to current takes minutes and requires ZERO reboots. It's as easy as typing "yum update". Since it can be used to track what security patches are applicable for each system, there's no research that needs to be done on just about anything other than the stuff that you installed from source.

Linux is quite simply light years ahead of Windows in this area. It is probably the main reason that I'm getting into Linux so much of late.

It sometimes takes over an hour to install a service pack on a Windows server. I can build up a new Linux server and fully patch it in less time. In fact, I can build up a new server with the LAMP stack, install an app on top of that (for log management, for instance) AND fully patch it in less time.

It's no wonder that Microsoft's share of datacenter systems has remained weak and will continue to slide. This situation is unacceptable. Even with clustering, which is expensive, hard to maintain and requires a lot more hardware, Microsoft can't maintain the kind of uptime that Linux is able to. Because guess what, patching invariably BREAKS your cluster.

On Windows 7, it can take over an hour to fully patch a new laptop or workstation and thats with SP1 already installed.

Even a shark with a congested nose can smell the blood in the water.

Linux administrators are able to perform patch management on their systems without buying expensive tools, without wasting a lot of time performing CVE and NVD searches for their apps, with a minimal amount of downtime and with significantly lower risk to their systems. Not to mention that it's much easier to deal with patching of systems isolated from the internet because you can build your own repositories.

Microsoft will continue to bleed marketshare and loyal customers like me until they solve this problem.

It will likely take a complete rewrite of Windows to do it, but given that the survival of the company depends on it, at least in my opinion, it would be stupid of them not to do it and soon.

I won't hold my breath though.

Dear Bill Gates, features and fixes I'd like to see in next Windows

This was originally posted to my ComputerWorld blog back in 2005, but as some of it is still pertinent today, I'm recreating it here. 

I'm sure that anyone who's used Windows has at least one pet peeve that they'd like to see fixed. As much as I like Windows (at least in its latest incarnation), I'm no exception.

What's more annoying is that some issues have been around for several versions of Windows (Office too).

OK, so let's get to it! Here's my list of things I'd like to see changed in Windows Mountain View (sorry, still can't call it what Microsoft wants to call it -psst...Windows Vista-...hurts my fingers just thinking about typing it).

1. Focus, focus focus! 

The way Windows changes focus, or how it designates what is the current active window, has been an annoyance of mine for a while now. 

For example, you are working on something, a Word document for instance, you need to reference a web page, so you click on the Firefox icon (or IE) in the Quick Launch bar and get back to typing your current thought stream on the Word document, when all of a sudden mid-sentence, you realize that you are now on your homepage in Firefox. Exasperated, you sigh, click back on your Word document and retype the thought stream from the point where Windows, thoughtfully, changed the active window.

Hey Microsoft, here's a hint for you in as plain english as I can make it: Never, ever, never, ever, ever, ever, never, ever, ever, ever, ever change focus from the window that I'm WORKING on until I EXPLICITY COMMAND Windows to do so!!!!

I don't CARE what your usability testing shows you, I work in specific ways and it would be MOST APPRECIATIVE if I was given the choice on how Windows handles change of focus.

2. I'm the boss!! 

I'm trying to delete files, a lot of them, from the Temp directory for instance. Windows pops up an error window telling me that the file is in use and can't be deleted. It doesn't tell me the specific app that is holding the file open. It doesn't ask me if I want to delete it anyways and it doesn't give me the choice to continue the file delete with the next file. LAME! 

Give me the choice, I don't care how hidden it is, as long as it's there and documented. Unless the file is a required system file, ask me if I want to disconnect the app's connection to the file and delete the file. 

Let me continue the delete from the next file chosen. 

Give me choice! Give me control! Give me more information! Gimme, gimme, gimme!

3. Major Tom to Ground Conrol.

An error comes up when I'm running an application. An error is in the event viewer. I'm having problems performing a specific task (such as trying to connect to console session of a Windows 2003 Server using RDP).

Where's the info in the event logs? Why are you making me click on a link to find out what the error means? Why is there nothing in the event logs at all? Why is the error not listed anywhere in the knowledge base with the same context as my error?

Windows should do a much better of job of telling the user (and an even better job of telling the admin) what's going on under the hood. What does the error mean, why is that application not starting, what's causing my inability to connect to another system's event logs.

I shouldn't have to download support tools in order to drill down to the lower levels of what's going on in Windows. It should tell me.

All error codes should translate into real english messages in the event viewer. All problems should be logged somewhere, or Windows should ask the user if they'd like the problem to be thoroughly added to the event log and Microsoft should at least let customers know that their problem is known even if there's not currently a fix.

Microsoft could even go the extra mile and ask the user if they'd like to be notified if a fix is created for their particular issue.

4. Welcome to the land of a thousand reboots.

So you install a new app, Windows asks you to reboot. You install a new driver for your printer, Windows asks you to reboot. You install a new security update, Windows asks you to reboot. You sneeze, Windows asks you to reboot. You run into a problem, so you reboot. Reboot, reboot, reboot after reboot.

I think you get the idea even if I have exaggerated the issue, but not by much. Sometimes it feels like I spend half my life waiting for systems to reboot. Perhaps it's not quite that much, but it's still too much. 

Even with all the improvements that Microsoft has made in this area it's still not enough. Linux only needs to be rebooted for kernel updates (as far as I know, perhaps Martin MC Brown could shed more light on this), in other words, very very rarely.

With the amount of updates, patches and security fixes that Microsoft puts out for Windows, the reboot requirements are way too high. The only way to get ultra high reliability with Windows currently is to run it in clusters. This is simply not acceptable for small businesses that can't afford double the servers and licenses.

Because we can't afford double the hardware and software is no excuse for us not to have high levels of uptime.

These are just 4 of the issues that I have with Microsoft. To some they might seem minor, but in my line of work, I am bumping up against these problems almost every day.

Microsoft is starting to bump up against competitors in the consumer sector and business sector. In light of this, I would suggest to Microsoft and all of its employees, that good enough isn't. New features aren't enough. You have to be better than your competitors, some of whom offer their products for free, far better. You just about have to be perfect.

You have a long way to go. And Windows Vista better be the next big leap instead of the next small step.

Installing Zabbix agent on Debian

I could not find a tutorial that showed how to install the precompiled Zabbix 2.0 agents on a 64 bit Debian box, so I'm making one here.

The latest downloads for precompiled agents and source code for building servers is here. http://www.zabbix.com/download.php

On the Debian system that is getting the agent (remember this is for 64 bit version of Debian, go to the Zabbix download site for the link to the 32 bit agent if your system is 32 bit):

We need both the precompiled agent and the source files

You should be logged in to a root sudo or su session for the following

cd $HOME

wget http://www.zabbix.com/downloads/2.0.0/zabbix_agents_2.0.0.linux2_6_23.amd64.tar.gz

wget http://downloads.sourceforge.net/project/zabbix/ZABBIX%20Latest%20Stable/2.0.0/zabbix-2.0.0.tar.gz

mkdir zabbix

cd zabbix

tar -xzvf ../zabbix_agents_2.0.0.linux2_6_23.amd64.tar.gz

tar -xzvf $HOME/zabbix-2.0.0.tar.gz

cp $HOME/zabbix/bin/* /usr/bin

cp $HOME/zabbix/sbin/* /usr/sbin

groupadd zabbix

useradd -g zabbix zabbix

mkdir /var/log/zabbix-agent

chown zabbix:zabbix /var/log/zabbix-agent

nano /usr/local/etc/zabbix_agent.conf

Change "Server=127.0.0.1" option to the IP address of your Zabbix server, for example:

Server=192.168.1.10

Exit and save the file

nano /usr/local/etc/zabbix_agentd.conf

Change "LogFile=/tmp/zabbix_agentd.log" to:>/P>

LogFile=/var/log/zabbix_agentd.log

Change "Server=127.0.0.1" option to the IP address of your Zabbix server, for example:

Server=192.168.1.10

Change "ServerActive=127.0.0.1" option to the IP address of your Zabbix server, for example:

ServerActive=192.168.1.10

Rem out the "Hostname=Zabbix server" line:

#Hostname=Zabbix server

Exit and save the file

nano /etc/init.d/zabbix-agent

#! /bin/sh
  counter=0
  zabbix_counter=$(ps -ef | grep zabbix_agentd | grep -v grep | wc -l)
  
  start(){
  echo "-------------------------------------------------------------------"
  echo " LAUNCHING ZABBIX AGENT"
  
  if [ $zabbix_counter -gt 0 ]; then
  echo " * Zabbix agent was previously running"
  echo " * Number of Zabbix agentd instances= $zabbix_counter"
  echo "-----------------------------------------------------------------"
  fi
  
  # Checking if the user is able to start the agent.... if the user is not able to, script performs su to
  # the user zabbix and starts the agent
  
  if [ $(whoami) != "zabbix" ];then
  sudo -u zabbix zabbix_agentd
  else
  # Script is acting as the zabbix user, so it can start the agent.
  zabbix_agentd
  fi
  sleep 10
  
  zabbix_counter=$(ps -ef | grep zabbix_agentd | grep -v grep | wc -l)
  if [ $zabbix_counter -gt 0 ]; then
  echo " * Zabbix agent succesfully started"
  echo " * Number of zabbix agentd instances= $zabbix_counter"
  echo "-------------------------------------------------------------------"
  else
  echo " * Zabbix agent couldn't be started, check Zabbix logs"
  echo "-------------------------------------------------------------------"
  fi
  
  }
  
  stop(){
  # Checking if the user is able to stop the agent.... if the user is not able to, script performs su to
  # the user zabbix and kills the agent. Also script tries to kill zabbix-agent processes 5 times using a counter, if at
  # the fith try the agent is still there, script outputs a message to the console.
  
  echo "-------------------------------------------------------------------"
  echo " STOPPING ZABBIX AGENT"
  
  if [ $zabbix_counter -eq 0 ]; then
  echo " * Zabbix agent was not running on this machine"
  echo "-------------------------------------------------------------------"
  fi
  
  while [ $zabbix_counter -gt 0 ] && [ $counter -lt 5 ] ; do
  
  let counter=counter+1
  
  echo " * Number of Attempts (Max 5)=$counter"
  echo " * Stopping zabbix.."
  echo " * Number of zabbix agentd instances= $zabbix_counter"
  
  if [ $(whoami) != "zabbix" ];then
  sudo -u zabbix killall zabbix_agentd > /dev/null &
  else
  killall zabbix_agentd > /dev/null &
  fi
  
  sleep 10
  # Script has a 10 second delay to avoid attempting to kill a process that is still shutting down. If the script
  # can't kill the processes, an error will appear.
  # After 10 seconds script checks again the number of zabbix_agentd processes running,
  # if it's 0, script will exit the loop and continue on
  
  zabbix_counter=$(ps -ef | grep zabbix_agentd | grep -v grep | wc -l)
  
  done
  
  if [ $zabbix_counter -gt 0 ]; then
  echo " * Zabbix agent couldn't be stopped, check Zabbix logs"
  echo "-------------------------------------------------------------------"
  fi
  
  if [ $zabbix_counter -eq 0 ]; then
  echo " * Zabbix agent successfully stopped"
  echo "-------------------------------------------------------------------"
  fi
  
  }
  
  restart(){
  stop
  # Gives system some time to stop processes before script restarts service
  sleep 10
  # Now script can start the agent again
  start
  }
  
  case "$1" in
  start)
  start
  ;;
  stop)
  stop
  ;;
  restart)
  restart
  ;;
  *)
  echo "Usage: zabbix {start|stop|restart}"
  exit 1
  esac
  
  exit 0

Exit and save the file

chmod 744 /etc/ini.d/zabbix-agent

ln -s /etc/init.d/zabbix-agent /sbin/zabbix-agent

update-rc.d zabbix-agent defaults

Go to your Zabbix server's web interface and add the new system to hosts as you normally would and configure accordingly and you are done.

References:

http://www.zabbix.com/forum/showthread.php?p=103244#post103244

Fix for Word not properly displaying Visio drawing lines

I work with Word and Visio a bit for incorporating network diagrams into documents. By default, Word will munge dashed lines of a Visio drawing when the drawing is embedded into Word and this is of course highly annoying when you are embedding Visio drawings with dashed lines into Word.

After some searching I found out that this is known behavior because of the way that Visio saves longer lines to save space, but there is a registry hack to fix the problem.

Go into the registry and 

Locate, and then click the following registry key:
Visio 2007 - HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application
Visio 2003 - HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Visio\Application

On the Edit menu, point to New, and then click DWORD Value. Type MetafileDashLineAsSolid, and then press ENTER.

Make the value of that key 1 instead of 0 (2 is the default behavior, but 1 fixes the problem) and there you have it.

Now when you insert Visio drawings into Word as embedded objects, your dashed lines will show up correctly and will print properly as well.

This fix is based on the information in the Microsoft KB 837294 article.

A good starting point for researching Security Information and Event Management (SIEM) tools/services

Recently, I've been doing research on tools for log management and SIEM (Security Information and Event Management). As anyone who's ever been part of selecting an enterprise can testify, it's quite the daunting task.

Enterprise tools are BIG, as in they have a footprint larger than a brontasaurus, typically require a lot of work to get them set up to where they are useful and usable and they aren't any good unless someone (sometimes a small team is required) is managing them on a daily basis. Figuring out which tool best meets your needs is just as large of an endeavour.

Sometimes it can be hard to figure out just where to start, so you do some Google searches trying to find what SIEM tools are on the market, and maybe you do some searches for open source products that are up to the task and if you are lucky, you'll hit on one of Dr. Anton Chuvakin's blog posts on the subject.

He is definitely an expert in the field and currently works at Gartner doing analysis for them on the subject.

You'll also notice, if you pay close attention, that he's got a great sense of humor (and apparently likes Cognac).

Some notable blog posts of his that I think are required reading to anyone who is looking to purchase a SIEM tool are:

Top 10 criteria for a SIEM? - He goes against his better instincts and writes an informative blog post on excellent criteria, in my opinion, for beginning your assessments of the various SIEM tools

On choosing a SIEM - Here he provides some questions that a security analyst, business exec or IT manager should ask before they even begin looking for a SIEM...the questions are quite insightful and get to the heart of the matter of "do we really need this functionality?" and, more importantly, "do we have the resources to support it and make it successful?"

The myth of SIEM as "analyst in a box" - A good blog post in his series on how not to choose a SIEM. Basically, it boils down to if you don't have a security analyst or analysis team on staff already, you better get one before deploying a SIEM or your effort will be a complete failure.

Happy reading!

Enterprise Linux tools need packaging

With few exceptions (Puppet being one of them, because it just rocks) open source enterprise tools need to be packaged and available in one of the mainstream repositories (even EPEL is good enough! The bar isn't that high!) or your tool just isn't ready for primetime.

Looking at you Plone, LogAnalyzer, nxLog and LogStash! OSSEC gets a pass, but just barely because they are using the funky Atomic repo.

This is where tools like Zabbix and OSSIM come out ahead. The last thing you want to be doing when managing an enterprise, particularly in the industrial control space because of the funky requirements, is worrying about manually updating ANYTHING.

Really, the only reason why Puppet gets a pass is because it's so hugely useful in an enterprise.

And no, I don't want a bunch of excuses on why your tool isn't in a repository, whether it's for Debian, Ubuntu or the Red Hat side of things. If it's not available as a managed package, chances are your tool isn't going to be deployed by me or other IT people like me...and we tend to be a very stodgy group.

Linux would not have protected the Iranians against Stuxnet

Interesting discussion going on over at Google+ about the ramifications of Stuxnet and Flame. 

One part of the conversation is completely *facepalm*/smh (shaking my head) worthy, though. Someone brought up the extremely ludicrous notion that Linux would have protected the Iranians against Stuxnet and Flame. Linux totally would not have given the Iranians any extra protection.

The Stuxnet attacks are highly sophisticated and targeted and were able to get through every layer of the Iranian infrastructure to get embedded within the centrifuge controls. Flame, at least as far as I can tell, may have been used to provide the reconnaissance needed in order to build Stuxnet. It wouldn't have mattered what types of computers and OSes the Iranians used. The attackers would have just found vulnerabilities in any of them and developed exploits accordingly.

These hacks were very difficult to defend against and would have required a very thorough "defense in depth" strategy with a dedicated staff of security analysts to monitor and analyze network, OS and application logs and health. Even then, given the fact that spies were involved, It would have been an uphill battle to stop these attacks from succeeding.

There are certainly advantages that Linux gives to organizations within datacenters. Protecting them against highly advanced and targeted threats that exploit unknown weaknesses is not one of them, in my opinion.

Use LastPass tool to check if your LinkedIn password was compromised

I've recently become a big fan of LastPass as a "cloud based" password management tool and have been using it to secure my identities on various sites by randomizing the password and storing it within LastPass.

As you may or may not know, LinkedIn recently was the victim of a successful attack which resulted in the compromise in a significant number of accounts. My account was among them and I verified it using this tool that LastPass created.

It's good to know that companies like LastPass are doing valuable things within the consumer security space.

If you haven't changed your LinkedIn password within the last week, please use the tool to see if it was compromised, although you should change your password anyhow.

And if you aren't already a LastPass user, now would be a good time to start. For just $12 a year, you can have it manage your passwords, store them in encrypted and hashed form on their infrastructure and sync up the password vault to your PC, Mac, iPad, iPhone, Android phone, etc. I highly recommend using this or similar services to manage your passwords. Your identity should be protected and you can't do it by using a weakly generated password that you use for multiple sites. Have LastPass generate a strong password (at least 20 characters, 32 where possible) for your sites and manage the passwords for you.

You'll be glad you did.

Configuring iptables to log network traffic

For security as well as debugging purposes, it's a good idea to log the inbound, outbound, invalid and dropped packets that flow through the network interfaces on your linux systems. This is part one of a series with the rest, such as how to configure rsyslog.conf, to come later.

I was having problems getting iptables to log packets like I wanted, so I did some research on Google and found this post by Toast Research that detailed a good method for building your iptables modularly to allow for logging of packets.

Then I modified what they had done and came up with my own file and here it is. It is set up to allow port 80 through as well as ICMP pings, SSH connections, syslog messages and traffic from your Puppet server.

Just do 'nano /etc/sysconfig/iptables' when logged in as root (using 'sudo su -' of course) to modify your file to do what you want it to do.

The three digit numbers are there to allow for automated building of iptables files using DevOps systems like Puppet or Chef. The benefit to that is that you'd manage the iptables file at the enterprise level and these systems keep an audit trail of changes made and also ensure that systems stay properly configured. If someone were to change an iptables file managed by one of the DevOps systems, the DevOps system will revert to the proper file. That's the power of DevOps.

As you can see, the file is broken up into modules with the header defining what those modules are and the various rules either accept, log, drop or send packets further on down the chain.

# 001
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:invaliddrop - [0:0]
:loginaccept - [0:0]
:logoutaccept - [0:0]
:logdrop - [0:0]

# 002
# Accept all loopback connections
-A INPUT -i lo -j ACCEPT

# 003
# Forward all invalid packets to invaliddrop
-A INPUT -m state --state INVALID -j invaliddrop

# 004
# Forward all established connections to loginaccept
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j loginaccept

# 005
# Forward all icmp packets to loginaccept-A INPUT -p icmp -j loginaccept

# 006
# Forward these allowed input rules to loginaccept
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j loginaccept
-I INPUT -p tcp --dport 514 -s <your ip range here>/24 -j loginaccept
-I INPUT -p udp --dport 514 -s <your ip range here>/24 -j loginaccept
-I INPUT -p tcp --dport 8140 -s <your puppet server here> -j loginaccept
-I INPUT -p tcp --dport 61613 -s <your puppet server here> -j loginaccept

# 007
# Accept these rules without logging or forwarding them to loginaccept for logging
-I INPUT -m state --state NEW,ESTABLISHED -p tcp --dport 80 -j loginaccept

# 008
# Cleanup rule
-A INPUT -j logdrop

# 009
# Allow outbound loopback traffic
-A OUTPUT -o lo -j ACCEPT

# 010
# Forward all outbound traffic to logoutaccept
-A OUTPUT -j logoutaccept

# 011
# Drop all invalid packets (invaliddrop chain)
-A invaliddrop -j LOG --log-level 4 --log-prefix "IPTablesInvDrop: "
-A invaliddrop -j DROP

# 012
# Log accepted incoming packets at a rate of 2 per minute (loginaccept chain)
-A loginaccept -m limit --limit 2/min -j LOG --log-level 4 --log-prefix "IPTablesInAccept: "
-A loginaccept -j ACCEPT

# 013
# Log accepted outgoing packets at a rate of 6 per hour(logoutaccept chain)
-A logoutaccept -m limit --limit 6/hour -j LOG --log-level 4 --log-prefix "IPTABLESOutAccept: "
-A logoutaccept -j ACCEPT

# 014
# Drop all blocked packets (logdrop chain)
-A logdrop -j LOG --log-level 4 --log-prefix "IPTABLESDropped: "
-A logdrop -j DROP
COMMIT

Customize as needed.