1 |
<?xml version='1.0' encoding='iso-8859-1'?> |
<?xml version='1.0' encoding='UTF-8'?> |
2 |
|
|
3 |
|
|
4 |
<!DOCTYPE guide SYSTEM "/dtd/guide.dtd"> |
<!DOCTYPE guide SYSTEM "/dtd/guide.dtd"> |
5 |
<guide link = "/doc/en/gentoo-security.xml"> |
<guide link = "/doc/en/gentoo-security.xml"> |
6 |
<title>Gentoo Linuxs Sikkerhedsvejledning</title> |
<title>Gentoo Linux Security Guide</title> |
7 |
<author title="Forfatter"><mail link="kn@insecurity.dk">Kim Nielsen</mail> |
<author title="Author"><mail link="kn@insecurity.dk">Kim Nielsen</mail> |
8 |
</author> |
</author> |
9 |
|
|
10 |
<author title="Redaktør"><mail link="zhen@gentoo.org">John P. Davis</mail> |
<author title="Editor"><mail link="zhen@gentoo.org">John P. Davis</mail> |
11 |
</author> |
</author> |
12 |
|
|
13 |
<author title="Redaktør"><mail link="stocke2@gentoo.org">Eric R. Stockbridge</mail> |
<author title="Editor"><mail link="stocke2@gentoo.org">Eric R. Stockbridge</mail> |
14 |
</author> |
</author> |
15 |
|
|
16 |
<author title="Redaktør"><mail link="carl@gentoo.org">Carl Anderson</mail> |
<author title="Editor"><mail link="carl@gentoo.org">Carl Anderson</mail> |
17 |
</author> |
</author> |
18 |
|
|
19 |
<author title="Redaktør"><mail link="peesh@gentoo.org">Jorge Paulo</mail> |
<author title="Editor"><mail link="peesh@gentoo.org">Jorge Paulo</mail> |
20 |
</author> |
</author> |
21 |
|
|
22 |
<author title="Redaktør"><mail link="swift@gentoo.org">Sven Vermeulen</mail> |
<author title="Editor"><mail link="swift@gentoo.org">Sven Vermeulen</mail> |
23 |
</author> |
</author> |
24 |
<author title="Redaktør"><mail link="bennyc@gentoo.org">Benny Chuang</mail> |
|
25 |
|
<author title="Editor"><mail link="bennyc@gentoo.org">Benny Chuang</mail> |
26 |
|
</author> |
27 |
|
|
28 |
|
<author title="Editor"><mail link="jaervosz@itu.dk">Sune Jeppesen</mail> |
29 |
</author> |
</author> |
30 |
<author title="Oversætter"><mail link="bro3man@yahoo.dk">Jesper Brodersen</mail |
|
31 |
|
<author title="Editor"><mail link="blubber@gentoo.org">Tiemo Kieft</mail> |
32 |
</author> |
</author> |
33 |
|
|
34 |
<license/> |
<license/> |
35 |
|
|
36 |
<abstract> |
<abstract> |
37 |
Denne vejledning er en trin-for-trin guide for at gøre din Gentoo Linux modstandsdygtig. |
This guide is step-by-step guide for hardening Gentoo Linux. |
38 |
</abstract> |
</abstract> |
39 |
|
|
40 |
<version>0.4.2_DK_1.0</version> |
<version>0.4.5</version> |
41 |
<date>21. September 2003</date> |
<date>September 30, 2003</date> |
42 |
|
|
43 |
-- Introduction start -- |
-- Introduction start -- |
44 |
|
|
45 |
<chapter> |
<chapter> |
46 |
<title>Introduktion</title> |
<title>Introduction</title> |
47 |
<section> |
<section> |
|
<title>Hvem burde læse denne vejledning?</title> |
|
48 |
<body> |
<body> |
49 |
|
|
50 |
<p> |
<p> |
51 |
Folk, som bruger Gentoo Linux i et server-baseret miljø og/eller føler et behov for et mere eller paranoid sikkerhedsniveau. |
This guide is intended for people who are using Gentoo Linux in a server based environment or just feel the need for better security. |
52 |
</p> |
</p> |
53 |
|
|
54 |
</body> |
<note> |
55 |
</section> |
If you are interested in even more Gentoo security stuff after reading this guide then have a look at the <uri link="http://www.gentoo.org/proj/en/hardened/">Hardened Gentoo Project</uri> |
56 |
|
</note> |
|
<section> |
|
|
<title>Credits</title> |
|
|
<body> |
|
|
|
|
|
<p> |
|
|
Kim Nielsen |
|
|
</p> |
|
|
|
|
|
</body> |
|
|
</section> |
|
|
|
|
|
<section> |
|
|
<title>Special thanks</title> |
|
|
<body> |
|
|
|
|
|
<p> |
|
|
A special thanks goes to the following people for finding various bugs, spelling mistakes and sentence structure. |
|
|
</p> |
|
|
|
|
|
<p> |
|
|
Bjarke Sørensen, Justin Lambert, Andreas Waschbuesch, Duncan Lissett, Sherman Boyd, Sami Dalouche and Väinö Järvelä. |
|
|
</p> |
|
57 |
|
|
58 |
</body> |
</body> |
59 |
</section> |
</section> |
60 |
|
|
61 |
|
<!-- |
62 |
<section> |
<section> |
63 |
<title>Enhancements for Next Release of this Guide:</title> |
<title>Enhancements for future releases of this Guide:</title> |
64 |
<body> |
<body> |
65 |
|
|
66 |
<p> |
<p> |
103 |
|
|
104 |
</body> |
</body> |
105 |
</section> |
</section> |
106 |
|
--> |
107 |
</chapter> |
</chapter> |
108 |
|
|
109 |
-- Introduction end -- |
-- Introduction end -- |
117 |
<body> |
<body> |
118 |
|
|
119 |
<p> |
<p> |
120 |
No matter how many safeguards you implement, it can all be easily circumvented if |
No matter how many safeguards you implement, all can easily be circumvented if |
121 |
the attacker can gain physical access to your box. Make sure your hardware is not |
the attacker can gain physical access to your box. Make sure your hardware is not |
122 |
casually accessible. For example, you may want to place your box |
casually accessible. For example, you may want to place your box |
123 |
in a locked server closet. Locking cases is a good idea too. For the highest level |
in a locked server closet. Locking cases is a good idea too. For the highest level |
124 |
of security set your BIOS to restrict booting to your hard drive only. |
of security set your BIOS to restrict booting to your hard drive only. |
125 |
Disable booting from the floppy and CD-ROM drive. For the paranoid, enabling the |
Disable booting from the floppy and CD-ROM drives. For the paranoid, enabling the |
126 |
BIOS password is a good idea. BIOS passwords are also a good idea for laptop users. |
BIOS password is a good idea. BIOS passwords are also a good idea for laptop users. |
127 |
</p> |
</p> |
128 |
|
|
137 |
Document what services the machine should run or is supposed to run. This will help |
Document what services the machine should run or is supposed to run. This will help |
138 |
you compose a better partition scheme for the system. It can also make your |
you compose a better partition scheme for the system. It can also make your |
139 |
intrusion detection strategy much easier. |
intrusion detection strategy much easier. |
|
</p> |
|
|
|
|
|
<p> |
|
140 |
Of course you should not document this if you only have one or a few computers and |
Of course you should not document this if you only have one or a few computers and |
141 |
you are the only one using them. |
you are the only one using them. |
142 |
</p> |
</p> |
150 |
</p> |
</p> |
151 |
|
|
152 |
<p> |
<p> |
153 |
<e>none</e>, except maybe ssh. |
<e>none</e>, except maybe <c>sshd</c>. |
154 |
</p> |
</p> |
155 |
|
|
156 |
<p> |
<p> |
157 |
Document this and the current version of SSH - it will help you keep track of which system to upgrade in case someone finds a security hole in sshd. This will also aid in determining who should have access to the system. |
Document this and the current version of SSH - it will help you keep track of which system to upgrade in case someone finds a security hole in <c>sshd</c>. This will also aid in determining who should have access to the system. |
158 |
</p> |
</p> |
159 |
|
|
160 |
</body> |
</body> |
171 |
<ul> |
<ul> |
172 |
|
|
173 |
<li> |
<li> |
174 |
Any directory tree a user should be able to write to (/home and /tmp /var), should be on a separate partition and use disk quotas. Portage uses /var/tmp to compile files so that partition should be large. This reduces the risk of a user filling up your "/" mount point. |
Any directory tree a user should be able to write to (<path>/home</path> and <path>/tmp</path> <path>/var</path>), should be on a separate partition and use disk quotas. Portage uses <path>/var/tmp</path> to compile files so that partition should be large. This reduces the risk of a user filling up your <path>/</path> mount point. |
175 |
</li> |
</li> |
176 |
|
|
177 |
<li> |
<li> |
178 |
Any directory tree where you want to install non-distribution software should be on a separate partition. According to the <uri link="http://www.pathname.com/fhs/">File Hierarchy Standard</uri>, this is <path>/opt</path> or /usr/local. If these are separate partitions, they will not be erased if you have to reinstall the system. |
Any directory tree where you want to install non-distribution software should be on a separate partition. According to the <uri link="http://www.pathname.com/fhs/">File Hierarchy Standard</uri>, this is <path>/opt</path> or <path>/usr/local</path>. If these are separate partitions, they will not be erased if you have to reinstall the system. |
179 |
</li> |
</li> |
180 |
|
|
181 |
<li> |
<li> |
190 |
<title>The root user</title> |
<title>The root user</title> |
191 |
<body> |
<body> |
192 |
<p> |
<p> |
193 |
The user 'root' is the most vital user on the system and should not be used for anything except if it's necessary. If an attacker gains root access you can no longer trust your system, so reinstall. |
The user 'root' is the most vital user on the system and should not be used for anything except if it is necessary. If an attacker gains root access you can no longer trust your system, so reinstall. |
194 |
</p> |
</p> |
195 |
|
|
196 |
<p> |
<p> |
212 |
</li> |
</li> |
213 |
|
|
214 |
<li> |
<li> |
215 |
If a user only needs a few commands instead of everything that root normally can do, consider using sudo, but be careful with this! |
If a user only needs a few commands instead of everything that root normally can do, consider using <c>sudo</c>, but be careful with this! |
216 |
</li> |
</li> |
217 |
|
|
218 |
<li> |
<li> |
222 |
</ul> |
</ul> |
223 |
|
|
224 |
<p> |
<p> |
225 |
Gentoo has general protection against normal users, trying to su. The default PAM setting states that a users has to be a member of wheel in order to be able to su. |
Gentoo has general protection against normal users, trying to <c>su</c>. The default PAM setting states that a users has to be a member of wheel in order to be able to su. |
226 |
</p> |
</p> |
227 |
|
|
228 |
</body> |
</body> |
229 |
</section> |
</section> |
230 |
|
|
231 |
<section> |
<section> |
232 |
<title>Policies</title> |
<title>Security policies</title> |
|
<body> |
|
|
<section> |
|
|
<title>Why policies are needed</title> |
|
233 |
<body> |
<body> |
234 |
|
|
235 |
<p>There are several reasons why policies are needed.</p> |
<p>There are several reasons why security policies are needed.</p> |
236 |
|
|
237 |
<ul> |
<ul> |
238 |
|
|
241 |
</li> |
</li> |
242 |
|
|
243 |
<li> |
<li> |
244 |
It's almost impossible to catch potential attackers, resolve network problems, or conduct audits, without spying on network traffic or looking in private home directories. And spying without the users agreement is illegal in most countries. And since about 60% of all attacks currently come from inside the organization, it's important that you keep an open eye. |
It is almost impossible to catch potential attackers, resolve network problems, or conduct audits, without spying on network traffic or looking in private home directories. And spying without the users agreement is illegal in most countries. And since about 60% of all attacks currently come from inside the organization, it is important that you keep an open eye. |
245 |
</li> |
</li> |
246 |
|
|
247 |
<li> |
<li> |
253 |
</li> |
</li> |
254 |
|
|
255 |
<li> |
<li> |
256 |
Police or federal law enforcement can't help you catch the attacker, if they don't know your network configuration or the services that you provide. |
Police or federal law enforcement can not help you catch the attacker, if they do not know your network configuration or the services that you provide. |
257 |
</li> |
</li> |
258 |
|
|
259 |
<li> |
<li> |
263 |
</ul> |
</ul> |
264 |
|
|
265 |
<p> |
<p> |
266 |
This should clearly state why it is important to create policies on systems with more than one user and why it's important to educate users. |
This should clearly state why it is important to create policies for systems with more than one user and why it is important to educate users. |
267 |
</p> |
</p> |
268 |
|
|
269 |
<p> |
<p> |
270 |
A policy is a document (or several documents) with answers to questions like who, where, why and what. |
A policy is a document (or several documents) with answers to questions like who, where, why and what. |
271 |
Every user on your system/network should read, understand and sign it. It is important that you take the time to help the users understand the policy and why the policy needs to be signed or what will happens if they act directly against the policy (the policy should also state this). This should be repeated at least once a year since the policy can change but also as a reminder to the user. |
Every user on your system/network should read, understand and sign it. It is important that you take the time to help the users understand the policy and why the policy needs to be signed or what will happens if they act directly against the policy (the policy should also state this). This should be repeated at least once a year since the policy can change but also as a reminder to the user. |
272 |
</p> |
</p> |
|
<note>Create policies that are easy to read and be very clear/specific on every subject.</note> |
|
273 |
|
|
274 |
<p> |
<note>Create policies that are easy to read and be very precise on every subject.</note> |
|
Most parts of a policy can be enforced directly in the operating system or through firewalls and others cannot. |
|
|
</p> |
|
|
|
|
|
</body> |
|
|
</section> |
|
|
|
|
|
<section> |
|
|
<title>Security policies</title> |
|
|
<body> |
|
275 |
|
|
276 |
<p> |
<p> |
277 |
A security policy is basically a set of rules that will insure your network/host security. It is basically a document containing information on how computer, network, password, email and even how users should or should not behave, how to act when attacked, how machines (workstation/servers) are installed, infrastructure etc. |
Most parts of a policy can be enforced directly in the operating system or through firewalls and others cannot. |
278 |
</p> |
</p> |
279 |
|
|
280 |
<p> |
<p> |
287 |
<ul> |
<ul> |
288 |
<li>Screen savers.</li> |
<li>Screen savers.</li> |
289 |
<li>Password handling.</li> |
<li>Password handling.</li> |
290 |
<li>Download of software.</li> |
<li>Software download and installation.</li> |
291 |
<li>Knowledge of if they are being monitored.</li> |
<li>Information stating if the users are being monitored.</li> |
292 |
<li>Use of anti-virus software.</li> |
<li>Use of anti-virus software.</li> |
|
<li>etc.</li> |
|
293 |
</ul> |
</ul> |
294 |
|
|
295 |
<li>Handling of sensitive information (any written form, paper or digital).</li> |
<li>Handling of sensitive information (any written form, paper or digital).</li> |
322 |
|
|
323 |
</body> |
</body> |
324 |
</section> |
</section> |
|
</body> |
|
|
</section> |
|
325 |
</chapter> |
</chapter> |
326 |
|
|
327 |
-- Considerations before installation end -- |
-- Considerations before installation end -- |
331 |
<chapter> |
<chapter> |
332 |
<title>Tightening the security after/during installation</title> |
<title>Tightening the security after/during installation</title> |
333 |
<section> |
<section> |
334 |
<title>/etc/make.conf</title> |
<title>USE flags</title> |
335 |
<body> |
<body> |
336 |
|
|
337 |
<p> |
<p> |
338 |
The make.conf file contains all the options and extra libraries that you want to have support for when building ebuilds. In this file you must make sure that if the ebuild supports any security library like PAM (Pluggable Authentication Modules), tcp wrappers or SSL (Secure Socket Layer) it will add support for it. Your global USE variable should contain pam, tcpd and ssl. |
The <path>make.conf</path> file contains user defined USE flags and <path>/etc/make.profile/make.defaults</path> contains the default USE flags for Gentoo Linux. For this guide the important flags are pam (Pluggable Authentication Modules), tcpd (TCP wrappers) and ssl (Secure Socket Layer). These are all in the default USE flags. |
|
</p> |
|
|
|
|
|
<p> |
|
|
So add something like this: |
|
339 |
</p> |
</p> |
340 |
|
|
|
<pre caption="USE settings to be added"> |
|
|
USE="tcpd pam ssl" |
|
|
</pre> |
|
|
|
|
341 |
</body> |
</body> |
342 |
</section> |
</section> |
343 |
|
|
344 |
<section> |
<section> |
345 |
<title>GRUB/LILO password</title> |
<title>GRUB password</title> |
|
<body> |
|
|
<section> |
|
|
<title>GRUB</title> |
|
346 |
<body> |
<body> |
347 |
|
|
348 |
<p> |
<p> |
359 |
</p> |
</p> |
360 |
|
|
361 |
<p> |
<p> |
362 |
When adding a md5 password, you need to convert the password into crypt format (man crypt) which is the same format as the shadow file. For example could the encrypted password <e>changeme</e> look like this <e>$1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.</e> |
When adding a md5 password, you need to convert the password into crypt format (man crypt) which is the same format as the shadow file. For example the encrypted password <e>changeme</e> look like this <e>$1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.</e> |
363 |
</p> |
</p> |
364 |
|
|
365 |
<p> |
<p> |
366 |
Or this: |
Or this you can convert it directly in the grub shell: |
367 |
|
</p> |
368 |
|
|
369 |
|
<pre caption="md5crypt in grub shell"> |
370 |
|
#<i>/sbin/grub</i> |
371 |
|
|
372 |
|
GRUB version 0.92 (640K lower / 3072K upper memory) |
373 |
|
|
374 |
|
[ Minimal BASH-like line editing is supported. For the first word, TAB |
375 |
|
lists possible command completions. Anywhere else TAB lists the possible |
376 |
|
completions of a device/filename. ] |
377 |
|
|
378 |
|
grub> <i>md5crypt</i> |
379 |
|
|
380 |
|
Password: <i>********</i> |
381 |
|
<codenote>Typed changeme</codenote> |
382 |
|
Encrypted: $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs. |
383 |
|
|
384 |
|
grub> <i>quit</i> |
385 |
|
</pre> |
386 |
|
|
387 |
|
<p> |
388 |
|
Then, cut and paste your password to <path>/boot/grub/grub.grub</path>. |
389 |
</p> |
</p> |
390 |
|
|
391 |
<pre caption="/boot/grub/grub.conf"> |
<pre caption="/boot/grub/grub.conf"> |
393 |
password --md5 $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs. |
password --md5 $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs. |
394 |
</pre> |
</pre> |
395 |
|
|
|
<warn> |
|
|
When testing this, remember to insert the timeout. Otherwise you will not be able to boot the system, if your password is incorrect. |
|
|
</warn> |
|
|
|
|
396 |
<p> |
<p> |
397 |
The timeout on 5 seconds becomes very handy if the system is remote and should be able to reboot without any keyboard interaction. More on Grub passwords can be found by executing <path>info grub</path> |
The 5 seconds timeout become handy if the system is remote and should be able to reboot without any keyboard interaction. More on Grub passwords can be found by executing <c>info grub</c> |
398 |
</p> |
</p> |
399 |
|
|
400 |
</body> |
</body> |
401 |
</section> |
</section> |
402 |
|
|
403 |
<section> |
<section> |
404 |
<title>LILO</title> |
<title>LILO password</title> |
405 |
<body> |
<body> |
406 |
|
|
407 |
<p> |
<p> |
439 |
|
|
440 |
</body> |
</body> |
441 |
</section> |
</section> |
|
</body> |
|
|
</section> |
|
442 |
|
|
443 |
<section> |
<section> |
444 |
<title>Restricting Console Usage</title> |
<title>Restricting Console Usage</title> |
457 |
|
|
458 |
</body> |
</body> |
459 |
</section> |
</section> |
460 |
|
</chapter> |
461 |
|
|
462 |
<section> |
<chapter> |
463 |
<title>More logging</title> |
<title>More logging</title> |
464 |
|
<section> |
465 |
<body> |
<body> |
466 |
|
|
467 |
<p> |
<p> |
485 |
</p> |
</p> |
486 |
|
|
487 |
<p> |
<p> |
488 |
Here is an example of how you can configure syslog |
Below is the standard <path>syslog.conf</path> with some added features. We have uncommented the <c>cron</c> and <c>tty</c> lines and added a remote logging server. To further enhance security you could add logs in two places. |
489 |
</p> |
</p> |
490 |
|
|
491 |
<pre caption="/etc/syslog.conf"> |
<pre caption="/etc/syslog.conf"> |
|
*.=debug /var/log/debug |
|
|
*.err /var/log/syslog |
|
|
|
|
|
#Users who should the see message if they are logged in. |
|
|
*.=alert root,<c>your user name here</c> |
|
|
*.=emerg root,<c>your user name here</c> |
|
|
|
|
|
mail.info,mail.notice /var/log/maillog |
|
|
kern.* /var/log/kern.log |
|
|
daemon.info;daemon.notice /var/log/daemon.log |
|
|
cron.* /var/log/cron.log |
|
|
mail.* /var/log/mail.log |
|
|
user.* /var/log/user.log |
|
|
uucp.* /var/log/uucp.log |
|
|
*.*;auth,authpriv.none /var/log/syslog |
|
|
|
|
|
#Place the log file in 2 places |
|
|
authpriv.*;auth.* /admin/auth.log |
|
|
authpriv.*;auth.* /var/log/secure |
|
492 |
|
|
493 |
#Write everything on the console |
# /etc/syslog.conf Configuration file for syslogd. |
494 |
*.* /dev/tty12 |
# |
495 |
|
# For more information see syslog.conf(5) |
496 |
|
# manpage. |
497 |
|
# This is from Debian, we are using it for now |
498 |
|
# Daniel Robbins, 5/15/99 |
499 |
|
|
500 |
|
# |
501 |
|
# First some standard logfiles. Log by facility. |
502 |
|
# |
503 |
|
|
504 |
|
auth,authpriv.* /var/log/auth.log |
505 |
|
*.*;auth,authpriv.none -/var/log/syslog |
506 |
|
cron.* /var/log/cron.log |
507 |
|
daemon.* -/var/log/daemon.log |
508 |
|
kern.* -/var/log/kern.log |
509 |
|
lpr.* -/var/log/lpr.log |
510 |
|
mail.* /var/log/mail.log |
511 |
|
user.* -/var/log/user.log |
512 |
|
uucp.* -/var/log/uucp.log |
513 |
|
local6.debug /var/log/imapd.log |
514 |
|
|
515 |
|
# |
516 |
|
# Logging for the mail system. Split it up so that |
517 |
|
# it is easy to write scripts to parse these files. |
518 |
|
# |
519 |
|
mail.info -/var/log/mail.info |
520 |
|
mail.warn -/var/log/mail.warn |
521 |
|
mail.err /var/log/mail.err |
522 |
|
|
523 |
|
# Logging for INN news system |
524 |
|
# |
525 |
|
news.crit /var/log/news/news.crit |
526 |
|
news.err /var/log/news/news.err |
527 |
|
news.notice -/var/log/news/news.notice |
528 |
|
|
529 |
|
# |
530 |
|
# Some `catch-all' logfiles. |
531 |
|
# |
532 |
|
*.=debug;\ |
533 |
|
auth,authpriv.none;\ |
534 |
|
news.none;mail.none -/var/log/debug |
535 |
|
*.=info;*.=notice;*.=warn;\ |
536 |
|
auth,authpriv.none;\ |
537 |
|
cron,daemon.none;\ |
538 |
|
mail,news.none -/var/log/messages |
539 |
|
|
540 |
|
# |
541 |
|
# Emergencies and alerts are sent to everybody logged in. |
542 |
|
# |
543 |
|
*.emerg * |
544 |
|
*.=alert * |
545 |
|
|
546 |
|
# |
547 |
|
# I like to have messages displayed on the console, but only on a virtual |
548 |
|
# console I usually leave idle. |
549 |
|
# |
550 |
|
daemon,mail.*;\ |
551 |
|
news.=crit;news.=err;news.=notice;\ |
552 |
|
*.=debug;*.=info;\ |
553 |
|
*.=notice;*.=warn /dev/tty8 |
554 |
|
|
555 |
#Or setup a remote logging server |
#Setup a remote logging server |
556 |
*.* @logserver |
*.* @logserver |
|
</pre> |
|
557 |
|
|
558 |
<p> |
# The named pipe /dev/xconsole is for the `xconsole' utility. To use it, |
559 |
The attacker will most likely try to erase their tracks by editing or deleting the log files. You can make it harder for the attacker by sending the log to one or more logging servers on different machines. |
# you must invoke `xconsole' with the `-file' option: |
560 |
</p> |
# |
561 |
|
# $ xconsole -file /dev/xconsole [...] |
562 |
|
# |
563 |
|
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably |
564 |
|
# busy site.. |
565 |
|
# |
566 |
|
#daemon.*,mail.*;\ |
567 |
|
# news.crit;news.err;news.notice;\ |
568 |
|
# *.=debug;*.=info;\ |
569 |
|
# *.=notice;*.=warn |/dev/xconsole |
570 |
|
|
571 |
|
local2.* -/var/log/ppp.log |
572 |
|
</pre> |
573 |
|
|
574 |
<p> |
<p> |
575 |
More info about syslogd can be found in the man page (<path>man syslog</path>) |
The attacker will most likely try to erase their tracks by editing or deleting the log files. You can make it harder for the attacker by sending the log to one or more logging servers on different machines. More info about syslogd can be found in the man page (<c>man syslog</c>) |
576 |
</p> |
</p> |
577 |
|
|
578 |
</body> |
</body> |
584 |
|
|
585 |
<p> |
<p> |
586 |
<uri link="http://metalog.sourceforge.net">Metalog</uri> by Frank Dennis is not able to log to a remote server, but it does have advantages when it comes to performance and logging flexibility. |
<uri link="http://metalog.sourceforge.net">Metalog</uri> by Frank Dennis is not able to log to a remote server, but it does have advantages when it comes to performance and logging flexibility. |
587 |
</p> |
It can log by program name, urgency, by facility (like syslogd) and comes with regular expression matching and it can launch external scripts when specific patterns are found. It is very good for taking action when needed. |
|
|
|
|
<p> |
|
|
It can log by program name or by facility (like syslogd) and comes with regular expression matching and execution of commands. Very good for taking action when needed. |
|
588 |
</p> |
</p> |
589 |
|
|
|
<pre caption="/etc/metalog/metalog.conf"> |
|
|
maxsize = 1000000 |
|
|
maxtime = 86400 |
|
|
maxfiles = 7 |
|
|
minimum = 7 |
|
|
|
|
|
Kernel messages : |
|
|
|
|
|
facility = "kern" |
|
|
logdir = "/var/log/kernel" |
|
|
|
|
|
Auth messages : |
|
|
facility = "auth" |
|
|
logdir = "/var/log/auth" |
|
|
|
|
|
Critical : |
|
|
facility = "critical" |
|
|
command = "/usr/local/sbin/pwdfail.sh" |
|
|
|
|
|
Crond : |
|
|
|
|
|
program = "crond" |
|
|
logdir = "/var/log/crond" |
|
|
|
|
|
Password failures : |
|
|
|
|
|
regex = "(password|login|authentication)\s+(fail|invalid)" |
|
|
regex = "(failed|invalid)\s+(password|login|authentication)" |
|
|
regex = "ILLEGAL ROOT LOGIN" |
|
|
logdir = "/var/log/pwdfail" |
|
|
command = "/usr/local/sbin/pwdfail.sh" |
|
|
|
|
|
SSH Server : |
|
|
|
|
|
program = "sshd" |
|
|
logdir = "/var/log/sshd" |
|
|
|
|
|
Mail : |
|
|
|
|
|
facility = "ftp-mail-news" |
|
|
logdir = "/var/log/mail" |
|
|
|
|
|
Snort: |
|
|
program = "snort" |
|
|
command = "/usr/local/sbin/pwdfail.sh" |
|
|
|
|
|
Everything important : |
|
|
|
|
|
facility = "*" |
|
|
logdir = "/var/log/everything" |
|
|
|
|
|
Everything very important : |
|
|
|
|
|
facility = "*" |
|
|
logdir = "/var/log/critical" |
|
|
|
|
|
</pre> |
|
|
|
|
590 |
<p> |
<p> |
591 |
This is basically a standard configuration with a few modifications, like a minimum logging level at 7, which means that everything will be logged. |
The standard configuration is basically enough. If you want to be notified by email whenever a password failure occurs use one of the following scripts. |
592 |
</p> |
</p> |
593 |
|
|
594 |
<p> |
<p> |
595 |
pwdfail.sh for postfix. |
For postfix: |
596 |
</p> |
</p> |
597 |
|
|
598 |
<pre caption = "postfix' pwdfail.sh"> |
<pre caption = "/usr/local/sbin/mail_pwd_failures.sh for postfix"> |
599 |
#! /bin/sh |
#! /bin/sh |
600 |
echo "$3" | mail -s "Warning (program : $2)" root |
echo "$3" | mail -s "Warning (program : $2)" root |
601 |
</pre> |
</pre> |
602 |
|
|
603 |
<p> |
<p> |
604 |
pwdfail.sh for qmail. |
For qmail: |
605 |
</p> |
</p> |
606 |
|
|
607 |
<pre caption = "qmail's pwdfail.sh"> |
<pre caption = "/usr/local/sbin/mail_pwd_failures.sh for qmail"> |
608 |
#!/bin/sh |
#!/bin/sh |
609 |
echo "To: root |
echo "To: root |
610 |
Subject:Failure (Warning: $2) |
Subject:Failure (Warning: $2) |
613 |
</pre> |
</pre> |
614 |
|
|
615 |
<p> |
<p> |
616 |
More information can be found in the <uri link="http://metalog.sourceforge.net">metalog</uri> website. |
Remember to make the script executable by issuing <c>chmod +x /usr/local/sbin/mail_pwd_failures.sh</c> |
617 |
</p> |
</p> |
618 |
|
|
619 |
|
<p> |
620 |
|
Then uncomment the command line under Password failures in |
621 |
|
<path>/etc/metalog/metalog.conf</path> like: |
622 |
|
</p> |
623 |
|
|
624 |
|
<pre caption="/etc/metalog/metalog.conf"> |
625 |
|
command = "/usr/local/sbin/mail_pwd_failures.sh" |
626 |
|
</pre> |
627 |
|
|
628 |
</body> |
</body> |
629 |
</section> |
</section> |
630 |
|
|
631 |
<section> |
<section> |
632 |
|
|
633 |
<title>Syslog-ng</title> |
<title>Syslog-ng</title> |
728 |
</section> |
</section> |
729 |
</body> |
</body> |
730 |
</section> |
</section> |
731 |
|
</chapter> |
732 |
|
|
733 |
|
<chapter> |
734 |
|
<title>Mounting partitions</title> |
735 |
<section> |
<section> |
|
<title>Mounting of partitions</title> |
|
736 |
<body> |
<body> |
737 |
|
|
738 |
<p> |
<p> |
781 |
|
|
782 |
</body> |
</body> |
783 |
</section> |
</section> |
784 |
|
</chapter> |
785 |
|
|
786 |
<section> |
<chapter> |
787 |
<title>User/group limitations</title> |
<title>User/group limitations</title> |
|
<body> |
|
788 |
|
|
789 |
<section> |
<section> |
790 |
<title>/etc/security/limits.conf</title> |
<title>/etc/security/limits.conf</title> |
828 |
</pre> |
</pre> |
829 |
|
|
830 |
<p> |
<p> |
831 |
Here we set the default settings and a specific setting for the user <e>kn</e>. Limits are part of the shadow package and only applies for the shadow login program. It is not necessary to set any limitations in this file, if you have set the PAM setting in your make.conf and configured PAM properly. |
Here we set the default settings and a specific setting for the user <e>kn</e>. Limits are part of the shadow package and only apply to the shadow login program. It is not necessary to set any limitations in this file if you haven't enabled pam in your <path>make.conf</path> and configured PAM properly. |
832 |
</p> |
</p> |
833 |
|
|
834 |
</body> |
</body> |
972 |
|
|
973 |
</body> |
</body> |
974 |
</section> |
</section> |
975 |
|
</chapter> |
976 |
|
|
977 |
|
<chapter> |
978 |
|
<title>File permissions</title> |
979 |
<section> |
<section> |
|
<title>File permissions.</title> |
|
980 |
<body> |
<body> |
981 |
|
|
982 |
<section> |
<section> |
983 |
<title>World readable.</title> |
<title>World readable</title> |
984 |
<body> |
<body> |
985 |
|
|
986 |
<p> |
<p> |
991 |
</section> |
</section> |
992 |
|
|
993 |
<section> |
<section> |
994 |
<title>World/Group writable.</title> |
<title>World/Group writable</title> |
995 |
<body> |
<body> |
996 |
|
|
997 |
<pre caption="Finding world-writable files and directories"> |
<pre caption="Finding world-writable files and directories"> |
1062 |
|
|
1063 |
</body> |
</body> |
1064 |
</section> |
</section> |
1065 |
|
</chapter> |
1066 |
|
|
1067 |
|
<chapter> |
|
<section> |
|
1068 |
<title>PAM (Pluggable Authentication Modules)</title> |
<title>PAM (Pluggable Authentication Modules)</title> |
1069 |
|
<section> |
1070 |
<body> |
<body> |
1071 |
|
|
1072 |
<p> |
<p> |
1073 |
PAM is a suite of shared libraries that provide an alternative way of making authentication in programs. The PAM settings of Gentoo Linux is pretty reasonable, but there is always room for improvement. |
PAM is a suite of shared libraries that provide an alternative way of making authentication in programs. The PAM settings of Gentoo Linux is pretty reasonable, but there is always room for improvement. |
1074 |
</p> |
</p> |
|
<note>This chapter will have no effect if you did not include the PAM in your USE option in <path>/etc/make.conf</path></note> |
|
1075 |
|
|
1076 |
<p>Install cracklib</p> |
<p>Install cracklib</p> |
1077 |
|
|
1120 |
|
|
1121 |
</body> |
</body> |
1122 |
</section> |
</section> |
1123 |
|
</chapter> |
1124 |
|
|
1125 |
<section> |
<chapter> |
1126 |
<title>TCP Wrappers</title> |
<title>TCP Wrappers</title> |
1127 |
|
<section> |
1128 |
<body> |
<body> |
1129 |
|
|
1130 |
<p> |
<p> |
1131 |
Is a way of controlling access to services normally run by inetd (which Gentoo does not have) but it can also be used by xinetd and other services. |
Is a way of controlling access to services normally run by inetd (which Gentoo does not have) but it can also be used by xinetd and other services. |
1132 |
</p> |
</p> |
1133 |
<note>The use in make.conf should contain tcpd and the service should be executing tcpd in its server argument (in xinetd). See the chapter on xinetd for more information</note> |
<note>The service should be executing tcpd in its server argument (in xinetd). See the chapter on xinetd for more information</note> |
1134 |
|
|
1135 |
<pre caption="/etc/hosts.deny"> |
<pre caption="/etc/hosts.deny"> |
1136 |
ALL:PARANOID |
ALL:PARANOID |
1151 |
|
|
1152 |
</body> |
</body> |
1153 |
</section> |
</section> |
|
|
|
|
|
|
|
</body> |
|
|
</section> |
|
1154 |
</chapter> |
</chapter> |
1155 |
|
|
1156 |
-- Tightening the security after/during installation end -- |
-- Tightening the security after/during installation end -- |
1297 |
</section> |
</section> |
1298 |
|
|
1299 |
<section> |
<section> |
|
<title>Kernel patches</title> |
|
|
<body> |
|
|
<section> |
|
1300 |
<title>Grsecurity</title> |
<title>Grsecurity</title> |
1301 |
<body> |
<body> |
1302 |
|
|
1392 |
|
|
1393 |
</body> |
</body> |
1394 |
</section> |
</section> |
|
|
|
|
</body> |
|
|
</section> |
|
|
|
|
1395 |
</chapter> |
</chapter> |
1396 |
|
|
1397 |
-- Kernel security end -- |
-- Kernel security end -- |
1547 |
</section> |
</section> |
1548 |
|
|
1549 |
<section> |
<section> |
1550 |
<title>Securing X</title> |
<title>X</title> |
1551 |
<body> |
<body> |
1552 |
|
|
1553 |
<p> |
<p> |
1554 |
Per default XFree is configured to act as a Xserver. This can be dangerous since X uses unencrypted tcp connections and listens for xclients. If you do not need this service disable it! But if you depend on using your workstation as a Xserver use the <path>/usr/X11R6/bin/xhost</path> command with caution. This command allows clients from other hosts to connect and use your display. This can become handy if you need an X application from a different machine and the only way is through the network. The syntax is <path>/usr/X11R6/bin/xhost +hostname</path> |
Per default XFree is configured to act as a Xserver. This can be dangerous since X uses unencrypted TCP connections and listens for xclients. If you do not need this service disable it! But if you depend on using your workstation as a Xserver use the <path>/usr/X11R6/bin/xhost</path> command with caution. This command allows clients from other hosts to connect and use your display. This can become handy if you need an X application from a different machine and the only way is through the network. The syntax is <path>/usr/X11R6/bin/xhost +hostname</path> |
1555 |
</p> |
</p> |
1556 |
<warn>Don't ever use the xhost + feature! This will allow any client to connect and take control of your X. If an attacker can get access to your X, he can log your keystrokes and control your desktop.</warn> |
<warn>Do not ever use the <c>xhost +</c>feature! This will allow any client to connect and take control of your X. If an attacker can get access to your X, he can log your keystrokes and control your desktop.</warn> |
1557 |
|
|
1558 |
<p> |
<p> |
1559 |
A more secure solution is to disable this feature completely by starting you X with <c>startx -- -nolisten</c> tcp or disable it permanently in the configuration file by changing the line |
A more secure solution is to disable this feature completely by starting X with <c>startx -- -nolisten</c> tcp or disable it permanently in the configuration. |
1560 |
</p> |
</p> |
|
<pre caption="/usr/X11R6/bin/startx"> |
|
|
defaultserverargs="" |
|
|
</pre> |
|
1561 |
|
|
|
<p> to </p> |
|
1562 |
<pre caption="/usr/X11R6/bin/startx"> |
<pre caption="/usr/X11R6/bin/startx"> |
1563 |
defaultserverargs="-nolisten tcp" |
defaultserverargs="-nolisten tcp" |
1564 |
</pre> |
</pre> |
1565 |
|
|
1566 |
<p> |
<p> |
1567 |
To make sure that <c>startx</c> doesn't get overwritten when you emerge |
To make sure that <c>startx</c> does not get overwritten when emerging |
1568 |
a newer XFree you must protect it. Add the following line to |
a new version of XFree you must protect it. Add the following line to |
1569 |
<path>/etc/make.conf</path>: |
<path>/etc/make.conf</path>: |
1570 |
</p> |
</p> |
1571 |
|
|
1577 |
If you use a graphical login manager you need a different approach. |
If you use a graphical login manager you need a different approach. |
1578 |
</p> |
</p> |
1579 |
|
|
|
<p>gdm (Gnome Display Manager)</p> |
|
|
|
|
|
<p>Change:</p> |
|
|
<pre caption="/etc/X11/gdm/gdm.conf"> |
|
|
[server-Standard] |
|
|
command=/usr/X11R6/bin/X |
|
|
</pre> |
|
1580 |
<p> |
<p> |
1581 |
to |
For gdm. |
1582 |
</p> |
</p> |
1583 |
|
|
1584 |
<pre caption="/etc/X11/gdm/gdm.conf"> |
<pre caption="/etc/X11/gdm/gdm.conf"> |
1585 |
[server-Standard] |
[server-Standard] |
1586 |
command=/usr/X11R6/bin/X -nolisten tcp |
command=/usr/X11R6/bin/X -nolisten tcp |
1587 |
</pre> |
</pre> |
1588 |
|
|
1589 |
<p>xdm (X Display Manager) and kdm (Kde Display Manager)</p> |
<p>For xdm (X Display Manager) and kdm (Kde Display Manager)</p> |
|
|
|
|
<p>Change</p> |
|
|
<pre caption="/etc/X11/xdm/Xservers"> |
|
|
:0 local /usr/bin/X11/X |
|
|
</pre> |
|
|
|
|
|
<p>to</p> |
|
1590 |
|
|
1591 |
<pre caption="/etc/X11/xdm/Xservers"> |
<pre caption="/etc/X11/xdm/Xservers"> |
1592 |
:0 local /usr/bin/X11/X -nolisten tcp |
:0 local /usr/bin/X11/X -nolisten tcp |
1595 |
</body> |
</body> |
1596 |
</section> |
</section> |
1597 |
|
|
1598 |
<section> |
<commment> |
|
<title>Print services</title> |
|
|
<body> |
|
|
|
|
1599 |
<section> |
<section> |
1600 |
<title>Lpd</title> |
<title>Lpd</title> |
1601 |
<body> |
<body> |
1617 |
|
|
1618 |
</body> |
</body> |
1619 |
</section> |
</section> |
1620 |
|
</commment> |
|
</body> |
|
|
</section> |
|
|
|
|
1621 |
|
|
1622 |
|
|
1623 |
<section> |
<section> |
1763 |
</p> |
</p> |
1764 |
|
|
1765 |
<p> |
<p> |
1766 |
If you have added ssl to your <path>/etc/make.conf</path> before installing apache, you should have access to a ssl enabled server. Just add the following line to enable it. |
If you did not disable ssl in your <path>/etc/make.conf</path> before installing apache, you should have access to a ssl enabled server. Just add the following line to enable it. |
1767 |
</p> |
</p> |
1768 |
|
|
1769 |
<pre caption="/etc/conf.d/apache"> |
<pre caption="/etc/conf.d/apache"> |
1795 |
</body> |
</body> |
1796 |
</section> |
</section> |
1797 |
|
|
1798 |
<section> |
<comment> |
|
<title>Mail</title> |
|
|
<body> |
|
|
|
|
|
|
|
1799 |
<section> |
<section> |
1800 |
<title>Postfix</title> |
<title>Postfix</title> |
1801 |
<body> |
<body> |
1802 |
TODO! |
TODO! |
1803 |
</body> |
</body> |
1804 |
</section> |
</section> |
1805 |
|
</comment> |
1806 |
|
|
1807 |
<section> |
<section> |
1808 |
<title>Qmail</title> |
<title>Qmail</title> |
1813 |
</body> |
</body> |
1814 |
</section> |
</section> |
1815 |
|
|
|
</body> |
|
|
</section> |
|
|
|
|
|
<section> |
|
|
<title>DNS</title> |
|
|
<body> |
|
|
<p> |
|
|
Gentoo supports two different dns servers, Bind and djbdns. |
|
|
</p> |
|
|
|
|
1816 |
<section> |
<section> |
1817 |
<title>Bind</title> |
<title>Bind</title> |
1818 |
<body> |
<body> |
1909 |
</body> |
</body> |
1910 |
</section> |
</section> |
1911 |
|
|
|
</body> |
|
|
</section> |
|
|
|
|
1912 |
<section> |
<section> |
1913 |
<title>Samba</title> |
<title>Samba</title> |
1914 |
<body> |
<body> |
1960 |
</section> |
</section> |
1961 |
|
|
1962 |
<section> |
<section> |
1963 |
<title>Chroot or virtual servers.</title> |
<title>Chroot or virtual servers</title> |
1964 |
<body> |
<body> |
1965 |
<p> |
<p> |
1966 |
Chrooting a service is a way of limiting a service (or user) environment to only accessing what it should and not gaining access (or information) that could lead to root access. By running the service as another user than root (nobody, apache, named) an attacker can only access files with the permissions of this user. This means that an attacker cannot gain root access even if the services has a security flaw. |
Chrooting a service is a way of limiting a service (or user) environment to only accessing what it should and not gaining access (or information) that could lead to root access. By running the service as another user than root (nobody, apache, named) an attacker can only access files with the permissions of this user. This means that an attacker cannot gain root access even if the services has a security flaw. |
2030 |
|
|
2031 |
</body> |
</body> |
2032 |
</section> |
</section> |
|
|
|
2033 |
</chapter> |
</chapter> |
2034 |
|
|
2035 |
-- Securing Services end -- |
-- Securing Services end -- |
2044 |
<body> |
<body> |
2045 |
|
|
2046 |
<p> |
<p> |
2047 |
People often think that a firewall is the ultimate security, but they are wrong. In most cases a mis configured firewall gives worse security than not having one at all. A firewall is also a piece of software and should be treated the same way as any other service, because is just as likely to have bugs (security holes). |
People often think that a firewall provides the ultimate security, but they are wrong. In most cases a misconfigured firewall gives worse security than not having one at all. A firewall is also a piece of software and should be treated the same way as any other piece of software, because is just as likely to contain bugs. |
2048 |
</p> |
</p> |
2049 |
|
|
2050 |
<p> |
<p> |
2051 |
So think before implementing one! Do you really need one ? If you think you need one write a policy on how it should work, what type of firewall and who should operate it. |
So think before implementing one! Do you really need one? If you think you need one write a policy on how it should work, what type of firewall and who should operate it. But first read this guide. |
2052 |
</p> |
</p> |
2053 |
|
|
2054 |
<p> |
<p> |
2056 |
</p> |
</p> |
2057 |
|
|
2058 |
<ul> |
<ul> |
2059 |
<li>To keep users (worms/attackers) out</li> |
<li>To keep users (worms/attackers) out.</li> |
2060 |
<li>To keep users (employees/children) in</li> |
<li>To keep users (employees/children) in.</li> |
2061 |
</ul> |
</ul> |
2062 |
|
|
2063 |
<p> |
<p> |
2065 |
</p> |
</p> |
2066 |
|
|
2067 |
<ul> |
<ul> |
2068 |
<li>Packet filtering</li> |
<li>Packet filtering.</li> |
2069 |
<li>Circuit relay</li> |
<li>Circuit relay.</li> |
2070 |
<li>Application gateway</li> |
<li>Application gateway.</li> |
2071 |
</ul> |
</ul> |
2072 |
|
|
2073 |
<p> |
<p> |
2082 |
<body> |
<body> |
2083 |
|
|
2084 |
<p> |
<p> |
2085 |
All network traffic is in the form of packets. Large amounts of traffic also split up into small packets for easy handling and then reassembled when arriving at it's destination. Every packet contains information on how and where is should be delivered. And these information is exactly what a packing filtering firewall uses. Filtering is based on: |
All network traffic is in the form of packets. Large amounts of traffic also split up into small packets for easy handling and then reassembled when arriving at its destination. In the packet header every packet contains information on how and where it should be delivered. And these informations are exactly what a packing filtering firewall uses. Filtering is based on: |
2086 |
</p> |
</p> |
2087 |
|
|
2088 |
<ul> |
<ul> |
2089 |
|
|
2090 |
<li>Allow or disallow packets based on source/destination IP address.</li> |
<li>Allow or disallow packets based on source/destination IP address.</li> |
2091 |
<li>Allow or disallow packets based on source/destination port.</li> |
<li>Allow or disallow packets based on source/destination port.</li> |
2092 |
<li>Allow or disallow packets according to protocol.</li> |
<li>Allow or disallow packets based on protocol.</li> |
2093 |
<li>Allow or disallow packets according to flags within a specific protocol</li> |
<li>Allow or disallow packets based on flags within a specific protocol.</li> |
2094 |
|
|
2095 |
</ul> |
</ul> |
2096 |
|
|
2097 |
<p> |
<p> |
2098 |
Basically filtering on all data within the header of a packet and not it's content. |
Basically filtering is based on all data within the header of a packet and not its content. |
2099 |
</p> |
</p> |
2100 |
|
|
2101 |
<p> |
<p> |
2103 |
</p> |
</p> |
2104 |
|
|
2105 |
<ul> |
<ul> |
2106 |
<li>Address information in a packet can potentially be a bogus address or as we say <e>spoofed</e> by the sender</li> |
<li>Address information in a packet can potentially be a bogus IP address or as we say <e>spoofed</e> by the sender.</li> |
2107 |
<li>Data or requests within the allowed packet may contain unwanted data that the attacker can use to exploit known bugs in the services on or behind the firewall</li> |
<li>Data or requests within the allowed packet may contain unwanted data that the attacker can use to exploit known bugs in the services on or behind the firewall.</li> |
2108 |
<li>Usually single point of failure</li> |
<li>Usually single point of failure.</li> |
2109 |
</ul> |
</ul> |
2110 |
|
|
2111 |
<p> |
<p> |
2113 |
</p> |
</p> |
2114 |
|
|
2115 |
<ul> |
<ul> |
2116 |
<li>Simple and easy to implement</li> |
<li>Simple and easy to implement.</li> |
2117 |
<li>Can give warnings on a possible attack before they happened (by detecting portscans)</li> |
<li>Can give warnings of a possible attack before it happens (ie. by detecting portscans).</li> |
2118 |
<li>Good for stopping SYN attacks</li> |
<li>Good for stopping SYN attacks.</li> |
2119 |
</ul> |
</ul> |
2120 |
|
|
2121 |
<p> |
<p> |
2136 |
<body> |
<body> |
2137 |
|
|
2138 |
<p> |
<p> |
2139 |
Or circuit level gateways is a firewall that validates connections before allowing data to be exchanged. This means that is simply does not allow or deny packets based based on the header of the packet but determines whether the connection between both ends is valid according to configurable rules before it opens a session and allows data to and from the allowed source address. Filtering is based on: |
Or circuit level gateways is a firewall that validates connections before allowing data to be exchanged. This means that it simply does not allow or deny packets based on the packet header but determines whether the connection between both ends is valid according to configurable rules before it opens a session and allows data to be exchanged. Filtering is based on: |
2140 |
</p> |
</p> |
2141 |
|
|
2142 |
<ul> |
<ul> |
2143 |
<li>Source/destination IP address</li> |
<li>Source/destination IP address.</li> |
2144 |
<li>Source/destination port</li> |
<li>Source/destination port.</li> |
2145 |
<li>A period of time</li> |
<li>A period of time.</li> |
2146 |
<li>Protocol</li> |
<li>Protocol.</li> |
2147 |
<li>User</li> |
<li>User.</li> |
2148 |
<li>Password</li> |
<li>Password.</li> |
2149 |
</ul> |
</ul> |
2150 |
|
|
2151 |
<p> |
<p> |
2152 |
All traffic is validated, monitored and traffic without is disallowed. |
All traffic is validated, monitored and unwanted traffic can be dropped. |
2153 |
</p> |
</p> |
2154 |
|
|
2155 |
<p> |
<p> |
2170 |
<body> |
<body> |
2171 |
|
|
2172 |
<p> |
<p> |
2173 |
The application level gateway is a proxy for application, exchanging data with remote systems on behalf of the clients. It is kept away from the public safely behind a DMZ or firewall with no connection from the outside. Filtering is based on: |
The application level gateway is a proxy for applications, exchanging data with remote systems on behalf of the clients. It is kept away from the public safely behind a DMZ (De-Militarized Zone: the portion of a private network that is visible through the firewall) or a firewall allowing no connections from the outside. Filtering is based on: |
2174 |
</p> |
</p> |
2175 |
|
|
2176 |
<ul> |
<ul> |
2177 |
<li>Allow or disallow based on source/destination IP address</li> |
<li>Allow or disallow based on source/destination IP address.</li> |
2178 |
<li>Based on the packets content</li> |
<li>Based on the packets content.</li> |
2179 |
<li>Can even alter the packet content on the fly</li> |
<li>Limiting file access based on file type or extension.</li> |
|
<li>Limiting file access based on file type or extension</li> |
|
2180 |
</ul> |
</ul> |
2181 |
|
|
2182 |
<p> |
<p> |
2184 |
</p> |
</p> |
2185 |
|
|
2186 |
<ul> |
<ul> |
2187 |
<li>Can cache files, increasing network performance</li> |
<li>Can cache files, increasing network performance.</li> |
2188 |
<li>Detailed logging of all connections</li> |
<li>Detailed logging of all connections.</li> |
2189 |
<li>Scales perfectly (some proxy servers can "share" the cached data)</li> |
<li>Scales perfectly (some proxy servers can "share" the cached data).</li> |
2190 |
<li>No direct access from the outside</li> |
<li>No direct access from the outside.</li> |
2191 |
|
<li>Can even alter the packet content on the fly.</li> |
2192 |
</ul> |
</ul> |
2193 |
|
|
2194 |
<p> |
<p> |
2196 |
</p> |
</p> |
2197 |
|
|
2198 |
<ul> |
<ul> |
2199 |
<li>The setup is complex</li> |
<li>Configuration is complex.</li> |
2200 |
</ul> |
</ul> |
2201 |
|
|
2202 |
<p> |
<p> |
2203 |
Application gateways are considered to be the most secure solution since it does not have to run as root and is not public to the Internet. |
Application gateways are considered to be the most secure solution since it does not have to run as root and the hosts behind it are not reachable from the Internet. |
2204 |
</p> |
</p> |
2205 |
|
|
2206 |
<p> |
<p> |
2219 |
<body> |
<body> |
2220 |
|
|
2221 |
<p> |
<p> |
2222 |
In order to get iptables working, it has to be enabled in the kernel. I have added them as modules (the iptables command will load them as they are needed) and recompiled my kernel. After you have compiled it (or while compiling the kernel) you have to add the iptables commands. Just <c>emerge iptables</c> and it should work. |
In order to get <c>iptables</c> working, it has to be enabled in the kernel. I have added them as modules (the <c>iptables</c> command will load them as they are needed) and recompiled my kernel. For more information on how to configure your kernel for <c>iptables</c> look go to the <uri link="http://iptables-tutorial.frozentux.net/chunkyhtml/kernelsetup.html">Iptables Tutorial Chapter 2: Preparations</uri>. After you have compiled your new kernel (or while compiling the kernel) you have to add the <c>iptables</c> command. Just <c>emerge iptables</c> and it should work. |
2223 |
</p> |
</p> |
2224 |
|
|
2225 |
<p> |
<p> |
2227 |
</p> |
</p> |
2228 |
|
|
2229 |
<p> |
<p> |
2230 |
Iptables is a stateful packet filter which means that it provides greater control and greater security than ipchains (Linux version 2.2) which is not stateful. You are properly asking yourself what is the stateful part? and what is the difference? |
Iptables is the new and heavily improved packet filter in the Linux 2.4.x kernel. It is the successor of the previous ipchains packet filter in the Linux 2.2.x kernel. One of the major improvements is that <c>iptables</c> is able to perform stateful packet filtering. With stateful packet filtering it is possible to keep track of each established TCP connection. |
2231 |
</p> |
</p> |
2232 |
|
|
2233 |
<p> |
<p> |
2234 |
We all know that a TCP connection consists of a series of packets. Each packet contains information about source IP address, the destination IP address and a sequence number so the packets can be reassembled. And we all know that TCP is connection-oriented and UDP is connectionless right? these are the states that is stored .. now you are probably asking yourself and so what? Well I'm getting to that. |
A TCP connection consists of a series of packets containing information about source IP address, destination IP address, sequence number so the packets can be reassembled and not to forget data. TCP is a connection-oriented protocol in contrast to UDP which is connectionless. |
2235 |
</p> |
</p> |
2236 |
|
|
2237 |
<p> |
<p> |
2238 |
Now imagine that you have a stateless firewall (ipchains) and do not want to allow external computers to originate a connection to your internal services but how can the firewall determine whether a packet is part of an ongoing connection or not? A stateless firewall cannot distinguish between an existing connection and one that is part of a new connection by looking at the SYN flag!. |
By examining the TCP packet header a stateful packet filter can determine if a received TCP packet is part of an already established connection or not and decide either to accept or drop the packet. |
2239 |
</p> |
</p> |
2240 |
|
|
2241 |
<p> |
<p> |
2242 |
Lets say an attacker is sending hand crafted packets (a packet created by the attacker) where he alters the SYN flags or any other flags. This is quite often what attackers do. Send packets right through the firewall altering routing tables or compromising services running on the firewall which are supposed to be safe behind a filter. A stateful firewall will keep track of all connections and can thus detect if a received packet does not belong to an existing connection. When a packet not belonging to any existing connection is found it is marked as invalid and can be discarded. This will also stop the possibility of "stealth scans" since the connection was invalid. |
With a stateless packet filter it is possible to fool the packet filter to accept packets that should be dropped by manipulating the TCP packet headers. This could be done by manipulating the SYN flag or other flags in the TCP header. With stateful packet filtering it is possible to drop such packets as they are not part of an already established connection. This will also stop the possibility of "stealth scans" since such packets will not be part of an already established connection. |
2243 |
</p> |
</p> |
2244 |
|
|
2245 |
<p> |
<p> |
2246 |
I could probably find a dozen other reasons but I think you got the picture .. simple rules result in a smaller firewall configuration that is easier to maintain. |
Iptables provides several other features like NAT (Network Address Translation) and rate limiting. Rate limiting is extremely useful when trying to prevent certain DoS (Denial of Service) attacks like SYN floods. |
2247 |
</p> |
</p> |
2248 |
|
|
2249 |
<p> |
<p> |
2250 |
Iptables provides several other features like rate limiting. This features is extremely useful when trying to prevent certain DoS (Denial of Service) attacks like a SYN attack. Now what is a SYN attack? |
A TCP connection is established by a so called three-way handshake. When establishing a TCP connection the client-side sends a packet to the server with the SYN flag set. When the server-side receives the SYN packet it responds by sending a SYN+ACK packet back to the client-side. When the SYN+ACK is received the client-side responds with a third ACK packet in effect acknowledging the connection. |
2251 |
</p> |
</p> |
2252 |
|
|
2253 |
<p> |
<p> |
2254 |
Again .. when creating a connection with TCP it uses three-way handshake to establish the connection like this: |
A SYN flood attack is performed by sending the SYN packet but failing to respond to the SYN+ACK packet. The client-side can forge a packet with a fake source IP address because it does not need a reply. The server-side system will add an entry to a queue of half-open connections when it receives the SYN packet and then wait for the final ACK packet before deleting the entry from the queue. The queue has a limitied number of slots and if all the slots are filled it is unable to open any further connections. If the ACK packet is not received before a specified timeout period the entry will automatically be deleted from the queue. The timeout settings vary but will typically be 30-60 seconds or even more. The client-side initiates the attack by forging a lot of SYN packets with different source IP addresses and sends them to the target IP address as fast as possible and thereby filling up the queue of half-open connections and thus preventing other clients from establishing legitimate with the server. |
2255 |
</p> |
</p> |
2256 |
|
|
|
<fig link="http://www.ibiblio.org/pub/Linux/distributions/gentoo/images/synack.jpg" short="Three-way handshake"/> |
|
|
|
|
2257 |
<p> |
<p> |
2258 |
A SYN attack is when it only sends a SYN packet (header only contains SYN flag) and does not continue sending the last two packets to establish the connection. A SYN packet does not require a valid source IP address because it does not need a reply. So the connection will hang until it times out. Now if the attacker sends a lot of SYN packets with a bogus source IP address, the computer waits for the response, which never comes. Depending on the timeout settings in your system, this connection could stay open for 30-60 seconds (or longer). When the connection limit table is completely occupied and unable to communicate with anyone. |
This is where the rate limit becomes handy. It is possible to limit the rate of accepted SYN packets by using the <c>-m limit --limit 1/s</c>. This will limit the number of SYN packets accepted to one per second and therefor restricting the SYN flood on our resources. |
|
</p> |
|
|
|
|
|
<p> |
|
|
This is where the rate limit becomes handy. It is possible to limit the number of SYN packets from a single source but using the <c>-m limit --limit 1/s</c>. This will limit the SYN packets to one per source and therefor restricting the SYN flood on our resources. |
|
2259 |
</p> |
</p> |
2260 |
|
|
2261 |
<p> |
<p> |
2263 |
</p> |
</p> |
2264 |
|
|
2265 |
<p> |
<p> |
2266 |
When iptables is loaded in the kernel it has 5 hooks where you can place your rules. They are called INPUT, OUTPUT FORWARD, PREROUTING and POSTROUTING. These lists are called chains because they work by added a rules and checks the rules one at the time as they where added. If one rule deny a packet it will be dropped and does not continue down the chain. |
When <c>iptables</c> is loaded in the kernel it has 5 hooks where you can place your rules. They are called INPUT, OUTPUT, FORWARD, PREROUTING and POSTROUTING. Each of these is called a chain and consists of a list of rules. Each rule says if the packet header looks like this, then here is what to do with the packet. If the rule does not match the packet the next rule in the chain is consulted. |
2267 |
</p> |
</p> |
2268 |
|
|
2269 |
<p> |
<p> |
2270 |
You can place rules directly to the 5 main chains or create chains and add them to as a rule to an existing chain. Lets see how this is done |
You can place rules directly in the 5 main chains or create new chains and add them to as a rule to an existing chain. <c>iptables</c> supports the following options. |
2271 |
</p> |
</p> |
2272 |
|
|
2273 |
<table border="0"> |
<table border="0"> |
2355 |
</table> |
</table> |
2356 |
|
|
2357 |
<p> |
<p> |
2358 |
First we will try to block all ICMP packages to our machine, just to get familiar with iptables. |
First we will try to block all ICMP packages to our machine, just to get familiar with <c>iptables</c>. |
2359 |
</p> |
</p> |
2360 |
|
|
2361 |
<pre caption="Block all ICMP packages"> |
<pre caption="Block all ICMP packages"> |
2363 |
</pre> |
</pre> |
2364 |
|
|
2365 |
<p> |
<p> |
2366 |
First we specify the chain it should be appended to. Next to specify the protocol and then the rule. The rule can be a ACCEPT, DROP, REJECT, LOG, QUEUE, MASQUERADE, a loaded module or a user defined chain. In this case we use DROP which will drop the packet without responding to the client. |
First we specify the chain it should be appended to next the protocol and then the target. The target can be the name of a user specified chain or one of the special targets ACCEPT, DROP, REJECT, LOG, QUEUE, MASQUERADE. In this case we use DROP which will drop the packet without responding to the client. |
2367 |
</p> |
</p> |
2368 |
|
|
2369 |
<p> |
<p> |
2370 |
Now try <c>ping localhost</c>. It will not be able to get any response since it is blocking the entire ICMP protocol incoming to our machine. It will not be able to ping other machines either since it is not allowed to get the ICMP packets returning from the host. Now flush the chain to get ICMP flowing again. |
Now try <c>ping localhost</c>. It will not be able to get any response since <c>iptables</c> will drop all incoming ICMP messages. It will not be able to ping other machines either since the ICMP reply packet will be dropped. Now flush the chain to get ICMP flowing again. |
2371 |
</p> |
</p> |
2372 |
|
|
2373 |
<pre caption="Flush all rules"> |
<pre caption="Flush all rules"> |
2375 |
</pre> |
</pre> |
2376 |
|
|
2377 |
<p> |
<p> |
2378 |
Now lets look at the stateful part in iptables. If we wanted to have a stateful inspection of packets incoming on eth0 we could enable it by issuing: |
Now lets look at the stateful packet filtering in <c>iptables</c>. If we wanted to have a stateful inspection of packets incoming on eth0 we could enable it by issuing: |
2379 |
</p> |
</p> |
2380 |
|
|
2381 |
<pre caption="Accept packets that originate from an already established connection"> |
<pre caption="Accept packets that originate from an already established connection"> |
2383 |
</pre> |
</pre> |
2384 |
|
|
2385 |
<p> |
<p> |
2386 |
This will accept any packet already established or related in the INPUT chain. And you could drop any packet that is not in the state table by issuing <c>iptables -A INPUT -i eth0 -m state --state INVALID -j DROP</c> just before. This enables the stateful part in iptables by loading the extension state. If you wanted connection from the outside to connect to you machine you could use the <c>--state NEW</c>. Iptables contain some modules for different purposes. Some of them are: |
This will accept any packet from an already established connection or related in the INPUT chain. And you could drop any packet that is not in the state table by issuing <c>iptables -A INPUT -i eth0 -m state --state INVALID -j DROP</c> just before. This enables the stateful packet filtering in <c>iptables</c> by loading the extension state. If you wanted to allow others to connect to you machine you could use the <c>--state NEW</c>. Iptables contain some modules for different purposes. Some of them are: |
2387 |
</p> |
</p> |
2388 |
|
|
2389 |
<table border="0"> |
<table border="0"> |
2411 |
Lets try to create a user defined chain and apply it to one of the existing chains: |
Lets try to create a user defined chain and apply it to one of the existing chains: |
2412 |
</p> |
</p> |
2413 |
|
|
2414 |
<pre caption="Creating a userdefined chain"> |
<pre caption="Creating a user defined chain"> |
2415 |
<codenote>Create a new chain with one rule</codenote> |
<codenote>Create a new chain with one rule</codenote> |
2416 |
# <i>iptables -X mychain</i> |
# <i>iptables -X mychain</i> |
2417 |
# <i>iptables -N mychain</i> |
# <i>iptables -N mychain</i> |
2436 |
</p> |
</p> |
2437 |
|
|
2438 |
<ul> |
<ul> |
2439 |
<li>Connections to the firewall is only allowed through SSH (port 22)</li> |
<li>Connections to the firewall are only allowed through SSH (port 22).</li> |
2440 |
<li>The local network should have access to HTTP, HTTPS and SSH (DNS should also be allowed)</li> |
<li>The local network should have access to HTTP, HTTPS and SSH (DNS should also be allowed).</li> |
2441 |
<li>ICMP traffic can contain payload and should not be allowed. Of course we have to allow some ICMP traffic.</li> |
<li>ICMP traffic can contain payload and should not be allowed. Of course we have to allow some ICMP traffic.</li> |
2442 |
<li>Port scan should be detected and logged</li> |
<li>Port scans should be detected and logged.</li> |
2443 |
<li>SYN attack should be avoided</li> |
<li>SYN attacks should be avoided.</li> |
2444 |
<li>All other traffic should be dropped and logged</li> |
<li>All other traffic should be dropped and logged.</li> |
2445 |
</ul> |
</ul> |
2446 |
|
|
2447 |
<pre caption="/etc/init.d/firewall"> |
<pre caption="/etc/init.d/firewall"> |
2659 |
</p> |
</p> |
2660 |
|
|
2661 |
<ol> |
<ol> |
2662 |
<li>Create your firewall policy before implementing it</li> |
<li>Create your firewall policy before implementing it.</li> |
2663 |
<li>Keep it simple</li> |
<li>Keep it simple.</li> |
2664 |
<li>Know how the protocol works (read the <uri link="http://www.ietf.org/">RFC (Request For Comments)</uri>)</li> |
<li>Know how the protocol works (read the <uri link="http://www.ietf.org/">RFC (Request For Comments)</uri>).</li> |
2665 |
<li>Keep in mind that a firewall it just another piece of software running as root</li> |
<li>Keep in mind that a firewall it just another piece of software running as root.</li> |
2666 |
<li>Test your firewall</li> |
<li>Test your firewall.</li> |
2667 |
</ol> |
</ol> |
2668 |
|
|
2669 |
<p> |
<p> |
2670 |
If you think that iptables is hard to understand or takes to long to setup a decent firewall you could use <uri link="http://www.shorewall.net">Shorewall</uri>. It basically uses iptables to generate firewall rules, but concentrates on rules and not specific protocols. |
If you think that <c>iptables</c> is hard to understand or takes to long to setup a decent firewall you could use <uri link="http://www.shorewall.net">Shorewall</uri>. It basically uses <c>iptables</c> to generate firewall rules, but concentrates on rules and not specific protocols. |
2671 |
</p> |
</p> |
2672 |
|
|
2673 |
</body> |
</body> |
2678 |
<body> |
<body> |
2679 |
|
|
2680 |
<p> |
<p> |
2681 |
Squid is a very powerful proxy server and it can filter traffic based on: time, regular expression path/uri, source and destination IP addresses, domain, browser, authenticated username, mime-type and port number(protocol). I probably forgot some features, but it can be hard to cover the entire feature list. |
Squid is a very powerful proxy server and it can filter traffic based on: time, regular expressions on path/URI, source and destination IP addresses, domain, browser, authenticated username, MIME type and port number (protocol). I probably forgot some features, but it can be hard to cover the entire feature list. |
2682 |
</p> |
</p> |
2683 |
|
|
2684 |
<p> |
<p> |
2685 |
In the following example I have added a banner filter instead of a filter based on porn sites. The reason for this is that Gentoo.org should <c>not</c> be listed as some porn site. And I do not want to waste my time trying to find some good sites for you. |
In the following example I have added a banner filter instead of a filter based on porn sites. The reason for this is that Gentoo.org should <e>not</e> be listed as some porn site. And I do not want to waste my time trying to find some good sites for you. |
2686 |
</p> |
</p> |
2687 |
|
|
2688 |
<p> |
<p> |
2690 |
</p> |
</p> |
2691 |
|
|
2692 |
<ul> |
<ul> |
2693 |
<li>Surfing (HTTP/HTTPS) is allowed during work hours (mon-fri 8-17 and sat 8-13) if they are here late they should work, not surf</li> |
<li>Surfing (HTTP/HTTPS) is allowed during work hours (mon-fri 8-17 and sat 8-13) if they are here late they should work, not surf.</li> |
2694 |
<li>Download is not allowed (.exe, .com, .arj, .zip, .asf, .avi, .mpg, .mpeg etc.)</li> |
<li>Download is not allowed (.exe, .com, .arj, .zip, .asf, .avi, .mpg, .mpeg etc).</li> |
2695 |
<li>We don't like banners so they are filtered and replaced with a transparent gif (this is where you get creative!)</li> |
<li>We do not like banners so they are filtered and replaced with a transparent gif (this is where you get creative!).</li> |
2696 |
<li>Every other connection to and from the Internet is not allowed</li> |
<li>All other connections to and from the Internet are not allowed.</li> |
2697 |
</ul> |
</ul> |
2698 |
|
|
2699 |
<p> |
<p> |
2834 |
</pre> |
</pre> |
2835 |
|
|
2836 |
<p> |
<p> |
2837 |
And the last part. We want this file to be displayed when it removes a banner. It is basically a half html file with a 4x4 transparent gif image. |
And as the last part we want this file to be displayed when a banner is removed. It is basically a half html file with a 4x4 transparent gif image. |
2838 |
</p> |
</p> |
2839 |
|
|
2840 |
<pre caption="/etc/squid/errors/NOTE_ADS_FILTERED"> |
<pre caption="/etc/squid/errors/NOTE_ADS_FILTERED"> |
2848 |
</pre> |
</pre> |
2849 |
|
|
2850 |
<note> |
<note> |
2851 |
Don't close the <HTML> <BODY> tags. This will be done by squid. |
Do not close the <HTML> <BODY> tags. This will be done by squid. |
2852 |
</note> |
</note> |
2853 |
|
|
2854 |
<p> |
<p> |
2855 |
As you can see, squid has a lot of possibilities and it is very effective in both filtering and proxying. It can even use alternative squid proxies to scale on very large networks. The configuration I have listed here is mostly suited for a small network with 1-20 users. |
As you can see, squid has a lot of possibilities and it is very effective at both filtering and proxying. It can even use alternative squid proxies to scale on very large networks. The configuration I have listed here is mostly suited for a small network with 1-20 users. |
2856 |
</p> |
</p> |
2857 |
|
|
2858 |
<p> |
<p> |
2859 |
But combining the packet filter (iptables) and the application gateway (squid) is probably the best solution, even if squid is located somewhere safe and nobody could access it from the outside. We still need to be concerned on attack from the inside. |
But combining the packet filter (<c>iptables</c>) and the application gateway (squid) is probably the best solution, even if squid is located somewhere safe and nobody can access it from the outside. We still need to be concerned by attacks from the inside. |
2860 |
</p> |
</p> |
2861 |
|
|
2862 |
<p> |
<p> |
2863 |
Now you have to add the proxy server into the settings of your clients browsers. The gateway will prevent the users from having any contact with the outside unless they use the proxy. |
Now you have to configure your clients browsers to use the proxy server. The gateway will prevent the users from having any contact with the outside unless they use the proxy. |
2864 |
</p> |
</p> |
2865 |
<note> |
<note> |
2866 |
In Mozilla this is done in Edit->Preferences->Advanced->Proxies. |
In Mozilla this is done in Edit->Preferences->Advanced->Proxies. |
2867 |
</note> |
</note> |
2868 |
|
|
2869 |
<p> |
<p> |
2870 |
It can also be done transparently by using iptables to forward all traffic out to a squid proxy. This can be done by adding a forwarding/prerouting rule on the gateway: |
It can also be done transparently by using <c>iptables</c> to forward all outbound traffic to a squid proxy. This can be done by adding a forwarding/prerouting rule on the gateway: |
2871 |
</p> |
</p> |
2872 |
|
|
2873 |
<pre caption="Enable portforwarding to our proxyserver"> |
<pre caption="Enable portforwarding to our proxyserver"> |
2888 |
</p> |
</p> |
2889 |
|
|
2890 |
<ol> |
<ol> |
2891 |
<li>A firewall can be a risk itself. A badly configured firewall is worse than not having one at all.</li> |
<li>A firewall can be a risk in itself. A badly configured firewall is worse than not having one at all.</li> |
2892 |
<li>How to setup a basic gateway and a transparent proxy.</li> |
<li>How to setup a basic gateway and a transparent proxy.</li> |
2893 |
<li>The key to a good firewall is to know the protocol you want do allow.</li> |
<li>The key to a good firewall is to know the protocol you want do allow.</li> |
2894 |
<li>That IP traffic does not always contain legitimate data. For an example ICMP packets with payload.</li> |
<li>That IP traffic does not always contain legitimate data ie. ICMP packets can contain payload.</li> |
2895 |
<li>How to prevent SYN attack.</li> |
<li>How to prevent SYN attack.</li> |
2896 |
<li>Filtering HTTP traffic by removing offensive pictures and downloads of viruses.</li> |
<li>Filtering HTTP traffic by removing offensive pictures and downloads of viruses.</li> |
2897 |
<li>Combining packet filters and application gateways gives a better control.</li> |
<li>Combining packet filters and application gateways provides better control.</li> |
2898 |
</ol> |
</ol> |
2899 |
|
|
2900 |
<p> |
<p> |
3133 |
</p> |
</p> |
3134 |
|
|
3135 |
<p> |
<p> |
3136 |
More information can be found at <uri link="http://www.cs.tut.fi/~rammer/aide.html">aide's</uri> projectpage. |
More information can be found at the <uri link="http://www.cs.tut.fi/~rammer/aide.html">AIDE</uri> projectpage. |
3137 |
</p> |
</p> |
3138 |
|
|
3139 |
</body> |
</body> |
3142 |
<section> |
<section> |
3143 |
<title>Snort</title> |
<title>Snort</title> |
3144 |
<body> |
<body> |
3145 |
|
<p> |
3146 |
|
Snort is a Network Intrusion Detection System (NIDS). To install and configure it use the following examples. |
3147 |
|
</p> |
3148 |
|
|
3149 |
<pre caption="Add a user snort to the system"> |
<pre caption="Add a user snort to the system"> |
3150 |
# useradd snort -d /var/log/snort -s /dev/null |
# useradd snort -d /var/log/snort -s /dev/null |
3257 |
</pre> |
</pre> |
3258 |
|
|
3259 |
<p> |
<p> |
3260 |
More information can be found at <uri link="http://www.snort.org">Snorts</uri> website. |
More information can be found at the <uri link="http://www.snort.org">Snort</uri> website. |
3261 |
</p> |
</p> |
3262 |
|
|
3263 |
</body> |
</body> |
3266 |
</chapter> |
</chapter> |
3267 |
|
|
3268 |
-- Intrusion detection end -- |
-- Intrusion detection end -- |
3269 |
|
<comment> |
3270 |
<chapter> |
<chapter> |
3271 |
<title>Changes since last version</title> |
<title>Changes since last version</title> |
3272 |
<section> |
<section> |
3294 |
</body> |
</body> |
3295 |
</section> |
</section> |
3296 |
</chapter> |
</chapter> |
3297 |
|
</comment> |
|
|
|
|
|
|
|
<chapter> |
|
|
<title>FAQ</title> |
|
|
|
|
|
<section> |
|
|
<title>Questions and answers</title> |
|
|
<body> |
|
|
|
|
|
<table border="0"> |
|
|
<tr> |
|
|
<th>Question</th><th>Answer</th> |
|
|
</tr> |
|
|
<tr> |
|
|
<ti>Where can I find the latest version of this guide?</ti><ti>The lastest version should be available on <uri>http://gentoo.org</uri> and the development version at <uri>http://gentoo.insecurity.dk</uri></ti> |
|
|
</tr> |
|
|
</table> |
|
|
|
|
|
</body> |
|
|
</section> |
|
|
</chapter> |
|
|
|
|
|
|
|
3298 |
</guide> |
</guide> |