/[gentoo-dk]/gentoo-dk/pre1/gentoo-security.xml
ViewVC logotype

Diff of /gentoo-dk/pre1/gentoo-security.xml

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.1 by broeman, Mon Sep 22 14:28:12 2003 UTC revision 1.2 by mejlholm, Sat Nov 1 21:46:18 2003 UTC
# Line 1  Line 1 
1  <?xml version='1.0' encoding='iso-8859-1'?>  <?xml version='1.0' encoding='UTF-8'?>
2    
3    
4  <!DOCTYPE guide SYSTEM "/dtd/guide.dtd">  <!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
5  <guide link = "/doc/en/gentoo-security.xml">  <guide link = "/doc/en/gentoo-security.xml">
6  <title>Gentoo Linuxs Sikkerhedsvejledning</title>  <title>Gentoo Linux Security Guide</title>
7  <author title="Forfatter"><mail link="kn@insecurity.dk">Kim Nielsen</mail>  <author title="Author"><mail link="kn@insecurity.dk">Kim Nielsen</mail>
8  </author>  </author>
9    
10  <author title="Redaktør"><mail link="zhen@gentoo.org">John P. Davis</mail>  <author title="Editor"><mail link="zhen@gentoo.org">John P. Davis</mail>
11  </author>  </author>
12    
13  <author title="Redaktør"><mail link="stocke2@gentoo.org">Eric R. Stockbridge</mail>  <author title="Editor"><mail link="stocke2@gentoo.org">Eric R. Stockbridge</mail>
14  </author>  </author>
15    
16  <author title="Redaktør"><mail link="carl@gentoo.org">Carl Anderson</mail>  <author title="Editor"><mail link="carl@gentoo.org">Carl Anderson</mail>
17  </author>  </author>
18    
19  <author title="Redaktør"><mail link="peesh@gentoo.org">Jorge Paulo</mail>  <author title="Editor"><mail link="peesh@gentoo.org">Jorge Paulo</mail>
20  </author>  </author>
21    
22  <author title="Redaktør"><mail link="swift@gentoo.org">Sven Vermeulen</mail>  <author title="Editor"><mail link="swift@gentoo.org">Sven Vermeulen</mail>
23  </author>  </author>
24  <author title="Redaktør"><mail link="bennyc@gentoo.org">Benny Chuang</mail>  
25    <author title="Editor"><mail link="bennyc@gentoo.org">Benny Chuang</mail>
26    </author>
27    
28    <author title="Editor"><mail link="jaervosz@itu.dk">Sune Jeppesen</mail>
29  </author>  </author>
30  <author title="Oversætter"><mail link="bro3man@yahoo.dk">Jesper Brodersen</mail  
31    <author title="Editor"><mail link="blubber@gentoo.org">Tiemo Kieft</mail>
32  </author>  </author>
33    
34  <license/>  <license/>
35    
36  <abstract>  <abstract>
37  Denne vejledning er en trin-for-trin guide for at gøre din Gentoo Linux modstandsdygtig.  This guide is step-by-step guide for hardening Gentoo Linux.
38  </abstract>  </abstract>
39    
40  <version>0.4.2_DK_1.0</version>  <version>0.4.5</version>
41  <date>21. September 2003</date>  <date>September 30, 2003</date>
42    
43  -- Introduction start --  -- Introduction start --
44    
45  <chapter>  <chapter>
46  <title>Introduktion</title>  <title>Introduction</title>
47  <section>  <section>
 <title>Hvem burde læse denne vejledning?</title>  
48  <body>  <body>
49    
50  <p>  <p>
51  Folk, som bruger Gentoo Linux i et server-baseret miljø og/eller føler et behov for et mere eller paranoid sikkerhedsniveau.  This guide is intended for people who are using Gentoo Linux in a server based environment or just feel the need for better security.
52  </p>  </p>
53    
54  </body>  <note>
55  </section>  If you are interested in even more Gentoo security stuff after reading this guide then have a look at the <uri link="http://www.gentoo.org/proj/en/hardened/">Hardened Gentoo Project</uri>
56    </note>
 <section>  
 <title>Credits</title>  
 <body>  
   
 <p>  
 Kim Nielsen  
 </p>  
   
 </body>  
 </section>  
   
 <section>  
 <title>Special thanks</title>  
 <body>  
   
 <p>  
 A special thanks goes to the following people for finding various bugs, spelling mistakes and sentence structure.  
 </p>  
   
 <p>  
 Bjarke Sørensen, Justin Lambert, Andreas Waschbuesch, Duncan Lissett, Sherman Boyd, Sami Dalouche and Väinö Järvelä.  
 </p>  
57    
58  </body>  </body>
59  </section>  </section>
60    
61    <!--
62  <section>  <section>
63  <title>Enhancements for Next Release of this Guide:</title>  <title>Enhancements for future releases of this Guide:</title>
64  <body>  <body>
65    
66  <p>  <p>
# Line 119  quality assurance purposes. Line 103  quality assurance purposes.
103    
104  </body>  </body>
105  </section>  </section>
106    -->
107  </chapter>  </chapter>
108    
109  -- Introduction end --  -- Introduction end --
# Line 133  quality assurance purposes. Line 117  quality assurance purposes.
117  <body>  <body>
118    
119  <p>  <p>
120  No matter how many safeguards you implement, it can all be easily circumvented if  No matter how many safeguards you implement, all can easily be circumvented if
121  the attacker can gain physical access to your box.  Make sure your hardware is not  the attacker can gain physical access to your box.  Make sure your hardware is not
122  casually accessible. For example, you may want to place your box  casually accessible. For example, you may want to place your box
123  in a locked server closet.  Locking cases is a good idea too.  For the highest level  in a locked server closet.  Locking cases is a good idea too.  For the highest level
124  of security set your BIOS to restrict booting to your hard drive only.  of security set your BIOS to restrict booting to your hard drive only.
125  Disable booting from the floppy and CD-ROM drive.  For the paranoid, enabling the  Disable booting from the floppy and CD-ROM drives.  For the paranoid, enabling the
126  BIOS password is a good idea.  BIOS passwords are also a good idea for laptop users.  BIOS password is a good idea.  BIOS passwords are also a good idea for laptop users.
127  </p>  </p>
128    
# Line 153  BIOS password is a good idea.  BIOS pass Line 137  BIOS password is a good idea.  BIOS pass
137  Document what services the machine should run or is supposed to run. This will help  Document what services the machine should run or is supposed to run. This will help
138  you compose a better partition scheme for the system.  It can also make your  you compose a better partition scheme for the system.  It can also make your
139  intrusion detection strategy much easier.  intrusion detection strategy much easier.
 </p>  
   
 <p>  
140  Of course you should not document this if you only have one or a few computers and  Of course you should not document this if you only have one or a few computers and
141  you are the only one using them.  you are the only one using them.
142  </p>  </p>
# Line 169  The Computer is supposed to act as a fir Line 150  The Computer is supposed to act as a fir
150  </p>  </p>
151    
152  <p>  <p>
153  <e>none</e>, except maybe ssh.  <e>none</e>, except maybe <c>sshd</c>.
154  </p>  </p>
155    
156  <p>  <p>
157  Document this and the current version of SSH - it will help you keep track of which system to upgrade in case someone finds a security hole in sshd. This will also aid in determining who should have access to the system.  Document this and the current version of SSH - it will help you keep track of which system to upgrade in case someone finds a security hole in <c>sshd</c>. This will also aid in determining who should have access to the system.
158  </p>  </p>
159    
160  </body>  </body>
# Line 190  Golden rules: Line 171  Golden rules:
171  <ul>  <ul>
172    
173  <li>  <li>
174  Any directory tree a user should be able to write to (/home and /tmp /var), should be on a separate partition and use disk quotas. Portage uses /var/tmp to compile files so that partition should be large. This reduces the risk of a user filling up your "/" mount point.  Any directory tree a user should be able to write to (<path>/home</path> and <path>/tmp</path> <path>/var</path>), should be on a separate partition and use disk quotas. Portage uses <path>/var/tmp</path> to compile files so that partition should be large. This reduces the risk of a user filling up your <path>/</path> mount point.
175  </li>  </li>
176    
177  <li>  <li>
178  Any directory tree where you want to install non-distribution software should be on a separate partition. According to the <uri link="http://www.pathname.com/fhs/">File Hierarchy Standard</uri>, this is <path>/opt</path> or /usr/local. If these are separate partitions, they will not be erased if you have to reinstall the system.  Any directory tree where you want to install non-distribution software should be on a separate partition. According to the <uri link="http://www.pathname.com/fhs/">File Hierarchy Standard</uri>, this is <path>/opt</path> or <path>/usr/local</path>. If these are separate partitions, they will not be erased if you have to reinstall the system.
179  </li>  </li>
180    
181  <li>  <li>
# Line 209  Try to move static data to its own parti Line 190  Try to move static data to its own parti
190  <title>The root user</title>  <title>The root user</title>
191  <body>  <body>
192  <p>  <p>
193  The user 'root' is the most vital user on the system and should not be used for anything except if it's necessary. If an attacker gains root access you can no longer trust your system, so reinstall.  The user 'root' is the most vital user on the system and should not be used for anything except if it is necessary. If an attacker gains root access you can no longer trust your system, so reinstall.
194  </p>  </p>
195    
196  <p>  <p>
# Line 231  Always use absolute paths when logged in Line 212  Always use absolute paths when logged in
212  </li>  </li>
213    
214  <li>  <li>
215  If a user only needs a few commands instead of everything that root normally can do, consider using sudo, but be careful with this!  If a user only needs a few commands instead of everything that root normally can do, consider using <c>sudo</c>, but be careful with this!
216  </li>  </li>
217    
218  <li>  <li>
# Line 241  Never leave the terminal when you are lo Line 222  Never leave the terminal when you are lo
222  </ul>  </ul>
223    
224  <p>  <p>
225  Gentoo has general protection against normal users, trying to su. The default PAM setting states that a users has to be a member of wheel in order to be able to su.  Gentoo has general protection against normal users, trying to <c>su</c>. The default PAM setting states that a users has to be a member of wheel in order to be able to su.
226  </p>  </p>
227    
228  </body>  </body>
229  </section>  </section>
230    
231  <section>  <section>
232  <title>Policies</title>  <title>Security policies</title>
 <body>  
 <section>  
 <title>Why policies are needed</title>  
233  <body>  <body>
234    
235  <p>There are several reasons why policies are needed.</p>  <p>There are several reasons why security policies are needed.</p>
236    
237  <ul>  <ul>
238    
# Line 263  You cannot claim to have a secure networ Line 241  You cannot claim to have a secure networ
241  </li>  </li>
242    
243  <li>  <li>
244  It's almost impossible to catch potential attackers, resolve network problems, or conduct audits, without spying on network traffic or looking in private home directories. And spying without the users agreement is illegal in most countries. And since about 60% of all attacks currently come from inside the organization, it's important that you keep an open eye.  It is almost impossible to catch potential attackers, resolve network problems, or conduct audits, without spying on network traffic or looking in private home directories. And spying without the users agreement is illegal in most countries. And since about 60% of all attacks currently come from inside the organization, it is important that you keep an open eye.
245  </li>  </li>
246    
247  <li>  <li>
# Line 275  Good guidelines and network documentatio Line 253  Good guidelines and network documentatio
253  </li>  </li>
254    
255  <li>  <li>
256  Police or federal law enforcement can't help you catch the attacker, if they don't know your network configuration or the services that you provide.  Police or federal law enforcement can not help you catch the attacker, if they do not know your network configuration or the services that you provide.
257  </li>  </li>
258    
259  <li>  <li>
# Line 285  What will you do when there has been an Line 263  What will you do when there has been an
263  </ul>  </ul>
264    
265  <p>  <p>
266  This should clearly state why it is important to create policies on systems with more than one user and why it's important to educate users.  This should clearly state why it is important to create policies for systems with more than one user and why it is important to educate users.
267  </p>  </p>
268    
269  <p>  <p>
270  A policy is a document (or several documents) with answers to questions like who, where, why and what.  A policy is a document (or several documents) with answers to questions like who, where, why and what.
271  Every user on your system/network should read, understand and sign it. It is important that you take the time to help the users understand the policy and why the policy needs to be signed or what will happens if they act directly against the policy (the policy should also state this). This should be repeated at least once a year since the policy can change but also as a reminder to the user.  Every user on your system/network should read, understand and sign it. It is important that you take the time to help the users understand the policy and why the policy needs to be signed or what will happens if they act directly against the policy (the policy should also state this). This should be repeated at least once a year since the policy can change but also as a reminder to the user.
272  </p>  </p>
 <note>Create policies that are easy to read and be very clear/specific on every subject.</note>  
273    
274  <p>  <note>Create policies that are easy to read and be very precise on every subject.</note>
 Most parts of a policy can be enforced directly in the operating system or through firewalls and others cannot.  
 </p>  
   
 </body>  
 </section>  
   
 <section>  
 <title>Security policies</title>  
 <body>  
275    
276  <p>  <p>
277  A security policy is basically a set of rules that will insure your network/host security. It is basically a document containing information on how computer, network, password, email and even how users should or should not behave, how to act when attacked, how machines (workstation/servers) are installed, infrastructure etc.  Most parts of a policy can be enforced directly in the operating system or through firewalls and others cannot.
278  </p>  </p>
279    
280  <p>  <p>
# Line 319  A security policy should at least contai Line 287  A security policy should at least contai
287  <ul>  <ul>
288    <li>Screen savers.</li>    <li>Screen savers.</li>
289    <li>Password handling.</li>    <li>Password handling.</li>
290    <li>Download of software.</li>    <li>Software download and installation.</li>
291    <li>Knowledge of if they are being monitored.</li>    <li>Information stating if the users are being monitored.</li>
292    <li>Use of anti-virus software.</li>    <li>Use of anti-virus software.</li>
   <li>etc.</li>  
293  </ul>  </ul>
294    
295  <li>Handling of sensitive information (any written form, paper or digital).</li>  <li>Handling of sensitive information (any written form, paper or digital).</li>
# Line 355  Examples of policies can be found at the Line 322  Examples of policies can be found at the
322    
323  </body>  </body>
324  </section>  </section>
 </body>  
 </section>  
325  </chapter>  </chapter>
326    
327  -- Considerations before installation end --  -- Considerations before installation end --
# Line 366  Examples of policies can be found at the Line 331  Examples of policies can be found at the
331  <chapter>  <chapter>
332  <title>Tightening the security after/during installation</title>  <title>Tightening the security after/during installation</title>
333  <section>  <section>
334  <title>/etc/make.conf</title>  <title>USE flags</title>
335  <body>  <body>
336    
337  <p>  <p>
338  The make.conf file contains all the options and extra libraries that you want to have support for when building ebuilds. In this file you must make sure that if the ebuild supports any security library like PAM (Pluggable Authentication Modules), tcp wrappers or SSL (Secure Socket Layer) it will add support for it. Your global USE variable should contain pam, tcpd and ssl.  The <path>make.conf</path> file contains user defined USE flags and <path>/etc/make.profile/make.defaults</path> contains the default USE flags for Gentoo Linux. For this guide the important flags are pam (Pluggable Authentication Modules), tcpd (TCP wrappers) and ssl (Secure Socket Layer). These are all in the default USE flags.
 </p>  
   
 <p>  
 So add something like this:  
339  </p>  </p>
340    
 <pre caption="USE settings to be added">  
 USE="tcpd pam ssl"  
 </pre>  
   
341  </body>  </body>
342  </section>  </section>
343    
344  <section>  <section>
345  <title>GRUB/LILO password</title>  <title>GRUB password</title>
 <body>  
 <section>  
 <title>GRUB</title>  
346  <body>  <body>
347    
348  <p>  <p>
# Line 405  This will add the password <e>changeme</ Line 359  This will add the password <e>changeme</
359  </p>  </p>
360    
361  <p>  <p>
362  When adding a md5 password, you need to convert the password into crypt format (man crypt) which is the same format as the shadow file. For example could the encrypted password <e>changeme</e> look like this <e>$1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.</e>  When adding a md5 password, you need to convert the password into crypt format (man crypt) which is the same format as the shadow file. For example the encrypted password <e>changeme</e> look like this <e>$1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.</e>
363  </p>  </p>
364    
365  <p>  <p>
366  Or this:  Or this you can convert it directly in the grub shell:
367    </p>
368    
369    <pre caption="md5crypt in grub shell">
370    #<i>/sbin/grub</i>
371    
372        GRUB  version 0.92  (640K lower / 3072K upper memory)
373    
374       [ Minimal BASH-like line editing is supported.  For the first word, TAB
375         lists possible command completions.  Anywhere else TAB lists the possible
376         completions of a device/filename. ]
377    
378    grub> <i>md5crypt</i>
379    
380    Password: <i>********</i>
381    <codenote>Typed changeme</codenote>
382    Encrypted: $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.
383    
384    grub> <i>quit</i>
385    </pre>
386    
387    <p>
388    Then, cut and paste your password to <path>/boot/grub/grub.grub</path>.
389  </p>  </p>
390    
391  <pre caption="/boot/grub/grub.conf">  <pre caption="/boot/grub/grub.conf">
# Line 417  timeout 5 Line 393  timeout 5
393  password --md5 $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.  password --md5 $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.
394  </pre>  </pre>
395    
 <warn>  
 When testing this, remember to insert the timeout. Otherwise you will not be able to boot the system, if your password is incorrect.  
 </warn>  
   
396  <p>  <p>
397  The timeout on 5 seconds becomes very handy if the system is remote and should be able to reboot without any keyboard interaction. More on Grub passwords can be found by executing <path>info grub</path>  The 5 seconds timeout become handy if the system is remote and should be able to reboot without any keyboard interaction. More on Grub passwords can be found by executing <c>info grub</c>
398  </p>  </p>
399    
400  </body>  </body>
401  </section>  </section>
402    
403  <section>  <section>
404  <title>LILO</title>  <title>LILO password</title>
405  <body>  <body>
406    
407  <p>  <p>
# Line 467  In order to store the new information in Line 439  In order to store the new information in
439    
440  </body>  </body>
441  </section>  </section>
 </body>  
 </section>  
442    
443  <section>  <section>
444  <title>Restricting Console Usage</title>  <title>Restricting Console Usage</title>
# Line 487  vc/1 Line 457  vc/1
457    
458  </body>  </body>
459  </section>  </section>
460    </chapter>
461    
462  <section>  <chapter>
463  <title>More logging</title>  <title>More logging</title>
464    <section>
465  <body>  <body>
466    
467  <p>  <p>
# Line 513  Syslogd is the most common logger for Li Line 485  Syslogd is the most common logger for Li
485  </p>  </p>
486    
487  <p>  <p>
488  Here is an example of how you can configure syslog  Below is the standard <path>syslog.conf</path> with some added features. We have uncommented the <c>cron</c> and <c>tty</c> lines and added a remote logging server. To further enhance security you could add logs in two places.
489  </p>  </p>
490    
491  <pre caption="/etc/syslog.conf">  <pre caption="/etc/syslog.conf">
 *.=debug                   /var/log/debug  
 *.err                      /var/log/syslog  
   
 #Users who should the see message if they are logged in.  
 *.=alert                   root,<c>your user name here</c>  
 *.=emerg                   root,<c>your user name here</c>  
   
 mail.info,mail.notice      /var/log/maillog  
 kern.*                     /var/log/kern.log  
 daemon.info;daemon.notice  /var/log/daemon.log  
 cron.*                     /var/log/cron.log  
 mail.*                     /var/log/mail.log  
 user.*                     /var/log/user.log  
 uucp.*                     /var/log/uucp.log  
 *.*;auth,authpriv.none     /var/log/syslog  
   
 #Place the log file in 2 places  
 authpriv.*;auth.*          /admin/auth.log  
 authpriv.*;auth.*          /var/log/secure  
492    
493  #Write everything on the console  #  /etc/syslog.conf     Configuration file for syslogd.
494  *.*                        /dev/tty12  #
495    #                       For more information see syslog.conf(5)
496    #                       manpage.
497    #                       This is from Debian, we are using it for now
498    #                       Daniel Robbins, 5/15/99
499    
500    #
501    # First some standard logfiles.  Log by facility.
502    #
503    
504    auth,authpriv.*                 /var/log/auth.log
505    *.*;auth,authpriv.none          -/var/log/syslog
506    cron.*                         /var/log/cron.log
507    daemon.*                        -/var/log/daemon.log
508    kern.*                          -/var/log/kern.log
509    lpr.*                           -/var/log/lpr.log
510    mail.*                          /var/log/mail.log
511    user.*                          -/var/log/user.log
512    uucp.*                          -/var/log/uucp.log
513    local6.debug                    /var/log/imapd.log
514    
515    #
516    # Logging for the mail system. Split it up so that
517    # it is easy to write scripts to parse these files.
518    #
519    mail.info                       -/var/log/mail.info
520    mail.warn                       -/var/log/mail.warn
521    mail.err                        /var/log/mail.err
522    
523    # Logging for INN news system
524    #
525    news.crit                       /var/log/news/news.crit
526    news.err                        /var/log/news/news.err
527    news.notice                     -/var/log/news/news.notice
528    
529    #
530    # Some `catch-all' logfiles.
531    #
532    *.=debug;\
533            auth,authpriv.none;\
534            news.none;mail.none     -/var/log/debug
535    *.=info;*.=notice;*.=warn;\
536            auth,authpriv.none;\
537            cron,daemon.none;\
538            mail,news.none          -/var/log/messages
539    
540    #
541    # Emergencies and alerts are sent to everybody logged in.
542    #
543    *.emerg                         *
544    *.=alert                        *
545    
546    #
547    # I like to have messages displayed on the console, but only on a virtual
548    # console I usually leave idle.
549    #
550    daemon,mail.*;\
551           news.=crit;news.=err;news.=notice;\
552           *.=debug;*.=info;\
553           *.=notice;*.=warn       /dev/tty8
554    
555  #Or setup a remote logging server  #Setup a remote logging server
556  *.*                        @logserver  *.*                        @logserver
 </pre>  
557    
558  <p>  # The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
559  The attacker will most likely try to erase their tracks by editing or deleting the log files. You can make it harder for the attacker by sending the log to one or more logging servers on different machines.  # you must invoke `xconsole' with the `-file' option:
560  </p>  #
561    #    $ xconsole -file /dev/xconsole [...]
562    #
563    # NOTE: adjust the list below, or you'll go crazy if you have a reasonably
564    #      busy site..
565    #
566    #daemon.*,mail.*;\
567    #       news.crit;news.err;news.notice;\
568    #       *.=debug;*.=info;\
569    #       *.=notice;*.=warn       |/dev/xconsole
570    
571    local2.*                -/var/log/ppp.log
572    </pre>
573    
574  <p>  <p>
575  More info about syslogd can be found in the man page (<path>man syslog</path>)  The attacker will most likely try to erase their tracks by editing or deleting the log files. You can make it harder for the attacker by sending the log to one or more logging servers on different machines. More info about syslogd can be found in the man page (<c>man syslog</c>)
576  </p>  </p>
577    
578  </body>  </body>
# Line 561  More info about syslogd can be found in Line 584  More info about syslogd can be found in
584    
585  <p>  <p>
586  <uri link="http://metalog.sourceforge.net">Metalog</uri> by Frank Dennis is not able to log to a remote server, but it does have advantages when it comes to performance and logging flexibility.  <uri link="http://metalog.sourceforge.net">Metalog</uri> by Frank Dennis is not able to log to a remote server, but it does have advantages when it comes to performance and logging flexibility.
587  </p>  It can log by program name, urgency, by facility (like syslogd) and comes with regular expression matching and it can launch external scripts when specific patterns are found. It is very good for taking action when needed.
   
 <p>  
 It can log by program name or by facility (like syslogd) and comes with regular expression matching and execution of commands. Very good for taking action when needed.  
588  </p>  </p>
589    
 <pre caption="/etc/metalog/metalog.conf">  
 maxsize  = 1000000  
 maxtime  = 86400  
 maxfiles = 7  
 minimum  = 7  
   
 Kernel messages :  
   
   facility = "kern"  
   logdir   = "/var/log/kernel"  
   
 Auth messages :  
   facility = "auth"  
   logdir   = "/var/log/auth"  
   
 Critical :  
   facility = "critical"  
   command  = "/usr/local/sbin/pwdfail.sh"    
   
 Crond :  
   
   program  = "crond"  
   logdir   = "/var/log/crond"  
     
 Password failures :  
   
   regex    = "(password|login|authentication)\s+(fail|invalid)"  
   regex    = "(failed|invalid)\s+(password|login|authentication)"  
   regex    = "ILLEGAL ROOT LOGIN"  
   logdir   = "/var/log/pwdfail"  
   command  = "/usr/local/sbin/pwdfail.sh"  
   
 SSH Server :  
   
   program  = "sshd"  
   logdir   = "/var/log/sshd"  
   
 Mail :  
   
   facility = "ftp-mail-news"  
   logdir   = "/var/log/mail"  
   
 Snort:  
   program   = "snort"  
   command  = "/usr/local/sbin/pwdfail.sh"  
   
 Everything important :  
   
   facility = "*"  
   logdir   = "/var/log/everything"  
   
 Everything very important :  
   
   facility = "*"  
   logdir   = "/var/log/critical"  
   
 </pre>  
   
590  <p>  <p>
591  This is basically a standard configuration with a few modifications, like a minimum logging level at 7, which means that everything will be logged.  The standard configuration is basically enough. If you want to be notified by email whenever a password failure occurs use one of the following scripts.
592  </p>  </p>
593    
594  <p>  <p>
595  pwdfail.sh for postfix.  For postfix:
596  </p>  </p>
597    
598  <pre caption = "postfix' pwdfail.sh">  <pre caption = "/usr/local/sbin/mail_pwd_failures.sh for postfix">
599  #! /bin/sh  #! /bin/sh
600  echo "$3" | mail -s "Warning (program : $2)" root  echo "$3" | mail -s "Warning (program : $2)" root
601  </pre>  </pre>
602    
603  <p>  <p>
604  pwdfail.sh for qmail.  For qmail:
605  </p>  </p>
606    
607  <pre caption = "qmail's pwdfail.sh">  <pre caption = "/usr/local/sbin/mail_pwd_failures.sh for qmail">
608  #!/bin/sh  #!/bin/sh
609  echo "To: root  echo "To: root
610  Subject:Failure (Warning: $2)  Subject:Failure (Warning: $2)
# Line 651  $3 Line 613  $3
613  </pre>  </pre>
614    
615  <p>  <p>
616  More information can be found in the <uri link="http://metalog.sourceforge.net">metalog</uri> website.  Remember to make the script executable by issuing <c>chmod +x /usr/local/sbin/mail_pwd_failures.sh</c>
617  </p>  </p>
618    
619    <p>
620    Then uncomment the command line under Password failures in
621    <path>/etc/metalog/metalog.conf</path> like:
622    </p>
623    
624    <pre caption="/etc/metalog/metalog.conf">
625    command  = "/usr/local/sbin/mail_pwd_failures.sh"
626    </pre>
627    
628  </body>  </body>
629  </section>  </section>
630    
631  <section>  <section>
632    
633  <title>Syslog-ng</title>  <title>Syslog-ng</title>
# Line 757  And syslog-ng does have other advantages Line 728  And syslog-ng does have other advantages
728  </section>  </section>
729  </body>  </body>
730  </section>  </section>
731    </chapter>
732    
733    <chapter>
734    <title>Mounting partitions</title>
735  <section>  <section>
 <title>Mounting of partitions</title>  
736  <body>  <body>
737    
738  <p>  <p>
# Line 808  Note that I do not set <path>/var</path> Line 781  Note that I do not set <path>/var</path>
781    
782  </body>  </body>
783  </section>  </section>
784    </chapter>
785    
786  <section>  <chapter>
787  <title>User/group limitations</title>  <title>User/group limitations</title>
 <body>  
788    
789  <section>  <section>
790  <title>/etc/security/limits.conf</title>  <title>/etc/security/limits.conf</title>
# Line 855  kn L10 C100000 U35 Line 828  kn L10 C100000 U35
828  </pre>  </pre>
829    
830  <p>  <p>
831  Here we set the default settings and a specific setting for the user <e>kn</e>. Limits are part of the shadow package and only applies for the shadow login program. It is not necessary to set any limitations in this file, if you have set the PAM setting in your make.conf and configured PAM properly.  Here we set the default settings and a specific setting for the user <e>kn</e>. Limits are part of the shadow package and only apply to the shadow login program. It is not necessary to set any limitations in this file if you haven't enabled pam in your <path>make.conf</path> and configured PAM properly.
832  </p>  </p>
833    
834  </body>  </body>
# Line 999  This will setup login access so members Line 972  This will setup login access so members
972    
973  </body>  </body>
974  </section>  </section>
975    </chapter>
976    
977    <chapter>
978    <title>File permissions</title>
979  <section>  <section>
 <title>File permissions.</title>  
980  <body>  <body>
981    
982  <section>  <section>
983  <title>World readable.</title>  <title>World readable</title>
984  <body>  <body>
985    
986  <p>  <p>
# Line 1016  Normal users should not have access to c Line 991  Normal users should not have access to c
991  </section>  </section>
992    
993  <section>  <section>
994  <title>World/Group writable.</title>  <title>World/Group writable</title>
995  <body>  <body>
996    
997  <pre caption="Finding world-writable files and directories">  <pre caption="Finding world-writable files and directories">
# Line 1087  The only SUID files that I have on my sy Line 1062  The only SUID files that I have on my sy
1062    
1063  </body>  </body>
1064  </section>  </section>
1065    </chapter>
1066    
1067    <chapter>
 <section>  
1068  <title>PAM (Pluggable Authentication Modules)</title>  <title>PAM (Pluggable Authentication Modules)</title>
1069    <section>
1070  <body>  <body>
1071    
1072  <p>  <p>
1073  PAM is a suite of shared libraries that provide an alternative way of making authentication in programs. The PAM settings of Gentoo Linux is pretty reasonable, but there is always room for improvement.  PAM is a suite of shared libraries that provide an alternative way of making authentication in programs. The PAM settings of Gentoo Linux is pretty reasonable, but there is always room for improvement.
1074  </p>  </p>
 <note>This chapter will have no effect if you did not include the PAM in your USE option in <path>/etc/make.conf</path></note>  
1075    
1076  <p>Install cracklib</p>  <p>Install cracklib</p>
1077    
# Line 1145  session  required pam_warn.so Line 1120  session  required pam_warn.so
1120    
1121  </body>  </body>
1122  </section>  </section>
1123    </chapter>
1124    
1125  <section>  <chapter>
1126  <title>TCP Wrappers</title>  <title>TCP Wrappers</title>
1127    <section>
1128  <body>  <body>
1129    
1130  <p>  <p>
1131  Is a way of controlling access to services normally run by inetd (which Gentoo does not have) but it can also be used by xinetd and other services.  Is a way of controlling access to services normally run by inetd (which Gentoo does not have) but it can also be used by xinetd and other services.
1132  </p>  </p>
1133  <note>The use in make.conf should contain tcpd and the service should be executing tcpd in its server argument (in xinetd). See the chapter on xinetd for more information</note>  <note>The service should be executing tcpd in its server argument (in xinetd). See the chapter on xinetd for more information</note>
1134    
1135  <pre caption="/etc/hosts.deny">  <pre caption="/etc/hosts.deny">
1136  ALL:PARANOID  ALL:PARANOID
# Line 1174  It is also possible to execute commands Line 1151  It is also possible to execute commands
1151    
1152  </body>  </body>
1153  </section>  </section>
   
   
 </body>  
 </section>  
1154  </chapter>  </chapter>
1155    
1156  -- Tightening the security after/during installation end --  -- Tightening the security after/during installation end --
# Line 1324  start() { Line 1297  start() {
1297  </section>  </section>
1298    
1299  <section>  <section>
 <title>Kernel patches</title>  
 <body>  
 <section>  
1300  <title>Grsecurity</title>  <title>Grsecurity</title>
1301  <body>  <body>
1302    
# Line 1422  And there is probably a lot more .. Line 1392  And there is probably a lot more ..
1392    
1393  </body>  </body>
1394  </section>  </section>
   
 </body>  
 </section>  
   
1395  </chapter>  </chapter>
1396    
1397  -- Kernel security end --  -- Kernel security end --
# Line 1581  This will add two files in your <path>~/ Line 1547  This will add two files in your <path>~/
1547  </section>  </section>
1548    
1549  <section>  <section>
1550  <title>Securing X</title>  <title>X</title>
1551  <body>  <body>
1552    
1553  <p>  <p>
1554  Per default XFree is configured to act as a Xserver. This can be dangerous since X uses unencrypted tcp connections and listens for xclients. If you do not need this service disable it! But if you depend on using your workstation as a Xserver use the <path>/usr/X11R6/bin/xhost</path> command with caution. This command allows clients from other hosts to connect and use your display. This can become handy if you need an X application from a different machine and the only way is through the network. The syntax is <path>/usr/X11R6/bin/xhost +hostname</path>  Per default XFree is configured to act as a Xserver. This can be dangerous since X uses unencrypted TCP connections and listens for xclients. If you do not need this service disable it! But if you depend on using your workstation as a Xserver use the <path>/usr/X11R6/bin/xhost</path> command with caution. This command allows clients from other hosts to connect and use your display. This can become handy if you need an X application from a different machine and the only way is through the network. The syntax is <path>/usr/X11R6/bin/xhost +hostname</path>
1555  </p>  </p>
1556  <warn>Don't ever use the xhost + feature! This will allow any client to connect and take control of your X. If an attacker can get access to your X, he can log your keystrokes and control your desktop.</warn>  <warn>Do not ever use the <c>xhost +</c>feature! This will allow any client to connect and take control of your X. If an attacker can get access to your X, he can log your keystrokes and control your desktop.</warn>
1557    
1558  <p>  <p>
1559  A more secure solution is to disable this feature completely by starting you X with <c>startx -- -nolisten</c> tcp or disable it permanently in the configuration file by changing the line  A more secure solution is to disable this feature completely by starting X with <c>startx -- -nolisten</c> tcp or disable it permanently in the configuration.
1560  </p>  </p>
 <pre caption="/usr/X11R6/bin/startx">  
 defaultserverargs=""  
 </pre>  
1561    
 <p> to </p>  
1562  <pre caption="/usr/X11R6/bin/startx">  <pre caption="/usr/X11R6/bin/startx">
1563  defaultserverargs="-nolisten tcp"  defaultserverargs="-nolisten tcp"
1564  </pre>  </pre>
1565    
1566  <p>  <p>
1567  To make sure that <c>startx</c> doesn't get overwritten when you emerge  To make sure that <c>startx</c> does not get overwritten when emerging
1568  a newer XFree you must protect it. Add the following line to  a new version of XFree you must protect it. Add the following line to
1569  <path>/etc/make.conf</path>:  <path>/etc/make.conf</path>:
1570  </p>  </p>
1571    
# Line 1615  CONFIG_PROTECT_MASK="/usr/X11R6/bin/star Line 1577  CONFIG_PROTECT_MASK="/usr/X11R6/bin/star
1577  If you use a graphical login manager you need a different approach.  If you use a graphical login manager you need a different approach.
1578  </p>  </p>
1579    
 <p>gdm (Gnome Display Manager)</p>  
   
 <p>Change:</p>  
 <pre caption="/etc/X11/gdm/gdm.conf">  
 [server-Standard]  
 command=/usr/X11R6/bin/X  
 </pre>  
1580  <p>  <p>
1581  to  For gdm.
1582  </p>  </p>
1583    
1584  <pre caption="/etc/X11/gdm/gdm.conf">  <pre caption="/etc/X11/gdm/gdm.conf">
1585  [server-Standard]  [server-Standard]
1586  command=/usr/X11R6/bin/X -nolisten tcp  command=/usr/X11R6/bin/X -nolisten tcp
1587  </pre>  </pre>
1588    
1589  <p>xdm (X Display Manager) and kdm (Kde Display Manager)</p>  <p>For xdm (X Display Manager) and kdm (Kde Display Manager)</p>
   
 <p>Change</p>  
 <pre caption="/etc/X11/xdm/Xservers">  
 :0 local /usr/bin/X11/X  
 </pre>  
   
 <p>to</p>  
1590    
1591  <pre caption="/etc/X11/xdm/Xservers">  <pre caption="/etc/X11/xdm/Xservers">
1592  :0 local /usr/bin/X11/X -nolisten tcp  :0 local /usr/bin/X11/X -nolisten tcp
# Line 1646  command=/usr/X11R6/bin/X -nolisten tcp Line 1595  command=/usr/X11R6/bin/X -nolisten tcp
1595  </body>  </body>
1596  </section>  </section>
1597    
1598  <section>  <commment>
 <title>Print services</title>  
 <body>  
   
1599  <section>  <section>
1600  <title>Lpd</title>  <title>Lpd</title>
1601  <body>  <body>
# Line 1671  TODO Line 1617  TODO
1617    
1618  </body>  </body>
1619  </section>  </section>
1620    </commment>
 </body>  
 </section>  
   
1621    
1622    
1623  <section>  <section>
# Line 1820  Apache (1.3.26) comes with a pretty dece Line 1763  Apache (1.3.26) comes with a pretty dece
1763  </p>  </p>
1764    
1765  <p>  <p>
1766  If you have added ssl to your <path>/etc/make.conf</path> before installing apache, you should have access to a ssl enabled server. Just add the following line to enable it.  If you did not disable ssl in your <path>/etc/make.conf</path> before installing apache, you should have access to a ssl enabled server. Just add the following line to enable it.
1767  </p>  </p>
1768    
1769  <pre caption="/etc/conf.d/apache">  <pre caption="/etc/conf.d/apache">
# Line 1852  Documentation can be found at <uri>http: Line 1795  Documentation can be found at <uri>http:
1795  </body>  </body>
1796  </section>  </section>
1797    
1798  <section>  <comment>
 <title>Mail</title>  
 <body>  
   
   
1799  <section>  <section>
1800  <title>Postfix</title>  <title>Postfix</title>
1801  <body>  <body>
1802  TODO!  TODO!
1803  </body>  </body>
1804  </section>  </section>
1805    </comment>
1806    
1807  <section>  <section>
1808  <title>Qmail</title>  <title>Qmail</title>
# Line 1873  Qmail is considered to be the most secur Line 1813  Qmail is considered to be the most secur
1813  </body>  </body>
1814  </section>  </section>
1815    
 </body>  
 </section>  
   
 <section>  
 <title>DNS</title>  
 <body>  
 <p>  
 Gentoo supports two different dns servers, Bind and djbdns.  
 </p>  
   
1816  <section>  <section>
1817  <title>Bind</title>  <title>Bind</title>
1818  <body>  <body>
# Line 1979  There is really not much to say about dj Line 1909  There is really not much to say about dj
1909  </body>  </body>
1910  </section>  </section>
1911    
 </body>  
 </section>  
   
1912  <section>  <section>
1913  <title>Samba</title>  <title>Samba</title>
1914  <body>  <body>
# Line 2033  Now restart the server and add the users Line 1960  Now restart the server and add the users
1960  </section>  </section>
1961    
1962  <section>  <section>
1963  <title>Chroot or virtual servers.</title>  <title>Chroot or virtual servers</title>
1964  <body>  <body>
1965  <p>  <p>
1966  Chrooting a service is a way of limiting a service (or user) environment to only accessing what it should and not gaining access (or information) that could lead to root access. By running the service as another user than root (nobody, apache, named) an attacker can only access files with the permissions of this user. This means that an attacker cannot gain root access even if the services has a security flaw.  Chrooting a service is a way of limiting a service (or user) environment to only accessing what it should and not gaining access (or information) that could lead to root access. By running the service as another user than root (nobody, apache, named) an attacker can only access files with the permissions of this user. This means that an attacker cannot gain root access even if the services has a security flaw.
# Line 2103  Examples of virtual servers: Line 2030  Examples of virtual servers:
2030    
2031  </body>  </body>
2032  </section>  </section>
   
2033  </chapter>  </chapter>
2034    
2035  -- Securing Services end --  -- Securing Services end --
# Line 2118  Examples of virtual servers: Line 2044  Examples of virtual servers:
2044  <body>  <body>
2045    
2046  <p>  <p>
2047  People often think that a firewall is the ultimate security, but they are wrong. In most cases a mis configured firewall gives worse security than not having one at all. A firewall is also a piece of software and should be treated the same way as any other service, because is just as likely to have bugs (security holes).  People often think that a firewall provides the ultimate security, but they are wrong. In most cases a misconfigured firewall gives worse security than not having one at all. A firewall is also a piece of software and should be treated the same way as any other piece of software, because is just as likely to contain bugs.
2048  </p>  </p>
2049    
2050  <p>  <p>
2051  So think before implementing one! Do you really need one ? If you think you need one write a policy on how it should work, what type of firewall and who should operate it.  So think before implementing one! Do you really need one? If you think you need one write a policy on how it should work, what type of firewall and who should operate it. But first read this guide.
2052  </p>  </p>
2053    
2054  <p>  <p>
# Line 2130  Firewalls are used for two purposes: Line 2056  Firewalls are used for two purposes:
2056  </p>  </p>
2057    
2058  <ul>  <ul>
2059  <li>To keep users (worms/attackers) out</li>  <li>To keep users (worms/attackers) out.</li>
2060  <li>To keep users (employees/children) in</li>  <li>To keep users (employees/children) in.</li>
2061  </ul>  </ul>
2062    
2063  <p>  <p>
# Line 2139  Basically there are three types of firew Line 2065  Basically there are three types of firew
2065  </p>  </p>
2066    
2067  <ul>  <ul>
2068  <li>Packet filtering</li>  <li>Packet filtering.</li>
2069  <li>Circuit relay</li>  <li>Circuit relay.</li>
2070  <li>Application gateway</li>  <li>Application gateway.</li>
2071  </ul>  </ul>
2072    
2073  <p>  <p>
# Line 2156  A firewall should be a dedicated machine Line 2082  A firewall should be a dedicated machine
2082  <body>  <body>
2083    
2084  <p>  <p>
2085  All network traffic is in the form of packets. Large amounts of traffic also split up into small packets for easy handling and then reassembled when arriving at it's destination. Every packet contains information on how and where is should be delivered. And these information is exactly what a packing filtering firewall uses. Filtering is based on:  All network traffic is in the form of packets. Large amounts of traffic also split up into small packets for easy handling and then reassembled when arriving at its destination. In the packet header every packet contains information on how and where it should be delivered. And these informations are exactly what a packing filtering firewall uses. Filtering is based on:
2086  </p>  </p>
2087    
2088  <ul>  <ul>
2089    
2090  <li>Allow or disallow packets based on source/destination IP address.</li>  <li>Allow or disallow packets based on source/destination IP address.</li>
2091  <li>Allow or disallow packets based on source/destination port.</li>  <li>Allow or disallow packets based on source/destination port.</li>
2092  <li>Allow or disallow packets according to protocol.</li>  <li>Allow or disallow packets based on protocol.</li>
2093  <li>Allow or disallow packets according to flags within a specific protocol</li>  <li>Allow or disallow packets based on flags within a specific protocol.</li>
2094    
2095  </ul>  </ul>
2096    
2097  <p>  <p>
2098  Basically filtering on all data within the header of a packet and not it's content.  Basically filtering is based on all data within the header of a packet and not its content.
2099  </p>  </p>
2100    
2101  <p>  <p>
# Line 2177  Weaknesses: Line 2103  Weaknesses:
2103  </p>  </p>
2104    
2105  <ul>  <ul>
2106  <li>Address information in a packet can potentially be a bogus address or as we say <e>spoofed</e> by the sender</li>  <li>Address information in a packet can potentially be a bogus IP address or as we say <e>spoofed</e> by the sender.</li>
2107  <li>Data or requests within the allowed packet may contain unwanted data that the attacker can use to exploit known bugs in the services on or behind the firewall</li>  <li>Data or requests within the allowed packet may contain unwanted data that the attacker can use to exploit known bugs in the services on or behind the firewall.</li>
2108  <li>Usually single point of failure</li>  <li>Usually single point of failure.</li>
2109  </ul>  </ul>
2110    
2111  <p>  <p>
# Line 2187  Advantages: Line 2113  Advantages:
2113  </p>  </p>
2114    
2115  <ul>  <ul>
2116  <li>Simple and easy to implement</li>  <li>Simple and easy to implement.</li>
2117  <li>Can give warnings on a possible attack before they happened (by detecting portscans)</li>  <li>Can give warnings of a possible attack before it happens (ie. by detecting portscans).</li>
2118  <li>Good for stopping SYN attacks</li>  <li>Good for stopping SYN attacks.</li>
2119  </ul>  </ul>
2120    
2121  <p>  <p>
# Line 2210  Examples of free packet filters on Linux Line 2136  Examples of free packet filters on Linux
2136  <body>  <body>
2137    
2138  <p>  <p>
2139  Or circuit level gateways is a firewall that validates connections before allowing data to be exchanged. This means that is simply does not allow or deny packets based based on the header of the packet but determines whether the connection between both ends is valid according to configurable rules before it opens a session and allows data to and from the allowed source address. Filtering is based on:  Or circuit level gateways is a firewall that validates connections before allowing data to be exchanged. This means that it simply does not allow or deny packets based on the packet header but determines whether the connection between both ends is valid according to configurable rules before it opens a session and allows data to be exchanged. Filtering is based on:
2140  </p>  </p>
2141    
2142  <ul>  <ul>
2143  <li>Source/destination IP address</li>  <li>Source/destination IP address.</li>
2144  <li>Source/destination port</li>  <li>Source/destination port.</li>
2145  <li>A period of time</li>  <li>A period of time.</li>
2146  <li>Protocol</li>  <li>Protocol.</li>
2147  <li>User</li>  <li>User.</li>
2148  <li>Password</li>  <li>Password.</li>
2149  </ul>  </ul>
2150    
2151  <p>  <p>
2152  All traffic is validated, monitored and traffic without is disallowed.  All traffic is validated, monitored and unwanted traffic can be dropped.
2153  </p>  </p>
2154    
2155  <p>  <p>
# Line 2244  Operates at the Transport Layer and may Line 2170  Operates at the Transport Layer and may
2170  <body>  <body>
2171    
2172  <p>  <p>
2173  The application level gateway is a proxy for application, exchanging data with remote systems on behalf of the clients. It is kept away from the public safely behind a DMZ or firewall with no connection from the outside. Filtering is based on:  The application level gateway is a proxy for applications, exchanging data with remote systems on behalf of the clients. It is kept away from the public safely behind a DMZ (De-Militarized Zone: the portion of a private network that is visible through the firewall) or a firewall allowing no connections from the outside. Filtering is based on:
2174  </p>  </p>
2175    
2176  <ul>  <ul>
2177  <li>Allow or disallow based on source/destination IP address</li>  <li>Allow or disallow based on source/destination IP address.</li>
2178  <li>Based on the packets content</li>  <li>Based on the packets content.</li>
2179  <li>Can even alter the packet content on the fly</li>  <li>Limiting file access based on file type or extension.</li>
 <li>Limiting file access based on file type or extension</li>  
2180  </ul>  </ul>
2181    
2182  <p>  <p>
# Line 2259  Advantages: Line 2184  Advantages:
2184  </p>  </p>
2185    
2186  <ul>  <ul>
2187  <li>Can cache files, increasing network performance</li>  <li>Can cache files, increasing network performance.</li>
2188  <li>Detailed logging of all connections</li>  <li>Detailed logging of all connections.</li>
2189  <li>Scales perfectly (some proxy servers can "share" the cached data)</li>  <li>Scales perfectly (some proxy servers can "share" the cached data).</li>
2190  <li>No direct access from the outside</li>  <li>No direct access from the outside.</li>
2191    <li>Can even alter the packet content on the fly.</li>
2192  </ul>  </ul>
2193    
2194  <p>  <p>
# Line 2270  Weakness: Line 2196  Weakness:
2196  </p>  </p>
2197    
2198  <ul>  <ul>
2199  <li>The setup is complex</li>  <li>Configuration is complex.</li>
2200  </ul>  </ul>
2201    
2202  <p>  <p>
2203  Application gateways are considered to be the most secure solution since it does not have to run as root and is not public to the Internet.  Application gateways are considered to be the most secure solution since it does not have to run as root and the hosts behind it are not reachable from the Internet.
2204  </p>  </p>
2205    
2206  <p>  <p>
# Line 2293  Example of a free application gateway: Line 2219  Example of a free application gateway:
2219  <body>  <body>
2220    
2221  <p>  <p>
2222  In order to get iptables working, it has to be enabled in the kernel. I have added them as modules (the iptables command will load them as they are needed) and recompiled my kernel. After you have compiled it (or while compiling the kernel) you have to add the iptables commands. Just <c>emerge iptables</c> and it should work.  In order to get <c>iptables</c> working, it has to be enabled in the kernel. I have added them as modules (the <c>iptables</c> command will load them as they are needed) and recompiled my kernel. For more information on how to configure your kernel for <c>iptables</c> look go to the <uri link="http://iptables-tutorial.frozentux.net/chunkyhtml/kernelsetup.html">Iptables Tutorial Chapter 2: Preparations</uri>. After you have compiled your new kernel (or while compiling the kernel) you have to add the <c>iptables</c> command. Just <c>emerge iptables</c> and it should work.
2223  </p>  </p>
2224    
2225  <p>  <p>
# Line 2301  Now test that it works by running <c>ipt Line 2227  Now test that it works by running <c>ipt
2227  </p>  </p>
2228    
2229  <p>  <p>
2230  Iptables is a stateful packet filter which means that it provides greater control and greater security than ipchains (Linux version 2.2) which is not stateful. You are properly asking yourself what is the stateful part? and what is the difference?  Iptables is the new and heavily improved packet filter in the Linux 2.4.x kernel. It is the successor of the previous ipchains packet filter in the Linux 2.2.x kernel. One of the major improvements is that <c>iptables</c> is able to perform stateful packet filtering. With stateful packet filtering it is possible to keep track of each established TCP connection.
2231  </p>  </p>
2232    
2233  <p>  <p>
2234  We all know that a TCP connection consists of a series of packets. Each packet contains information about source IP address, the destination IP address and a sequence number so the packets can be reassembled. And we all know that TCP is connection-oriented and UDP is connectionless right? these are the states that is stored .. now you are probably asking yourself and so what? Well I'm getting to that.  A TCP connection consists of a series of packets containing information about source IP address, destination IP address, sequence number so the packets can be reassembled and not to forget data. TCP is a connection-oriented protocol in contrast to UDP which is connectionless.
2235  </p>  </p>
2236    
2237  <p>  <p>
2238  Now imagine that you have a stateless firewall (ipchains) and do not want to allow external computers to originate a connection to your internal services but how can the firewall determine whether a packet is part of an ongoing connection or not? A stateless firewall cannot distinguish between an existing connection and one that is part of a new connection by looking at the SYN flag!.  By examining the TCP packet header a stateful packet filter can determine if a received TCP packet is part of an already established connection or not and decide either to accept or drop the packet.
2239  </p>  </p>
2240    
2241  <p>  <p>
2242  Lets say an attacker is sending hand crafted packets (a packet created by the attacker) where he alters the SYN flags or any other flags. This is quite often what attackers do. Send packets right through the firewall altering routing tables or compromising services running on the firewall which are supposed to be safe behind a filter. A stateful firewall will keep track of all connections and can thus detect if a received packet does not belong to an existing connection. When a packet not belonging to any existing connection is found it is marked as invalid and can be discarded. This will also stop the possibility of "stealth scans" since the connection was invalid.  With a stateless packet filter it is possible to fool the packet filter to accept packets that should be dropped by manipulating the TCP packet headers. This could be done by manipulating the SYN flag or other flags in the TCP header. With stateful packet filtering it is possible to drop such packets as they are not part of an already established connection. This will also stop the possibility of "stealth scans" since such packets will not be part of an already established connection.
2243  </p>  </p>
2244    
2245  <p>  <p>
2246  I could probably find a dozen other reasons but I think you got the picture .. simple rules result in a smaller firewall configuration that is easier to maintain.  Iptables provides several other features like NAT (Network Address Translation) and rate limiting. Rate limiting is extremely useful when trying to prevent certain DoS (Denial of Service) attacks like SYN floods.
2247  </p>  </p>
2248    
2249  <p>  <p>
2250  Iptables provides several other features like rate limiting. This features is extremely useful when trying to prevent certain DoS (Denial of Service) attacks like a SYN attack. Now what is a SYN attack?  A TCP connection is established by a so called three-way handshake. When establishing a TCP connection the client-side sends a packet to the server with the SYN flag set. When the server-side receives the SYN packet it responds by sending a SYN+ACK packet back to the client-side. When the SYN+ACK is received the client-side responds with a third ACK packet in effect acknowledging the connection.
2251  </p>  </p>
2252    
2253  <p>  <p>
2254  Again .. when creating a connection with TCP it uses three-way handshake to establish the connection like this:  A SYN flood attack is performed by sending the SYN packet but failing to respond to the SYN+ACK packet. The client-side can forge a packet with a fake source IP address because it does not need a reply. The server-side system will add an entry to a queue of half-open connections when it receives the SYN packet and then wait for the final ACK packet before deleting the entry from the queue. The queue has a limitied number of slots and if all the slots are filled it is unable to open any further connections. If the ACK packet is not received before a specified timeout period the entry will automatically be deleted from the queue. The timeout settings vary but will typically be 30-60 seconds or even more. The client-side initiates the attack by forging a lot of SYN packets with different source IP addresses and sends them to the target IP address as fast as possible and thereby filling up the queue of half-open connections and thus preventing other clients from establishing legitimate with the server.
2255  </p>  </p>
2256    
 <fig link="http://www.ibiblio.org/pub/Linux/distributions/gentoo/images/synack.jpg" short="Three-way handshake"/>  
   
2257  <p>  <p>
2258  A SYN attack is when it only sends a SYN packet (header only contains SYN flag) and does not continue sending the last two packets to establish the connection. A SYN packet does not require a valid source IP address because it does not need a reply. So the connection will hang until it times out. Now if the attacker sends a lot of SYN packets with a bogus source IP address, the computer waits for the response, which never comes. Depending on the timeout settings in your system, this connection could stay open for 30-60 seconds (or longer). When the connection limit table is completely occupied and unable to communicate with anyone.  This is where the rate limit becomes handy. It is possible to limit the rate of accepted SYN packets by using the <c>-m limit --limit 1/s</c>. This will limit the number of SYN packets accepted to one per second and therefor restricting the SYN flood on our resources.
 </p>  
   
 <p>  
 This is where the rate limit becomes handy. It is possible to limit the number of SYN packets from a single source but using the <c>-m limit --limit 1/s</c>. This will limit the SYN packets to one per source and therefor restricting the SYN flood on our resources.  
2259  </p>  </p>
2260    
2261  <p>  <p>
# Line 2343  Now! some practical stuff! Line 2263  Now! some practical stuff!
2263  </p>  </p>
2264    
2265  <p>  <p>
2266  When iptables is loaded in the kernel it has 5 hooks where you can place your rules. They are called INPUT, OUTPUT FORWARD, PREROUTING and POSTROUTING. These lists are called chains because they work by added a rules and checks the rules one at the time as they where added. If one rule deny a packet it will be dropped and does not continue down the chain.  When <c>iptables</c> is loaded in the kernel it has 5 hooks where you can place your rules. They are called INPUT, OUTPUT, FORWARD, PREROUTING and POSTROUTING. Each of these is called a chain and consists of a list of rules. Each rule says if the packet header looks like this, then here is what to do with the packet. If the rule does not match the packet the next rule in the chain is consulted.
2267  </p>  </p>
2268    
2269  <p>  <p>
2270  You can place rules directly to the 5 main chains or create chains and add them to as a rule to an existing chain. Lets see how this is done  You can place rules directly in the 5 main chains or create new chains and add them to as a rule to an existing chain. <c>iptables</c> supports the following options.
2271  </p>  </p>
2272    
2273  <table border="0">  <table border="0">
# Line 2435  You can place rules directly to the 5 ma Line 2355  You can place rules directly to the 5 ma
2355  </table>  </table>
2356    
2357  <p>  <p>
2358  First we will try to block all ICMP packages to our machine, just to get familiar with iptables.  First we will try to block all ICMP packages to our machine, just to get familiar with <c>iptables</c>.
2359  </p>  </p>
2360    
2361  <pre caption="Block all ICMP packages">  <pre caption="Block all ICMP packages">
# Line 2443  First we will try to block all ICMP pack Line 2363  First we will try to block all ICMP pack
2363  </pre>  </pre>
2364    
2365  <p>  <p>
2366  First we specify the chain it should be appended to. Next to specify the protocol and then the rule. The rule can be a ACCEPT, DROP, REJECT, LOG, QUEUE, MASQUERADE, a loaded module or a user defined chain. In this case we use DROP which will drop the packet without responding to the client.  First we specify the chain it should be appended to next the protocol and then the target. The target can be the name of a user specified chain or one of the special targets ACCEPT, DROP, REJECT, LOG, QUEUE, MASQUERADE. In this case we use DROP which will drop the packet without responding to the client.
2367  </p>  </p>
2368    
2369  <p>  <p>
2370  Now try <c>ping localhost</c>. It will not be able to get any response since it is blocking the entire ICMP protocol incoming to our machine. It will not be able to ping other machines either since it is not allowed to get the ICMP packets returning from the host. Now flush the chain to get ICMP flowing again.  Now try <c>ping localhost</c>. It will not be able to get any response since <c>iptables</c> will drop all incoming ICMP messages. It will not be able to ping other machines either since the ICMP reply packet will be dropped. Now flush the chain to get ICMP flowing again.
2371  </p>  </p>
2372    
2373  <pre caption="Flush all rules">  <pre caption="Flush all rules">
# Line 2455  Now try <c>ping localhost</c>. It will n Line 2375  Now try <c>ping localhost</c>. It will n
2375  </pre>  </pre>
2376    
2377  <p>  <p>
2378  Now lets look at the stateful part in iptables. If we wanted to have a stateful inspection of packets incoming on eth0 we could enable it by issuing:  Now lets look at the stateful packet filtering in <c>iptables</c>. If we wanted to have a stateful inspection of packets incoming on eth0 we could enable it by issuing:
2379  </p>  </p>
2380    
2381  <pre caption="Accept packets that originate from an already established connection">  <pre caption="Accept packets that originate from an already established connection">
# Line 2463  Now lets look at the stateful part in ip Line 2383  Now lets look at the stateful part in ip
2383  </pre>  </pre>
2384    
2385  <p>  <p>
2386  This will accept any packet already established or related in the INPUT chain. And you could drop any packet that is not in the state table by issuing <c>iptables -A INPUT -i eth0 -m state --state INVALID -j DROP</c> just before. This enables the stateful part in iptables by loading the extension state. If you wanted connection from the outside to connect to you machine you could use the <c>--state NEW</c>. Iptables contain some modules for different purposes. Some of them are:  This will accept any packet from an already established connection or related in the INPUT chain. And you could drop any packet that is not in the state table by issuing <c>iptables -A INPUT -i eth0 -m state --state INVALID -j DROP</c> just before. This enables the stateful packet filtering in <c>iptables</c> by loading the extension state. If you wanted to allow others to connect to you machine you could use the <c>--state NEW</c>. Iptables contain some modules for different purposes. Some of them are:
2387  </p>  </p>
2388    
2389  <table border="0">  <table border="0">
# Line 2491  This will accept any packet already esta Line 2411  This will accept any packet already esta
2411  Lets try to create a user defined chain and apply it to one of the existing chains:  Lets try to create a user defined chain and apply it to one of the existing chains:
2412  </p>  </p>
2413    
2414  <pre caption="Creating a userdefined chain">  <pre caption="Creating a user defined chain">
2415  <codenote>Create a new chain with one rule</codenote>  <codenote>Create a new chain with one rule</codenote>
2416  # <i>iptables -X mychain</i>  # <i>iptables -X mychain</i>
2417  # <i>iptables -N mychain</i>  # <i>iptables -N mychain</i>
# Line 2516  Lets see a full blown example. In this c Line 2436  Lets see a full blown example. In this c
2436  </p>  </p>
2437    
2438  <ul>  <ul>
2439    <li>Connections to the firewall is only allowed through SSH (port 22)</li>    <li>Connections to the firewall are only allowed through SSH (port 22).</li>
2440    <li>The local network should have access to HTTP, HTTPS and SSH (DNS should also be allowed)</li>    <li>The local network should have access to HTTP, HTTPS and SSH (DNS should also be allowed).</li>
2441    <li>ICMP traffic can contain payload and should not be allowed. Of course we have to allow some ICMP traffic.</li>    <li>ICMP traffic can contain payload and should not be allowed. Of course we have to allow some ICMP traffic.</li>
2442    <li>Port scan should be detected and logged</li>    <li>Port scans should be detected and logged.</li>
2443    <li>SYN attack should be avoided</li>    <li>SYN attacks should be avoided.</li>
2444    <li>All other traffic should be dropped and logged</li>    <li>All other traffic should be dropped and logged.</li>
2445  </ul>  </ul>
2446    
2447  <pre caption="/etc/init.d/firewall">  <pre caption="/etc/init.d/firewall">
# Line 2739  Free advice when creating a firewall: Line 2659  Free advice when creating a firewall:
2659  </p>  </p>
2660    
2661  <ol>  <ol>
2662    <li>Create your firewall policy before implementing it</li>    <li>Create your firewall policy before implementing it.</li>
2663    <li>Keep it simple</li>    <li>Keep it simple.</li>
2664    <li>Know how the protocol works (read the <uri link="http://www.ietf.org/">RFC (Request For Comments)</uri>)</li>    <li>Know how the protocol works (read the <uri link="http://www.ietf.org/">RFC (Request For Comments)</uri>).</li>
2665    <li>Keep in mind that a firewall it just another piece of software running as root</li>    <li>Keep in mind that a firewall it just another piece of software running as root.</li>
2666    <li>Test your firewall</li>    <li>Test your firewall.</li>
2667  </ol>  </ol>
2668    
2669  <p>  <p>
2670  If you think that iptables is hard to understand or takes to long to setup a decent firewall you could use <uri link="http://www.shorewall.net">Shorewall</uri>. It basically uses iptables to generate firewall rules, but concentrates on rules and not specific protocols.  If you think that <c>iptables</c> is hard to understand or takes to long to setup a decent firewall you could use <uri link="http://www.shorewall.net">Shorewall</uri>. It basically uses <c>iptables</c> to generate firewall rules, but concentrates on rules and not specific protocols.
2671  </p>  </p>
2672    
2673  </body>  </body>
# Line 2758  If you think that iptables is hard to un Line 2678  If you think that iptables is hard to un
2678  <body>  <body>
2679    
2680  <p>  <p>
2681  Squid is a very powerful proxy server and it can filter traffic based on: time, regular expression path/uri, source and destination IP addresses, domain, browser, authenticated username, mime-type and port number(protocol). I probably forgot some features, but it can be hard to cover the entire feature list.  Squid is a very powerful proxy server and it can filter traffic based on: time, regular expressions on path/URI, source and destination IP addresses, domain, browser, authenticated username, MIME type and port number (protocol). I probably forgot some features, but it can be hard to cover the entire feature list.
2682  </p>  </p>
2683    
2684  <p>  <p>
2685  In the following example I have added a banner filter instead of a filter based on porn sites. The reason for this is that Gentoo.org should <c>not</c> be listed as some porn site. And I do not want to waste my time trying to find some good sites for you.  In the following example I have added a banner filter instead of a filter based on porn sites. The reason for this is that Gentoo.org should <e>not</e> be listed as some porn site. And I do not want to waste my time trying to find some good sites for you.
2686  </p>  </p>
2687    
2688  <p>  <p>
# Line 2770  In this case, my policy states: Line 2690  In this case, my policy states:
2690  </p>  </p>
2691    
2692  <ul>  <ul>
2693    <li>Surfing (HTTP/HTTPS) is allowed during work hours (mon-fri 8-17 and sat 8-13) if they are here late they should work, not surf</li>    <li>Surfing (HTTP/HTTPS) is allowed during work hours (mon-fri 8-17 and sat 8-13) if they are here late they should work, not surf.</li>
2694    <li>Download is not allowed (.exe, .com, .arj, .zip, .asf, .avi, .mpg, .mpeg etc.)</li>    <li>Download is not allowed (.exe, .com, .arj, .zip, .asf, .avi, .mpg, .mpeg etc).</li>
2695    <li>We don't like banners so they are filtered and replaced with a transparent gif (this is where you get creative!)</li>    <li>We do not like banners so they are filtered and replaced with a transparent gif (this is where you get creative!).</li>
2696    <li>Every other connection to and from the Internet is not allowed</li>    <li>All other connections to and from the Internet are not allowed.</li>
2697  </ul>  </ul>
2698    
2699  <p>  <p>
# Line 2914  _ad\..*cgi Line 2834  _ad\..*cgi
2834  </pre>  </pre>
2835    
2836  <p>  <p>
2837  And the last part. We want this file to be displayed when it removes a banner. It is basically a half html file with a 4x4 transparent gif image.  And as the last part we want this file to be displayed when a banner is removed. It is basically a half html file with a 4x4 transparent gif image.
2838  </p>  </p>
2839    
2840  <pre caption="/etc/squid/errors/NOTE_ADS_FILTERED">  <pre caption="/etc/squid/errors/NOTE_ADS_FILTERED">
# Line 2928  And the last part. We want this file to Line 2848  And the last part. We want this file to
2848  </pre>  </pre>
2849    
2850  <note>  <note>
2851  Don't close the &lt;HTML&gt; &lt;BODY&gt; tags. This will be done by squid.  Do not close the &lt;HTML&gt; &lt;BODY&gt; tags. This will be done by squid.
2852  </note>  </note>
2853    
2854  <p>  <p>
2855  As you can see, squid has a lot of possibilities and it is very effective in both filtering and proxying. It can even use alternative squid proxies to scale on very large networks. The configuration I have listed here is mostly suited for a small network with 1-20 users.  As you can see, squid has a lot of possibilities and it is very effective at both filtering and proxying. It can even use alternative squid proxies to scale on very large networks. The configuration I have listed here is mostly suited for a small network with 1-20 users.
2856  </p>  </p>
2857    
2858  <p>  <p>
2859  But combining the packet filter (iptables) and the application gateway (squid) is probably the best solution, even if squid is located somewhere safe and nobody could access it from the outside. We still need to be concerned on attack from the inside.  But combining the packet filter (<c>iptables</c>) and the application gateway (squid) is probably the best solution, even if squid is located somewhere safe and nobody can access it from the outside. We still need to be concerned by attacks from the inside.
2860  </p>  </p>
2861    
2862  <p>  <p>
2863  Now you have to add the proxy server into the settings of your clients browsers. The gateway will prevent the users from having any contact with the outside unless they use the proxy.  Now you have to configure your clients browsers to use the proxy server. The gateway will prevent the users from having any contact with the outside unless they use the proxy.
2864  </p>  </p>
2865  <note>  <note>
2866  In Mozilla this is done in Edit->Preferences->Advanced->Proxies.  In Mozilla this is done in Edit->Preferences->Advanced->Proxies.
2867  </note>  </note>
2868    
2869  <p>  <p>
2870  It can also be done transparently by using iptables to forward all traffic out to a squid proxy. This can be done by adding a forwarding/prerouting rule on the gateway:  It can also be done transparently by using <c>iptables</c> to forward all outbound traffic to a squid proxy. This can be done by adding a forwarding/prerouting rule on the gateway:
2871  </p>  </p>
2872    
2873  <pre caption="Enable portforwarding to our proxyserver">  <pre caption="Enable portforwarding to our proxyserver">
# Line 2968  We have learned that: Line 2888  We have learned that:
2888  </p>  </p>
2889    
2890  <ol>  <ol>
2891    <li>A firewall can be a risk itself. A badly configured firewall is worse than not having one at all.</li>    <li>A firewall can be a risk in itself. A badly configured firewall is worse than not having one at all.</li>
2892    <li>How to setup a basic gateway and a transparent proxy.</li>    <li>How to setup a basic gateway and a transparent proxy.</li>
2893    <li>The key to a good firewall is to know the protocol you want do allow.</li>    <li>The key to a good firewall is to know the protocol you want do allow.</li>
2894    <li>That IP traffic does not always contain legitimate data. For an example ICMP packets with payload.</li>    <li>That IP traffic does not always contain legitimate data ie. ICMP packets can contain payload.</li>
2895    <li>How to prevent SYN attack.</li>    <li>How to prevent SYN attack.</li>
2896    <li>Filtering HTTP traffic by removing offensive pictures and downloads of viruses.</li>    <li>Filtering HTTP traffic by removing offensive pictures and downloads of viruses.</li>
2897    <li>Combining packet filters and application gateways gives a better control.</li>    <li>Combining packet filters and application gateways provides better control.</li>
2898  </ol>  </ol>
2899    
2900  <p>  <p>
# Line 3213  Now there is some problems with storing Line 3133  Now there is some problems with storing
3133  </p>  </p>
3134    
3135  <p>  <p>
3136  More information can be found at <uri link="http://www.cs.tut.fi/~rammer/aide.html">aide's</uri> projectpage.  More information can be found at the <uri link="http://www.cs.tut.fi/~rammer/aide.html">AIDE</uri> projectpage.
3137  </p>  </p>
3138    
3139  </body>  </body>
# Line 3222  More information can be found at <uri li Line 3142  More information can be found at <uri li
3142  <section>  <section>
3143  <title>Snort</title>  <title>Snort</title>
3144  <body>  <body>
3145    <p>
3146    Snort is a Network Intrusion Detection System (NIDS). To install and configure it use the following examples.
3147    </p>
3148    
3149  <pre caption="Add a user snort to the system">  <pre caption="Add a user snort to the system">
3150  # useradd snort -d /var/log/snort -s /dev/null  # useradd snort -d /var/log/snort -s /dev/null
# Line 3334  config classification: kickass-porn,SCOR Line 3257  config classification: kickass-porn,SCOR
3257  </pre>  </pre>
3258    
3259  <p>  <p>
3260  More information can be found at <uri link="http://www.snort.org">Snorts</uri> website.  More information can be found at the <uri link="http://www.snort.org">Snort</uri> website.
3261  </p>  </p>
3262    
3263  </body>  </body>
# Line 3343  More information can be found at <uri li Line 3266  More information can be found at <uri li
3266  </chapter>  </chapter>
3267    
3268  -- Intrusion detection end --  -- Intrusion detection end --
3269    <comment>
3270  <chapter>  <chapter>
3271  <title>Changes since last version</title>  <title>Changes since last version</title>
3272  <section>  <section>
# Line 3371  Version 0.2 -> 0.4 Line 3294  Version 0.2 -> 0.4
3294  </body>  </body>
3295  </section>  </section>
3296  </chapter>  </chapter>
3297    </comment>
   
   
 <chapter>  
 <title>FAQ</title>  
   
 <section>  
 <title>Questions and answers</title>  
 <body>  
   
 <table border="0">  
   <tr>  
     <th>Question</th><th>Answer</th>  
   </tr>  
   <tr>  
     <ti>Where can I find the latest version of this guide?</ti><ti>The lastest version should be available on <uri>http://gentoo.org</uri> and the development version at <uri>http://gentoo.insecurity.dk</uri></ti>  
   </tr>  
 </table>  
   
 </body>  
 </section>  
 </chapter>  
   
   
3298  </guide>  </guide>

Legend:
Removed from v.1.1  
changed lines
  Added in v.1.2

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26