Securing Network using Linux

Lesson Outline Setting up a secure system TCP Wrapper configuration Firewalls in Linux Authentication Systems –NIS –Kerberos

Types of Security Threats Denial of Service (DoS) –This attack disrupts a service on the system Intrusion –Unauthorised access by compromising a service or logging in by stealing a password Snooping –This attack involves interception of the data of another user, listening to all sensitive information transmitted Viruses, worms and Trojan Horses

Setting up a Secure System There are some very basic things that you have to do in order to secure your system Shutting down the redundant services –You have to disable all network daemons (services) that are not needed by the system –Any network port that is listening for connections can be vulnerable to attacks due to probable exploits against running daemon –To find out the ports that are opened type: # netstat -an

Setting up a secure system (cont.) Looking in /etc/services or by passing -p to netstat we can tell which service is running per port Check each port that looks like unnecessary Examples vulnerable services: –telnetd, sendmail, ftpd: Send clear passwords through the web. Instead of telnet use ssh Shutting down services involves editing the appropriate files on your system

Setting up a Secure System (cont.) On RedHat based systems daemons are started by scripts in the /etc/rc.d/init.d directory Depending on the runlevel each daemon/services in linked to the appropriate rcX.d directory where 0<X<6

Setting up a secure system What to have in mind all the time: –Never use simple passwords. Try to make them complex by mixing letters,symbols and numbers –Do NOT work on the root account unless absolutely necessary –Do not ignore the log files –Update your system in a regular basis

TCP Wrapper Configuration A simple and effective way to protect the system TCP Wrappers “wrap” a service access (e.g. apache web server)monitoring the connections to it and refusing unauthorised sites It is used in conjunction with inetd and xinetd It's a good way to control the access to services that do not provide any native access control mechanism

TCP Wrapper Configuration (cont.) TCP Wrapper is the first thing encounter when a connection is established with a service protected by the wrapper TCP Wrapper is responsible for determining whether the connection comes from a source host that it is allowed to do so Depending on whether you are using TCP Wrappers with inetd or xinetd there are two different approaches

TCP Wrapper Configuration (cont.) with inetd If the system is using the inetd daemon you have to edit the /etc/inetd.conf file to use the TCP wrapper Using TCP wrappers requires just a small change to /etc/inetd.conf E.g. for the finger daemon finger stream tcp nowait root /usr/sbin/in.fingerd in.fingerd has to be changed to: finger stream tcp nowait root /usr/sbin/tcpd /usr/sbin/in.fingerd This cause the tcpd command, representing the TCP wrapper, to be executed instead of the in.fingerd and protect the daemon

TCP Wrapper Configuration (cont.) with xinetd xinetd is the replacement of inetd adopted by some distros In most cases xinetd has built-in support for TCP wrappers You need to modify the TCP wrapper configuration files (/etc/hosts.allow, /etc/hosts.deny)

TCP Wrapper Configuration (cont.) with xinetd /etc/hosts.allow and /etc/hosts.deny specify the access rules that are applied in daemon protection When a TCP wrapper is invoked it obtains the IP address of the connecting host and its hostname If the IP of the host is specified in the /etc/hosts.allow then access is permitted to the daemon/service If no match is found, the /etc/hosts.deny is consulted. If the IP is described there then the connection is closed If no much exists both of the files then access is granted

TCP Wrapper Configuration (cont.) with xinetd The syntax of those two files is simple Each file contains a set of rules General rule form: daemon_list : client_list : shell_command where daemon_list is comma separated list of daemons to which the rule applies, the client_list is comma separated list of the hostnames or IP addresses where the rule applies and shell_command is optional, specifying the command to be executed when rule matches

TCP Wrapper Configuration (cont.) with xinetd Example rules: 1. /etc/hosts.deny ALL:ALL # Deny everything from everywhere In case that nothing is specified in the /etc/hosts.allow then this rule will refuse connection to any service by anyone 2. /etc/hosts.deny ALL: ALL EXCEPT localhost 3. /etc/hosts.allow in.fingerd: ALL

Firewalls in Linux It is the case that TCP Wrappers work with services configured using xinetd For stand-alone services another tool has to be used to control access In modern systems is common place to get protection by IP filtering In IP filtering kernel inspects each network packet transmitted or received by the host machine

Firewalls in Linux (cont.) Kernel IP filtering mechanism decides whether to allow or deny the access of a certain packet IP filtering though does not provide protection from DoS attacks, Trojan’s and viruses IP filters take their decision according to packet headers which contain information like: –Protocol Type (TCP,UDP) –Source and Destination Port Numbers E.g. Web Servers like Apache use port 80 on TCP protocol

Firewalls in Linux (cont.) IP filtering in Linux is implemented by the kernel There are three IP filtering/firewall generations in Linux: –ipfw (IP firewall) for kernel versions 2.0.X –ipchains in kernel versions 2.2.x –netfilter/iptables in kernel versions 2.4.x netfilter is the kernel module while iptables is the user space configuration tool

Firewalls in Linux (cont.) We are going to describe netfilter/iptables that refers to the modern kernel versions 2.4.x Iptables command allows a rich and complex IP filtering rule definition E.g. iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT This command install an IP filter that accepts new incoming connections to TCP port 22 (the ssh service) on our local system.

Firewalls in Linux (cont.) A set of rules defined by iptables is called chain and is applied to all packets transmitted or received There are three system chains defined by kernel: –INPUT: Applies to packets received –OUTPUT: Applies to packets send –FORWARD: Applies to all the packets that are routed from one network interface (net card) of the system to an other. Helpful when system works as router or gateway

Firewalls in Linux (cont.) Actions that can be performed from rules include: –ACCEPT: Accepts the packet –DROP: Drops the packet, i.e. refusing transmitting or receiving it –The default action can be configured to be either ACCEPT or DROP netfilter also allows performing: –Packet Logging –Network Address Translation (NAT) aka IP masquerading

Firewalls in Linux (cont.) Each Linux Distribution takes a slightly different approach on managing firewall In RedHat-based distros all the rules are stored in /etc/sysconfig/iptables You first specify the rules using the iptables command and the you save them typing as root: –/sbin/service iptables save

Firewalls in Linux (cont.) # Set default policy on the INPUT chain to DROP. # -P sets the default action of the specified chain, so here #DROP the packets of INPUT chain iptables -P INPUT DROP # ACCEPT all packets that have come from the loopback interface, that # is, from the local host. '-i lo' identifies the loopback interface. iptables -A INPUT -i lo -j ACCEPT -j here stands for “jump” meaning that if a packet matches the rules then processing will jump to what follows. The options after –j are: ACCEPT: Allow the transmission of the packet DROP: Drop the packet QUEUE: Pass the packet to a program for processing RETURN: Returns the packet to the end of rule chain

Firewalls in Linux (cont.) # ACCEPT packets belonging to an existing (ESTABLISHED,RELATED) connection.'-A INPUT' is used to append to the INPUT chain. '-m state' uses the stateful inspection module. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # ACCEPT new incoming FTP connections from /24. iptables -A INPUT -m state --state NEW -m tcp -p tcp -s /24 \ --dport 21 -j ACCEPT

Firewalls in Linux (cont.) You can see the list of rule currently applied on the system by typing: –iptalbes –L -v

Reference – Using the iptables