Unit 2. Basic Linux Security

Transcription

1 it 2 Basic Liux ecurity oa Warre

2 Cofigurig g Cliet ervices Cofigure superservers to hadle multiple etwork services et up admiistrative services like loggig ad pritig se simple etwork iformatio services like figer ad talk derstad basic mailig list ad ews server cofiguratios oa Warre

3 he uperservers uperservers liste o multiple etwork ports ad start the appropriate service whe a cliet coectio arrives for that port. xietd is a superserver gaiig popularity t is a revised versio of ietd that creates a more secure eviromet ot shipped with Fedora 12 xietd is the most widely used superserver pplicatio level security is provided via CP Wrappers - the tcpd program oa Warre

4 CP Wrappers oa Warre

5 CP Wrappers CP Wrappers - tcpd - is a applicatio-level access cotrol program CP Wrappers is ot a firewall ad should be used with oe if Liux security issues exist Cofiguratio is doe by two files: /etc/hosts.allow ad /etc/hosts.dey sure proper p ad expected cofiguratio by testig carefully before relyig o it oa Warre

6 /etc/xietd.cof # imple cofiguratio file for xietd # read ma xietd.cof defaults { istaces = 60 log_type = LG authpriv log_o_success = H P log_o_failure = H cps = } icludedir /etc/xietd.d files i this special directory # iclude all oa Warre

7 telet (/etc/xietd.d) service telet { disable = o # default is yes flags = socket_type = stream wait = o user = root server = /usr/sbi/i.teletd server_args = a oe log_o_failure o += # add userid to the log } oa Warre

8 /etc/services # 21 is registered to ftp, but also used by fsp ftpdata 20/tcp ftpdata 20/udp ftp 21/tcp ftp 21/udp fsp fspd # H emote Logi Protocol ssh 22/tcp ssh 22/udp telet 23/tcp telet 23/udp oa Warre

9 Hostames ust atch our hostame ad your eighbors hostames must be i the /etc/hosts files with the correct Ps, othewise security settigs will ot let you log i u the hostame commad to fid who you are. oa Warre

10 /etc/hosts.allow # llow access to telet from the etwork # ote the i implies the service ad is ot always eeded sshd i.teletd i.ftpd : # llow access to ftp oly from Ps ad i.ftpd : oa Warre

11 /etc/hosts.dey # ey access to all servers from all cliets LL : LL oa Warre

12 CP Wrappers oa Warre

13 ther ervices ay services do ot rely o superservers, they are desiged to ru stadaloe pache Web server is the best example of this ervers such as P ad FP ca be used i stadaloe mode, or with ietd or xietd FP rus more efficietly i stadaloe mode if much FP traffic is expected oa Warre

14 chroot jails method of ruig services securely ecommed you backup the bi ad lib directories i case you eed to restore the defaults ll files eeded d by the service must be i the jail /usr/bi/chroot jailpath /bi/su user daemoame & oa Warre

15 What is a Firewall? set of related programs that protects the resources of a private etwork from users from other etworks mechaism for filterig etwork packets based o iformatio cotaied withi the P header meas of maitaiig i i saity P ables is a Liux firewall oa Warre

16 P ables Protects Complex etwork pplicatios Volatile eviromets teral ecurity ystem egregatio Local Host Protectio ti oa Warre

17 CP Header Versio HL ype of ervice otal Legth detificatio Flags Fragmet ffset ime to Live Protocol Header Checksum ource ddress estiatio ddress ource Port estiatio Port equece umber ckowledgmet umber oa Warre Cotrol

18 pchais packet traversal outig put Chai ey Forward Chai ey Local Processes utput Chai ey oa Warre

19 CCP iptables argets let the packet through P drop the packet Q pass the packet to the userspace stop traversig this chai ad resume the callig chai oa Warre

20 Basic iptables sytax iptables --flush iptables - P -i lo -j CCP iptables - P -o lo -j CCP iptables --policy P P iptables --policy P P iptables --policy FW P oa Warre

21 iptables example iptables - P -i eth1 -p tcp -s \ --sport 1024: d dport 22 \ -j CCP iptables - P -o eth1 -p tcp! --sy \ -s sport 22 -d \ --dport 1024: j CCP oa Warre

22 Forwardig Packets iptables - FW -i <iteral iterface> \ -o <exteral iterface> -s /32 --sport \ 1024: m state --state \ W,BLH,L - j CCP iptables - FW -i <exteral iterface> \ -o <iteral iterface> -m state --state \ BLH,L -j CCP *do't forget /proc/sys/et/ipv4/ip_forward/ / oa Warre

23 iptables -L -v - Chai P (policy P 280 packets, bytes) pkts bytes target prot opt i out source destiatio K CCP tcp -- eth1 * tcp dpt: LG all -- eth0 * /00 0 0/ /00 0 0/0 LG flags 0 level 4 378K 46 LG all -- eth1 * / /0 LG flags 0 level CCP all -- lo * / / LG all -- * * / /0 LG flags 0 level 4 Chai FW (policy P 0 packets, 0 bytes) pkts bytes target prot opt i out source destiatio K LG all -- eth1 eth / /0 LG flags 0 level K LG all -- eth0 eth / /0 LG flags 0 level CCP tcp -- eth0 eth / tcp dpt:22 state W K CCP all -- eth1 eth / /0 state L,BLH K CCP all -- eth0 eth / /0 state L,BLH CCP tcp -- eth1 eth / tcp dpt:22 state W CCP tcp -- eth0 eth / tcp dpt:22 state W Chai P (policy P 7 packets, 588 bytes) pkts bytes target prot opt i out source destiatio K CCP tcp -- * eth tcp spt: LG all -- * eth / /0 LG flags 0 level K LG all -- * eth / /0 LG flags 0 level CCP all -- * lo / /0 oa Warre

24 LG LG - arget xtesio --log-level level --log-prefix --log-tcp-sequece --log-tcp-optios --log-ip-optios optios iptables - P -o eth0 -j LG iptables - P -m state state VL -j LG -- log-prefix "VL iput: " oa Warre

25 aw iptables log output Ju 25 09:05:11 hebe kerel: =eth1 = C=00:00:92:a7:df:05:02:07:01:23:5e:29:08:00 C= = L=44 =0x00 PC=0x00 L=60 =7276 P=CP P=47785 P=10003 WW=16384 =0x00 GP=0 Ju 25 09:05:11 hebe kerel: =eth1 = C=00:00:92:a7:df:05:02:07:01:23:5e:29:08:00 C= = L=44 =0x00 PC=0x00 L=60 =7276 P=CP P=47785 P=10003 WW=16384 =0x00 GP=0 Ju 25 09:05:12 hebe kerel: =eth1 = C=ff:ff:ff:ff:ff:ff:00:06:5b:d1:24:bb:08:00 C= = L=241 =0x00 PC=0x00 L=128 =547 P=P P=138 P=138 L=221 Ju 25 09:05:12 hebe kerel: =eth1 = C=ff:ff:ff:ff:ff:ff:00:06:5b:d1:24:bb:08:00 C= = L=241 =0x00 PC=0x00 L=128 =547 P=P P=138 P=138 L=221 Ju 25 09:05:12 hebe kerel: =eth1 = C=ff:ff:ff:ff:ff:ff:00:50:04:74:0b:81:08:00 C= = L=78 =0x00 PC=0x00 L=64 =44852 P=P P=137 P=137 L=58 Ju 25 09:05:12 hebe kerel: =eth1 = C=ff:ff:ff:ff:ff:ff:00:50:04:74:0b:81:08:00 C= = L=78 =0x00 PC=0x00 L=64 =44852 P=P P=137 P=137 L=58 Ju 25 09:05:15 hebe kerel: =eth1 = C=ff:ff:ff:ff:ff:ff:00:60:cf:20:2d:37:08:00 C= = L=78 =0x00 PC=0x00 L=1 =60733 F P=P P=137 P=137 L=58 Ju 25 09:05:15 hebe kerel: =eth1 = C=ff:ff:ff:ff:ff:ff:00:60:cf:20:2d:37:08:00 C= = L=78 =0x00 PC=0x00 L=1 =60733 F P=P P=137 P=137 L=58 Ju 25 09:05:23 hebe kerel: =eth1 = C=00:00:92:a7:df:05:02:07:01:23:5e:29:08:00 C= = L=44 =0x00 PC=0x00 00 L=60 =11698 P=CP CP P=4778 oa Warre

26 log_aalysis output 3 Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP Chai: iput terface: eth0 >> => CP 1433 oa Warre

27 Firewall ptimizatio Place loopback rules as early as possible Place forwardig rules as early as possible se the state ad coectio-trackig modules to bypass the firewall for established coectios Combie rules to stadard CP clietserver coectios ito a sigle rule usig port lists Place rules for heavy traffic services as early as possible oa Warre

28 ser efied Chais iptables - P -i $ -d <public address> \ -j -iput iptables - -iput -p udp --sport 53 \ --dport 53 -j - ds-server-i iptables - -iput -p tcp! --sy --sport 53 \ --dport 1024: j -ds-server-i iptables - -ds-server-i server -s $V_1 \ -j CCP oa Warre

29 verview llows you to covert from ad exteral ip address to a iteral oe ource he source address of the iitial packet is modified Performed o the PG Chai. cludes Q fuctioality estiatio he destiatio address of the iitial packet is modified Performed o the PG or P chai oa Warre

30 tadard xample iptables -t at - PG -o \ <exteral iterface> -j --to-source \ <exteral address> iptables - FW -i <iteral iterface> \ -o <exteral iterface> -m state --state \ W,BLH,L BLH -j CCP iptables - F -o <iteral iterface> \ -m state --state BLH,L -j CCP oa Warre

31 Chapter ummary he superservers, ietd ad xietd, liste to umerous ports ad start etwork services whe eeded to respod to a icomig cliet request pplicatio-level security is provided for xietd via CP Wrappers - the tcpd program Ports are mapped to service ames by the /etc/services file ome etwork services such as pache Web server ad the id ews server are ot desiged to be ru by the superserver but ru as stadaloe etwork testig services such as charge ad echo are provided by ietd oa Warre

32 Lab 2 ask 1: stallig xietd ask 2: Cofigurig Liux ask 3: CP Wrappers ad Pables ask 4: stallig iger ask 5: Lab Questios oa Warre