Jonathan's Contribution

Linux Configuration

Gateway Firewall and Security

Introduction

References

We need to get ipmasqadm. The rpm can be retrieved from Juanjo's website . We retrieve the actual rpm.

I startup the firewall by calling a created file /etc/rc.d/rc.firewall, from /etc/rc.d/rc.local. I know this is not strictly RedHat's Sys V way of doing things. Look in Trinity OS for an approach that creates a /etc/rc.d/init.d/firewall startup / shutdown script.

Restricting Permissions

It is wise to only have root rwx permissions for files in /etc/rc.d:

chown -R root:root /etc/rc.d/*

chmod -R 700 /etc/rc.d/*

Remember to do the same with rc.firewall once we have created it.

The Firewall Startup Scripts

Modify the /etc/rc.d/rc.local start up script, so it looks like (use your own names):; rc.local; rc.firewall; Now lets confirm that the settings are okay.; Next we do an; And lastly we do a:; Now, ping a host on the external network. Use its ip address if the internal name server is not set up yet.

TCP Wrappers

References

hosts.allow man page
/usr/doc/tcp_wrappers*/README

As Gateway is a firewall server only the minimum of inet services must started, and they must be restricted only for the appropriate access. We do this first by enabling only the permitted services in /etc/inetd.conf

inetd.conf

>>>>>>>>>>>>>>>>>>>>>>>>/etc/inetd.conf

# inetd.conf    This file describes the services that will be available
#               through the INETD TCP/IP super server.  To re-configure
#               the running INETD process, edit this file, then send the
#               INETD process a SIGHUP signal.
#
# Version:      @(#)/etc/inetd.conf     3.10    05/27/93
#
# Authors:      Original taken from BSD UNIX 4.3/TAHOE.
#               Fred N. van Kempen, &ltlwaltje@uwalt.nl.mugnet.org>
#
# Modified for Debian Linux by Ian A. Murdock <imurdock@shell.portal.com>
#
# Modified for RHS Linux by Marc Ewing <marc@redhat.com>
#
# <service_name> <sock_type> <proto> <flags> <user> <server_path> <args>
#
# Echo, discard, daytime, and chargen are used primarily for testing.
#
# To re-read this file after changes, just do a 'killall -HUP inetd'
#
#echo   stream  tcp     nowait  root    internal
#echo   dgram   udp     wait    root    internal
#discard        stream  tcp     nowait  root    internal
#discard        dgram   udp     wait    root    internal
daytime stream  tcp     nowait  root    internal
daytime dgram   udp     wait    root    internal
#chargen        stream  tcp     nowait  root    internal
#chargen        dgram   udp     wait    root    internal
time    stream  tcp     nowait  root    internal
time    dgram   udp     wait    root    internal
#
# These are standard services.
#
ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -a
telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
#
# Shell, login, exec, comsat and talk are BSD protocols.
#
#shell  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rshd
#login  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rlogind
#exec   stream  tcp     nowait  root    /usr/sbin/tcpd  in.rexecd
#comsat dgram   udp     wait    root    /usr/sbin/tcpd  in.comsat
#talk   dgram   udp     wait    nobody.tty      /usr/sbin/tcpd  in.talkd
#ntalk  dgram   udp     wait    nobody.tty      /usr/sbin/tcpd  in.ntalkd
#dtalk  stream  tcp     wait    nobody.tty      /usr/sbin/tcpd  in.dtalkd
#
# Pop and imap mail services et al
#
#pop-2  stream  tcp     nowait  root    /usr/sbin/tcpd  ipop2d
#pop-3   stream  tcp     nowait  root    /usr/sbin/tcpd ipop3d
#imap    stream  tcp     nowait  root    /usr/sbin/tcpd imapd
#
# The Internet UUCP service.
#
#uucp   stream  tcp     nowait  uucp    /usr/sbin/tcpd  /usr/lib/uucp/uucico    -l
#
# Tftp service is provided primarily for booting.  Most sites
# run this only on machines acting as "boot servers." Do not uncomment
# this unless you *need* it.  
#
#tftp   dgram   udp     wait    root    /usr/sbin/tcpd  in.tftpd
#bootps dgram   udp     wait    root    /usr/sbin/tcpd  bootpd
#
# Finger, systat and netstat give out user information which may be
# valuable to potential "system crackers."  Many sites choose to disable 
# some or all of these services to improve security.
#
#finger stream  tcp     nowait  nobody  /usr/sbin/tcpd  in.fingerd
#cfinger stream tcp     nowait  root    /usr/sbin/tcpd  in.cfingerd
#systat stream  tcp     nowait  guest   /usr/sbin/tcpd  /bin/ps -auwwx
#netstat        stream  tcp     nowait  guest   /usr/sbin/tcpd  /bin/netstat    -f inet
#
# Authentication
#
# identd is run standalone now
#
#auth   stream  tcp     wait    root    /usr/sbin/in.identd in.identd -e -o
#
# End of inetd.conf
#swat      stream  tcp     nowait.400      root /usr/sbin/swat swat

<<<<<<<<<<<<<<<<<<<<<<<<<</etc/inetd.conf

Basically the only inet services enables are time, daytime, telnet and ftp. The only reason time and daytime are enabled is that gateway also serves as a time server, and is an accurate time reference for other hosts (internal and external) to obtain their time.

The hosts.allow and hosts.deny files for tcp wrappers follow a mostly closed approach where everything in denyied initially, and only those permitted services are allowed.

hosts.deny

>>>>>>>>>>>>>>>>>>>>>>>>/etc/hosts.deny

#
# hosts.deny This file describes the names of the hosts which are
#  *not* allowed to use the local INET services, as decided
#  by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!

ALL: ALL

<<<<<<<<<<<<<<<<<<<<<<<</etc/hosts.deny

hosts.allow

>>>>>>>>>>>>>>>>>>>>>>>/etc/hosts.allow

# hosts.allow This file describes the names of the hosts which are
#  allowed to use the local INET services, as decided
#  by the '/usr/sbin/tcpd' server.
#
# Give complete access for all to the local host
ALL:            127.0.0.1, 24.113.94.87, 24.113.98.164, 192.168.0.254

# Defind access rules for hosts on local network.
#   hal-9000, hershel, hercules,  and henry are trusted to access this host.
ALL:  192.168.0.1 192.168.0.3, 192.168.0.4, 192.168.0.6

# Telnet access for "trusted" external addresses
in.telnetd: 24.113.94.163           # Ron's address
in.telnetd: 163.241.175.102  # wormhole.amp.com
in.telnetd: 208.239.159.2   # backdoor.macom.com

<<<<<<<<<<<<<<<<<<<<<<</etc/hosts.allow

Note that telnet is further restricted by the limited number of users, and cryptic passwords. This is not bullet proof, and telnet is still susceptable to IP address spoofing. In the future this will become ssh. Ftp access can only occur from the internal network (port forwarding from the external network), and its setup is also very access restrictive, not allowing anonymous ftp. Using Wu-ftp as the ftp server, we remove its ability to guest or host anonymous ftp by editing its first line.

ftpaccess

>>>>>>>>>>>>>>>>>>>>>/etc/ftpaccess

class   all   real *

email ftpmaster@novatek.co.nz
loginfails 3
banner  /etc/msgs/ftpbanner
greeting brief
readme  README*    login
readme  README*    cwd=*
message /welcome.msg           
login
message .message               
cwd=*
limit all 20 Any  /etc/msgs/ftptoomany
compress        yes            
all
tar            
yes            
all
chmod  no  guest,anonymous
delete  no  guest,anonymous
overwrite no  guest,anonymous
rename  no  guest,anonymous
upload  /home/ftp  *              
no
upload  /home/ftp  /incoming      
yes  ftp  ftp  0666
log commands real
log transfers anonymous,real inbound,outbound
passwd-check rfc822 enforce

<<<<<<<<<<<<<<<<<<<<</etc/ftpaccess

[Home] [Up] [Prev] [Next]