IPtables Tips and Tricks-3.ppt - LinuxFest Northwest 2015

下载 0

Null

发布于

1844

人观看

#信息技术

Scenario: You are going to make changes to the IPTables policy rules. You want to avoid locking yourself, and potentially everybody else out too (this costs time ...

展开查看详情

1 .IPTables Tips and Tricks: More Than Just ACCEPT and DROP Gary Smith, Pacific Northwest National Laboratory

2 . A Little Context The Five Golden Principles of Security Know your system Principle of Least Privilege Defense in Depth Protection is key but detection is a must. Know your enemy. 2

3 . Avoiding Locking Yourself Out Scenario: You are going to make changes to the IPTables policy rules. You want to avoid locking yourself, and potentially everybody else out too (this costs time and money). Tips #1: Take a backup of your IPTables configuration before you ever start working on it. /sbin/iptablessave > /root/iptablesworks Even better, include a timestamp as part of the file name: /sbin/iptablessave > /root/iptablesworks`date +%F` You get a file with a name like /root/IPTablesworks20140414. If you do something that prevents your system from working, you can quickly restore it. /sbin/iptablesrestore < /root/iptablesworks20140414 3

4 . Avoiding Locking Yourself Out (2) Tip #2: Every time you create a backup copy of the IPTables policy, create a link to the file with ‘latest’ as part of the name. ln –s /root/iptablesworks`date +%F` /root/iptablesworkslatest Create a cron script that will reload to your ‘latest’ working saved policy every 5 minutes during testing. 4

5 . Avoiding Locking Yourself Out (3) Tip #3: Have an IPMI/KVM console ready and waiting. If you’re working on a physical server, connect to the IPMI port on the server and log into the server. If you’re working on a VM, start up a console session on the VM and log into the VM. 5

6 . Avoiding Locking Yourself Out (4) Tip #4: Put specific rules at the top of the policy and generic rules at the bottom. The more criteria you specify in the rule, the less chance you will have of locking yourself out. iptables A INPUT p tcp dport 22 –s 10.0.0.0/8 –d 192.168.100.101 j DROP Avoid generic rules like this at the top of the policy rules: iptables A INPUT p tcp dport 22 j DROP There are plenty of ways that you can be more specific. For example, using "-i eth0" will limit the processing to a single NIC in your server. This way, it will not apply the rule to eth1. 6

7 . Avoiding Locking Yourself Out (5) Tip #5: Whitelist your IP address at the top of your policy rules. This is a very effective method of not getting locked out. Everybody else, not so much. iptables I INPUT s <your IP> j ACCEPT You need to put this as the FIRST rule in order for it to work properly. Remember, "-I" inserts it as the first rule; "-A" appends it to the end of the list. 7

8 . Avoiding Locking Yourself Out (6) Tip #6: Know and understand all of the rules in your current policy. Not making the mistake in the first place is half the battle. If you understand the inner workings behind your IPTables policy, it will make your life easier. Draw a flow chart if you must. Also remember: What the policy does and what it is supposed to do can be two different things. 8

9 . Setting Up a Workstation Firewall Policy Scenario: You want to set up a workstation with a restrictive firewall policy: Tip #1: Set the default policy as DROP. Tip #2: Allow only the minimum amount of services needed to let the user get work done. # Set a default policy of DROP *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] 9

10 . Setting Up a Workstation Firewall Policy (2) # Accept any related or established connections I INPUT 1 m state state RELATED,ESTABLISHED j ACCEPT I OUTPUT 1 m state state RELATED,ESTABLISHED j ACCEPT # Allow all traffic on the loopback interface A INPUT i lo j ACCEPT A OUTPUT o lo j ACCEPT # Allow outbound DHCP request A OUTPUT –o eth0 p udp dport 67:68 sport 67:68 j ACCEPT 10

11 . Setting Up a Workstation Firewall Policy (3) # Allow inbound SSH A INPUT i eth0 p tcp m tcp dport 22 m state state NEW j ACCEPT # Allow outbound email A INPUT i eth0 p tcp m tcp dport 25 m state state NEW j ACCEPT # Outbound DNS lookups A OUTPUT o eth0 p udp m udp dport 53 j ACCEPT # Outbound PING requests A OUTPUT –o eth0 p icmp j ACCEPT # Outbound Network Time Protocol (NTP) request A OUTPUT –o eth0 p udp dport 123 sport 123 j ACCEPT 11

12 . Setting Up a Workstation Firewall Policy (4) # Outbound HTTP A OUTPUT o eth0 p tcp m tcp dport 80 m state state NEW j ACCEPT A OUTPUT o eth0 p tcp m tcp dport 443 m state state NEW j ACCEPT COMMIT 12

13 . Restricting an IP Address Range Scenario: You’re employees are spending too much time on Facebook and not getting their work done. You want to block access to Facebook. Tip: Use this process to block access to Facebook. Find out all ip addresses of facebook.com: host t a www.facebook.com www.facebook.com is an alias for star.c10r.facebook.com. star.c10r.facebook.com has address 31.13.65.17 whois 31.13.65.17 | grep inetnum inetnum: 31.13.64.0 31.13.127.255 13

14 . Restricting an IP Address Range (2) Convert that range to CIDR notation (http://www.ipaddressguide.com/cidr) and you get 31.13.64.0/18. To prevent outgoing access to www.facebook.com, do iptables A OUTPUT p tcp i eth0 –o eth1 –d 31.13.64.0/18 j DROP 14

15 . Regulating by Time Scenario: The backlash from your employees over denying access to Facebook is causes you to relent (a little). You decide to allow access to facebook.com only at lunch time (1200 to 1300). Tip: Use the time features of IPTables to open up the access. iptables –A OUTPUT p tcp m multiport –dport http,https i eth0 o eth1 m time timestart 12:00 timestop 13:00 –d 31.13.64.0/18 j ACCEPT This presumes a default policy of DROP. 15

16 . Regulating by Time (2) Scenario: Drop all TCP/UDP traffic during service hours (between 02:00 and 03:00), that is, for maintenance’s tasks which should not be disrupted by incoming traffic. iptables A INPUT p tcp m time timestart 02:00 timestop 03:00 j DROP iptables A INPUT p udp m time timestart 02:00 timestop 03:00 j DROP 16

17 . Limiting Connections with IPTables Scenario: You suspect a bad actor is attempting to DoS your webserver. Tip #1: You can restrict the number of connections a single IP address can have to your webserver. iptables –A INPUT –p tcp –syn m multiport –dport 80,443 –m connlimit –connlimitabove 20 –j REJECT –rejectwithtcpreset 17

18 . Limiting Connections by Time (2) Tip #2: You can drop incoming connections if the IP address makes more than 10 connections to port 80/443 in 100 seconds. iptables –A INPUT –p tcp m multiport –dport 80,443 – m state d–state NEW –m recent –set iptables –A INPUT –p tcp m multiport –dport 80,443 – m state –state NEW –m recent –update –seconds 100 –hitcount 10 –j DROP 18

19 . Monitoring IPTables Scenario: You would like to monitor what’s going on with IPTables in real time, sort of like with “top”. Tip #1: Issue this command as root: watch interval=5 ’iptables nvL | grep v "0 0"’ Note: the spacing on the “grep” command is important. The result looks like this: 19

20 . Monitoring IPTables (2) 20

21 . Monitoring IPTables (3) Tip #2: Use this Perl script from perlmonks.org http://www.perlmonks.org/?node_id=513732. It does a more comprehensive display. 21

22 . Monitoring IPTables (4) 22

23 . Reporting on IPTables Scenario: You (Your boss) think(s) this dynamic stuff is just great, but a daily activity report would also be great. Tip: Use FWReport (http://fwreport.sourceforge.net/). FWReport is a log parser and reporting tool for IPTables. It generates daily and monthly summaries of the log files, allowing the security administrator to free up substantial time, maintain better control over security of the network, and reduce unnoticed attacks. 23

24 . Reporting on IPTables (2) 24

25 . Visualizing IPTables Log Files Scenario: It’s almost time for the monthly operations review and you would like to have a really great graphical representation of the activity on the firewall for the past month. Tip: There is an excellent tutorial on how to use psad, afterglow, and graphviz to visualize the activity in your IPTables firewall logs (http://lintut.com/use-afterglow-to- visualize-iptables-logs-on-centos-rhel-fedora/) Here are some examples: 25

26 . Visualizing IPTables Firewall Input 26

27 . Visualizing IPTables Firewall Output 27

28 . In Conclusion… We’ve covered many facets of IPTables; all the way from making sure you don’t lock yourself out when working with IPTables to monitoring IPTables to visualizing the activity of an IPTables firewall. These are just some of the tips and tricks that exist for IPTables. These will get you started down the path to realizing even more IPTables tips and tricks. There REALLY is more to IPTables than just ACCEPT and DROP. 28

29 . References Convert an address range to CIDR - www.ipaddressguide.com/cidr Real-time IPTables Monitor - www.perlmonks.org/? node_id=513732 FWReport - http://fwreport.sourceforge.net Using Afterglow to Visualize IPTables Logs - http://lintut.com/use-afterglow-to-visualize-IPTables-logs- on-centos-rhel-fedora/ IPTables - http://www.netfilter.org/ 29

1点赞

0收藏

0下载