Databases, Systems & Networks

Source: linuxhomenetworking.com

Introduction

Network security is a primary consideration in any decision to host a website as the threats are becoming more widespread and persistent every day. One means of providing additional protection is to invest in a firewall. Though prices are always falling, in some cases you may be able to create a comparable unit using the Linux iptables package on an existing server for little or no additional expenditure.
This chapter shows how to convert a Linux server into:

• A firewall while simultaneously being your home website’s mail, web and DNS server.
• A router that will use NAT and port forwarding to both protect your home network and have another web server on your home network while sharing the public IP address of your firewall.

Creating an iptables firewall script requires many steps, but with the aid of the sample tutorials, you should be able to complete a configuration relatively quickly.

What Is iptables?

Originally, the most popular firewall/NAT package running on Linux was ipchains, but it had a number of shortcomings. To rectify this, the Netfilter organization decided to create a new product called iptables, giving it such improvements as:

• Better integration with the Linux kernel with the capability of loading iptables-specific kernel modules designed for improved speed and reliability.
• Stateful packet inspection. This means that the firewall keeps track of each connection passing through it and in certain cases will view the contents of data flows in an attempt to anticipate the next action of certain protocols. This is an important feature in the support of active FTP and DNS, as well as many other network services.
• Filtering packets based on a MAC address and the values of the flags in the TCP header. This is helpful in preventing attacks using malformed packets and in restricting access from locally attached servers to other networks in spite of their IP addresses.
• System logging that provides the option of adjusting the level of detail of the reporting.
• Better network address translation.
• Support for transparent integration with such Web proxy programs as Squid.
• A rate limiting feature that helps iptables block some types of denial of service (DoS) attacks.

Considered a faster and more secure alternative to ipchains, iptables has become the default firewall package installed under RedHat and Fedora Linux.

Download And Install The Iptables Package

Before you begin, you need to make sure that the iptables software RPM is installed. (See Chapter 6, « Installing Linux Software« , if you need a refresher.) When searching for the RPMs, remember that the filename usually starts with the software package name by a version number, as in iptables-1.2.9-1.0.i386.rpm.

Managing the iptables Server

Managing the iptables daemon is easy to do, but the procedure differs between Linux distributions. Here are some things to keep in mind.

• Firstly, different Linux distributions use different daemon management systems. Each system has its own set of commands to do similar operations. The most commonly used daemon management systems are SysV and Systemd.
• Secondly, the daemon name needs to be known. In this case the name of the daemon is iptables.

Armed with this information you can know how to:

• Start your daemons automatically on booting
• Stop, start and restart them later on during troubleshooting or when a configuration file change needs to be applied.

For more details on this, please take a look at the « Managing Daemons » section of Chapter 6 « Installing Linux Software »

Note: Remember to configure your daemon to start automatically upon your next reboot.

Lire la suite…

par Alban Jacquemin et Adrien Mercier

1 – Pourquoi un firewall

De nos jours, toutes les entreprises possédant un réseau local possèdent aussi un accès à Internet, afin d’accéder à la manne d’information disponible sur le réseau des réseaux, et de pouvoir communiquer avec l’extérieur. Cette ouverture vers l’extérieur est indispensable… et dangereuse en même temps. Ouvrir l’entreprise vers le monde signifie aussi laisser place ouverte aux étrangers pour essayer de pénétrer le réseau local de l’entreprise, et y accomplir des actions douteuses, parfois gratuites, de destruction, vol d’informations confidentielles, … Les mobiles sont nombreux et dangereux.

Pour parer à ces attaques, une architecture sécurisée est nécessaire. Pour cela, le coeur d’une tel architecture est basé sur un firewall. Cette outil a pour but de sécuriser au maximum le réseau local de l’entreprise, de détecter les tentatives d’intrusion et d’y parer au mieux possible. Cela représente une sécurité supplémentaire rendant le réseau ouvert sur Internet beaucoup plus sûr.  De plus, il peut permettre de restreindre l’accès interne vers l’extérieur. En effet, des employés peuvent s’adonner à des activités que l’entreprise ne cautionne pas, le meilleur exemple étant le jeu en ligne. En plaçant un firewall limitant ou interdisant l’accès à ces services, l’entreprise peut donc avoir un contrôle sur les activités se déroulant dans son enceinte.

Le firewall propose donc un véritable contrôle sur le trafic réseau de l’entreprise. Il permet d’analyser, de sécuriser et de gérer le trafic réseau, et ainsi d’utiliser le réseau de la façon pour laquelle il a été prévu et sans l’encombrer avec des activités inutiles, et d’empêcher une personne sans autorisation d’accéder à ce réseau de données.

2 – Les différents types de filtrages

2.1 – Le filtrage simple de paquet (Stateless)

2.1.1 – Le principe

C’est la méthode de filtrage la plus simple, elle opère au niveau de la couche réseau et transport du modèle Osi. La plupart des routeurs d’aujourd’hui permettent d’effectuer du filtrage simple de paquet. Cela consiste à accorder ou refuser le passage de paquet d’un réseau à un autre en se basant sur :

– L’adresse IP Source/Destination.
– Le numéro de port Source/Destination.
– Et bien sur le protocole de niveau 3 ou 4.

Cela nécessite de configurer le Firewall ou le routeur par des règles de filtrages, généralement appelées des ACL (Access Control Lists).

2.1.2 – Les limites

Le premier problème vient du fait que l’administrateur réseau est rapidement contraint à autoriser un trop grand nombre d’accès, pour que le Firewall offre une réelle protection. Par exemple, pour autoriser les connexions à Internet à partir du réseau privé, l’administrateur devra accepter toutes les connexions TCP provenant de l’Internet avec un port supérieur à 1024. Ce qui laisse beaucoup de choix à un éventuel pirate.

Il est à noter que de définir des ACL sur des routeurs haut de gamme – c’est à dire, supportant un débit important – n’est pas sans répercussion sur le débit lui-même. Enfin, ce type de filtrage ne résiste pas à certaines attaques de type IP Spoofing / IP Flooding, la mutilation de paquet, ou encore certaines attaques de type DoS. Ceci est vrai sauf dans le cadre des routeurs fonctionnant en mode distribué. Ceci permettant de gérer les Acl directement sur les interfaces sans remonter à la carte de traitement central. Les performances impactées par les Acl sont alors quasi nulles.

Lire la suite…

Packet filtering using network rules such as NAT (network address translation) can be accomplished by using iptables. Iptables utilize ports and protocols and may also be used as a firewall.

Using iptables for IPv4

By default, the iptables tool is included with your Linode supplied distribution. In order to use iptables, you will have to have root privileges to make changes. The location of the iptables files is in the /sbin directory. However, you will make changes to these files by invoking commands, not with a text editor.

The iptables Command

There are a number of options that can be used with iptables. Before you begin, you need to understand how iptables work. As stated above, iptables are used to set the rules governing network traffic. You can define different tables to handle these rules. The table contains a variety of built-in chains, but you can add your own chains. A chain is a list of rules that match a set of packets.

Basic iptables Parameters

In order to start using iptables, you will need to understand some basics about the command syntax. For example:

iptables -I INPUT -s 12.34.56.78 -j DROP

In the sample above you are invoking iptables by its name. The -I option is for insertion. Using a rule with the insertion option will add it at the beginning of a chain, it will also be the rule that is applied first. You may also use a number with -I option to indicate its placement in the chain. The -s parameter along with the IP address (12.34.56.78) indicates the source. Finally the -j parameter is for jump. It specifies the target of the rule i.e. what action it is to perform if the packet is a match.

For example, the rule above is added to the beginning of the chain, and it will drop all packets from the address 12.34.56.78 received from anywhere.

Default Tables

A root or sudo user can create tables. Tables are comprised of built-in chains and may also contain user-defined chains. The built-in tables present will depend on the kernel configuration and the installed modules. Below is a list of the tables available.

The default tables are as follows:

• Filter – this is the default table. Its built-in chains are:
  • Input – is for packets going to local sockets
  • Forward – is for packets routed through the server
  • Output – is for locally-generated packets
• Nat – when a packet creates a new connection this is the table that is used. Its built-in chains are Prerouting, Output, and Postrouting
  • Prerouting is for packets when they come in
  • Output is for locally-generated packets before routing takes place
  • Postrouting is for altering packets on the way out
• Mangle – is used for special altering of packets. Its chains are Pre/Post routing, Forward, Input, and Output
  • Prerouting is for incoming packets
  • Postrouting is for packets going out
  • Output is for locally generated packets that are being altered.
  • Input is for packets coming directly into the server
  • Forward is for packets being routed through the server
• Raw – is used primarily for configuring exemptions from connection tracking. The built-in chains are Prerouting and Output.
  • Prerouting is for packets that arrive by the network interface
  • Output is for processes that are locally generated
• Security – is used for Mandatory Access Control (MAC) rules. After the filter table, the security table is accessed next. The built-in chains are Input, Output, and Forward.
  • Input pertains to packets entering the server
  • Output is for locally-generated packets
  • Forward is for packet passing through the server

Lire la suite…

Every business needs DDoS protection.

Today it’s important for the success of your business to have an online presence. You always thought that you would never be a victim of DDoS attacks. But, what would happen if your website or online application is down because of a DDoS attack?

Here are some facts taken from digitalattackmap:

• Attacks are cheaper (150$ for a week long DDoS)
• Their number are increasing every weeks (2000/day)
• Increase attributed downtime (1/3 of all downtime incidents)

You can even block a 1TB DDoS attack!

With enough preparation, anybody can block a DDoS attack of any size and we will tell you how in 5 steps.

1. Become invisible
2. Filter aggressively
3. Identify attack patterns
4. Block traffic patterns
5. Deploy counter-measures solutions

Lire la suite…

Source: DigitalOcean – Mitchell Anicas