Secure Linux Build

[homecomputeraid]

I want to create a DMZ for a small network I administer. In it, I want a hardened, dedicated DNS Server, an MTA Server, and a device to monitor those to make sure they're not hacked.

I'd like to make them secure Linux builds. Any resources you recommend?

[edit]So far, I've found these:

http://tldp.org/HOWTO/Chroot-BIND-HOWTO.html (This article seems to suggest that qmail might be a very secure MTA. Do you think it's better than postfix?)

http://www.postfix.org/linuxjournal.200010/4241.html

http://www.securityfocus.com/infocus/1419

http://www.securityfocus.com/infocus/1420

Please bear in mind that I'm an absolute newbie with Linux. I don't know how to compile my own kernel yet, or any stuff like that. Some newbie secure server build walkthrough would be great if you know of one!

[edit]I just found this about qmail:

http://www.lifewithqmail.org/lwq.pdf

[scuzzman]

qmail is rather secure, and as for a DNS server, BIND comes with most distrobutions. The only thing you're going to need is a firewall -- and iptables is compiled into the kernel and is a very good one. You'll need a good server distrobution, which I'd suggest Slackware or Debian (avoid RPM-based distros such as Mandrake, Fedora, and SuSE).

About IPTABLES, it does SPI, and can be configured for DMZ. Check out http://www.linuxguruz.com for good tutorials...

Also, this site will build an iptables script for you, that is very well commented and gives you a VERY good foundation on which you can learn to script IPTABLES yourself and build your own (like writing your own hardware firewall :D ): http://easyfwgen.morizot.net/gen/

[homecomputeraid]

Thanks Scuzzman!

This might sound like a silly question, but I'm behind a firewall in my DMZ, and I plan to disable all ports/protocols except those absolutely needed for each server. Should I add firewall software to each server, or will that somehow increase my vulnerability by adding software which requires even more knowledge and configuration? Is Stateful Packet Inspection needed in my scenario on the DNS and MTA Servers?

I realize I'm making a hole in my firewall to the DMZ for DNS and SMTP, but I wonder if less is more is the best approach? I'm going to keep reading about it too.

Also, I've found a lot of great How-To's at http://www.tldp.org/HOWTO/HOWTO-INDEX/howtos.html. I'm starting with the basics and working toward a secure install.

Have you heard of or tried the NSA's SELinux Kernel? Any thoughts on it?

[scuzzman]

I've seen a few people using it, and have yet to hear anything negative. That said, all the reviews I've seen seem to indicate all neutral/generic comments.

As for the question at hand, it's like this:

When a packet comes in, if you have an iptables firewall configured it will traverse the entire ruleset until it finds one that applies to it, then take that path. Like this: If I had a packet come in on port 22 (SSH) and had the following ruleset this is what would occur:

iptables -n tcp_inbound -destination-port 22 -j ACCEPT

iptables -n tcp_inbound -j DROP

the packet would see the first rule, and be accepted. At this point, it never sees the second rule. Now, lets become a little more elaborate with it: the packet comes in on port 5031 and this is my ruleset:

iptables -n tcp_inbound -destination-port 22 -j ACCEPT

iptables -n tcp_inbound -destination-port 110 -j ACCEPT

iptables -n tcp_inbound -destination-port 80 -j ACCEPT

iptables -n tcp_inbound -j DROP

The packet would be dropped. The reason is, no previous rules apply to it (they all apply to ports 22, 110, and 80 respectively) .

This is my current iptables script. It is commented OK, and there are only certain parts that need edited/tailored to suit your needs, making it a good starter script. Keep in mind, a few of these rules may not need to be here (I'm using my Linux box as a router).

#!/bin/sh

SYSCTL="/sbin/sysctl -w" 
WAN="eth0"
LAN="eth1"
LOCAL_IP="192.168.0.1"
LOCAL_NET="192.168.0.0/24"
LOCAL_BCAST="192.168.0.255"
LOOP="lo"
LO_IP="127.0.0.1"

if [ "$1" = "save" ]
then
	echo -n "Saving firewall to /etc/sysconfig/iptables ... "
	iptablesS > /etc/sysconfig/iptables
	echo "done"
	exit 0
elif [ "$1" = "restore" ]
then
	echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
	iptablesR < /etc/sysconfig/iptables
	echo "done"
	exit 0
fi

###############################################################################
#
# Load Modules
#

echo "Loading kernel modules ..."

# core netfilter module
/sbin/modprobe ip_tables

# the stateful connection tracking module
/sbin/modprobe ip_conntrack

# The ftp nat module is required for non-PASV ftp support
/sbin/modprobe ip_nat_ftp

# the module for full ftp connection tracking
/sbin/modprobe ip_conntrack_ftp

# the module for full irc connection tracking
/sbin/modprobe ip_conntrack_irc

if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/ip_forward
else
    $SYSCTL net.ipv4.ip_forward="1"
fi

if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/tcp_syncookies
else
    $SYSCTL net.ipv4.tcp_syncookies="1"
fi

if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
else
    $SYSCTL net.ipv4.conf.all.rp_filter="1"
fi

if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
else
    $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
fi

if [ "$SYSCTL" = "" ]
then
    echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
else
    $SYSCTL net.ipv4.conf.all.accept_source_route="0"
fi

if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
else
    $SYSCTL net.ipv4.conf.all.secure_redirects="1"
fi

# This option logs packets from impossible addresses.
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
else
    $SYSCTL net.ipv4.conf.all.log_martians="1"
fi


###############################################################################
#
# Flush Any Existing Rules or Chains
#

echo "Flushing Tables ..."

# Reset Default Policies
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT

# Flush all rules
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Erase all non-default chains
iptables -X
iptables -t nat -X
iptables -t mangle -X

if [ "$1" = "stop" ]
then
	echo "Firewall completely flushed!  Now running with no firewall."
	exit 0
fi

###############################################################################
#
# Rules Configuration
#

###############################################################################
#
# Filter Table
#
###############################################################################

# Set Policies

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

###############################################################################
#
# User-Specified Chains
#
# Create user chains to reduce the number of rules each packet
# must traverse.

echo "Create and populate custom rule chains ..."

# Create a chain to filter INVALID packets
iptables -N bad_packets

# Create another chain to filter bad tcp packets
iptables -N bad_tcp_packets

# Create separate chains for icmp, tcp (incoming and outgoing),
# and incoming udp packets.
iptables -N icmp_packets

# Used for UDP packets inbound from the Internet
iptables -N udp_inbound

# Used to block outbound UDP services from internal network
# Default to allow all
iptables -N udp_outbound

# Used to allow inbound services if desired
# Default fail except for established sessions
iptables -N tcp_inbound

# Used to block outbound services from internal network
# Default to allow all
iptables -N tcp_outbound

###############################################################################
#
# Populate User Chains
#

# bad_packets chain
#
# Drop INVALID packets immediately

iptables -A bad_packets -p ALL -m state --state INVALID -j LOG \
    --log-prefix "Invalid packet: "
iptables -A bad_packets -p ALL -m state --state INVALID -j DROP

# Then check the tcp packets for additional problems
iptables -A bad_packets -p tcp -j bad_tcp_packets

# All good, so return
iptables -A bad_packets -p ALL -j RETURN
iptables -A bad_tcp_packets -p tcp -i $LAN -j RETURN
iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
    --log-prefix "New not syn: "
iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

# All good, so return
iptables -A bad_tcp_packets -p tcp -j RETURN
iptables -A icmp_packets --fragment -p ICMP -j LOG \
    --log-prefix "ICMP Fragment: "
iptables -A icmp_packets --fragment -p ICMP -j DROP
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j DROP

# Time Exceeded
iptables -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

# Not matched, so return so it will be logged
iptables -A icmp_packets -p ICMP -j RETURN
iptables -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
iptables -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
iptables -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j REJECT
iptables -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 \
     -j ACCEPT
iptables -A udp_inbound -p UDP -j RETURN
iptables -A udp_outbound -p UDP -s 0/0 -j ACCEPT
iptables -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j REJECT

##################
# Custom ports
# Here, we add the custom ports for the tcp_inbound chain
# These are processed before the default DROP policy
# So they stay alive
##################

# Bittorrent - ports 6881-6889 
iptables -A tcp_inbound -p TCP -s 0/0 --destination-port 6881:6889 -j ACCEPT

# Webmin - port 8081
iptables -A tcp_inbound -p TCP -s 0/0 --destination-port 8081 -j ACCEPT

# DCC - port 1025
iptables -A tcp_inbound -p TCP -s 0/0 --destination-port 1025 -j ACCEPT

# SSH - port 110
iptables -A tcp_inbound -p TCP -s 0/0  --destination-port 110 -j ACCEPT

# HTTP - port 8080
#iptables -A tcp_inbound -p TCP -s 0/0 --destination-port 8080 -j ACCEPT

##################
# END CUSTOM PORTS
#################

# Default policies

# Inbound default policy is to DROP the packet
# This is reached only if the packet does not apply to any of the custom configurations
iptables -A tcp_inbound -p TCP -j DROP

# Outbound default policy is to ACCEPT (allow) the packet
# This is a little less secure, as we are letting any data go out
# thus allowing any program to "call home" (will be fixed soon)
iptables -A tcp_outbound -p TCP -s 0/0 -j ACCEPT

###############################################################################
#
# INPUT Chain
#

echo "Process INPUT chain ..."
iptables -A INPUT -p ALL -i $LOOP -j ACCEPT
iptables -A INPUT -p ALL -j bad_packets
iptables -A INPUT -p ALL -d 224.0.0.1 -j DROP

# Rules for the private network (accessing gateway system itself)
iptables -A INPUT -p ALL -i $LAN -s $LOCAL_NET -j ACCEPT
iptables -A INPUT -p ALL -i $LAN -d $LOCAL_BCAST -j ACCEPT

# Allow DHCP client request packets inbound from internal network
iptables -A INPUT -p UDP -i $LAN --source-port 68 --destination-port 67 \
     -j ACCEPT
iptables -A INPUT -p ALL -i $WAN -m state --state ESTABLISHED,RELATED \
     -j ACCEPT
iptables -A INPUT -p TCP -i $WAN -j tcp_inbound
iptables -A INPUT -p UDP -i $WAN -j udp_inbound
iptables -A INPUT -p ICMP -i $WAN -j icmp_packets
iptables -A INPUT -p ALL -d 255.255.255.255 -j DROP
iptables -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
    --log-prefix "INPUT packet died: "

##############################################################
#
# FORWARD Chain
#

echo "Process FORWARD chain ..."

iptables -A FORWARD -p ALL -j bad_packets
iptables -A FORWARD -p tcp -i $LAN -j tcp_outbound
iptables -A FORWARD -p udp -i $LAN -j udp_outbound
iptables -A FORWARD -p ALL -i $LAN -j ACCEPT
iptables -A FORWARD -i $WAN -m state --state ESTABLISHED,RELATED \
     -j ACCEPT
iptables -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
    --log-prefix "FORWARD packet died: "

echo "Process OUTPUT chain ..."
iptables -A OUTPUT -m state -p icmp --state INVALID -j DROP
iptables -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
iptables -A OUTPUT -p ALL -o $LOOP -j ACCEPT
iptables -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
iptables -A OUTPUT -p ALL -o $LAN -j ACCEPT
iptables -A OUTPUT -p ALL -o $WAN -j ACCEPT
iptables -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
    --log-prefix "OUTPUT packet died: "

###############################################################################
#
# nat table
#
###############################################################################

echo "Load rules for nat table ..."

iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

[homecomputeraid]

Thanks Scuzzman!

So, I should probably do a secure build and, in addition to only enabling UDP Port 53 on my DNS Server, and SMTP TCP Port 25 on my Mail Server, add a firewall, and a rule to the same effect, to make sure any 'holes' I've missed, or OS vulnerabilities are blocked?

Thanks for the feedback about the SELinux kernel. It does seem to be available for Ubuntu, by the way.

What are your thoughts on the security of FreeBSD, or OpenBSD versus Linux for building a secure server? I've read that OpenBSD takes a secure default build approach requiring the user to enable services he or she needs, instead of having everything on by default. I also found (after blowing away my Ubuntu build) that OpenBSD seems to want me to buy their CD for $40.00. The iso image that they have on their site lets me blow everything away, but doesn't have any of the other files needed for install! :blink:

They said I can build my own iso image, but don't really say how to do that. :unsure:

Luckily, Ubuntu's a breeze to install, and the box is an expiramental one used for such purposes anyway. B)

[Redhat]

Personally, I would use Free or Open BSD for this purpose. For important things, I always use FreeBSD, for the pure fact that in my opinion, it runs faster and more stable than Linux. If you wish to stick with Linux rather than learn a new O/S, I suggest either Debian Stable, or Slackware. Both because they are mature distributions, and both, in my opinion, superb distros too.

If you choose to install Debian (what Ubuntu is based on, so you probably know alot about it) do a bare-bones install, and then apt-get something like XFCE4 or Enlightenment. Or, if you are comfortable with the command line, keep it as it is after fresh install.

With FreeBSD, check FreeBSD.org regularly for security updates.

As this sounds like an important server, I would check forums etc.. for problems with new kernels and program versions before installing them.

Here are some links I use to keep on top of security:

http://www.linuxsecurity.com

http://www.securiteam.com

http://www.freebsd.org/security/index.html

http://www.freebsd.org/doc/en_US.ISO8859-1...ERESOURCES-MAIL

http://www.securityfocus.com

HTH, Sorry I didn't post sooner.

[scuzzman]

*BSD is meant to inherently be stable and secure, and thus does a very good job at this. Package installation is a breeze with *BSD's PORTS system, but it takes some getting used to.

I suggest reading this: BSD for Linux Users. It explains very well the similarties and differences between BSD and Linux. In particular, I like this quote:

BSD is what you get when a bunch of Unix hackers sit down to try to port a Unix system to the PC. Linux is what you get when a bunch of PC hackers sit down and try to write a Unix system for the PC.

Here is a complete walkthrough on installing OpenBSD on your PC.

I would say this is purely a matter of choice in what you want to do (meaning which UNIX-like OS to choose). If you choose Linux, I would suggest Slack or Debian (as mentioned above) and use only stable (as in NON-TESTING) packages. The same applies for BSD (I reccomend OpenBSD).

As for "OS Vulnerabilities" keep in mind this: this is not an issue. Because of the modular nature of a Linux system, there is no such thing. You would need to worry about a kernel vulnerability, or an IPTABLES vulnerability (yeah, right), or some other vulnerability (also keep in mind how quickly these are found and patched on open-source software :) ) but as long as you use stable programs that have had their bugs worked out, the chances of this are pretty slim.

[homecomputeraid]

Awsome Scuzzman!

I had already muddled my way through the OpenBSD install. The default GUI is ugly! I'm not choosing it because of its GUI though. For the apps I want to run, I'll probably never even start the GUI.

Thanks so much for the info!

[Redhat]

Welcome to X Window Mananger, it's probably on every Linux box you've used but I also hate it :D

Should be easy enough to get a non-resource-pig WM, such as XFCE, Fluxbox, Enlightenment, BlackBox.. but for a server, it IS best not to run a GUI all the time, you want those extra CPU cycles for the purpose it's there for :P

[scuzzman]

Awsome Scuzzman!

I had already muddled my way through the OpenBSD install.

Congrats :D

The default GUI is ugly!  I'm not choosing it because of its GUI though.  For the apps I want to run, I'll probably never even start the GUI.

Yup -- that's XWM. As Redhat says, if you want a GUI, there are some very eye-candy ones that are very lightweight -- probably already available in the ports tree.

Thanks so much for the info!

No problem -- need anything else, just ask!

[homecomputeraid]

It looks like OpenBSD's the way to go for secure servers. Thank you both for your help. I'm focusing on learning OpenBSD for now. At least enough to do the servers.

I like your quote explaining the difference between BSD and Linux Scuzzman:

BSD is what you get when a bunch of Unix hackers sit down to try to port a Unix system to the PC. Linux is what you get when a bunch of PC hackers sit down and try to write a Unix system for the PC.

In "Sams Teach Yourself FreeBSD in 24 Hours," I learned that Mac OSX is BSD based, and that Yahoo!, the Apache Project, and Sony Japan run on FreeBSD.

It was also interesting to learn that BSD has a much more open license than Linux. BSD licensing does allow anyone to start with BSD as a base, build something, and sell it without releasing the base code!

[scuzzman]

Indeed it does have a much more open license than the GPL. This is precisely why, when someone steals something from open source software (*Cough*Berkeley Sockets*Cough*) they do so from a project licensed under a BSD license, and not the GPL.

Given this example, you can see why this sort of licensing (the BSD variant) and the GPL can both be bittersweet at times...

[Redhat]

OpenBSD 3.7 has been released: "We are pleased to announce the official release of OpenBSD 3.7. This is our 17th release on CD-ROM (and 18th via FTP). We remain proud of OpenBSD's record of eight years with only a single remote hole in the default install. As in our previous releases, 3.7 provides significant improvements, including new features, in nearly all areas of the system. New platforms: OpenBSD/zaurus - expanding the arm porting effort by supporting the Sharp Zaurus SL-C3000, bringing a secure ssh-capable machine to your pocket; OpenBSD/sgi - starting out support with the SGI O2 machines.

http://archives.neohapsis.com/archives/ope...05-05/1297.html

http://www.openbsd.org :D

Going to install over Ubuntu on the server :P

[homecomputeraid]

Redhat,

I don't notice any difference whatsoever in the install process between OpenBSD Versions 3.6 and 3.7, but I assume that 3.7's more secure, so I'm upgrading.