|By Joshua Drake||
|September 20, 2001 12:00 AM EDT||
(LinuxWorld) -- As I write this column, the world suffers infestation by yet another Internet worm, and again the worms are intended to attack Microsoft-based machines. Fortunately for my company, we don't run any Microsoft-based machines, but the Nimda worm still affects us.
Nimda eats our bandwidth since other companies sharing our subnet are running infectious Windows 98, NT, and 2000 machines. These diseased, ill-maintained beasts from the land of insufficient light are now trying to infest our stable, secure, long running, easy-to-use, well-behaved Linux machines. (Can you tell I'm a bit irritated?)
This has led me to start editing some of our firewall rules, and in the process, consider that, as we have recently migrated to the 2.4 kernel, some people may be interested in how to create a Linux 2.4 kernel-based firewall quickly.
The following examples do not create the perfect firewall. What I describe is designed to give a system administrator a little piece of mind by fortifying a machine from obvious attacks.
The 2.2 version of the Linux kernel used the ipchains application to control the firewall. For standard firewalling, ipchains is a decent solution. We still use it on some of our machines, and there is still a positive argument for 2.2 kernel-based firewalls, because the 2.4 kernel still has some stability issues under heavy load.
Those heavy load issues aside, the 2.4 kernel provides a wealth of networking capabilities 2.2 lacks. These include stateful firewalling and solid quality-of-service options. One could argue that the 2.4 kernel, and its iptables firewall code, enables a person to build intricate firewalls capable of competing with the likes of CheckPoint.
The command to execute iptables is simple: as root type
iptables. The execution of the previous command should display output similar to the following:
[[email protected] root]# /sbin/iptables iptables v1.2.1: no command specified Try `iptables -h' or 'iptables --help' for more information. [[email protected] root]#
If you would like an output of the available options when using the iptables you can pass the
-h flag during program execution. The
-h command will result in output similar to the following:
[[email protected] root]# /sbin/iptables -h iptables v1.2.1 Usage: iptables -[ADC] chain rule-specification [options] iptables -[RI] chain rulenum rule-specification [options] iptables -D chain rulenum [options] iptables -[LFZ] [chain] [options] iptables -[NX] chain iptables -E old-chain-name new-chain-name iptables -P chain target [options] iptables -h (print this help information)
Commands: Either long or short options are allowed. --append -A chain Append to chain --delete -D chain Delete matching rule from chain --delete -D chain rulenum [...]
For this article, I am not going to go into exhaustive explanation of all the iptables options. If you want an advanced introduction, to iptables I suggest the Linux 2.4 Packet Filtering HOWTO (see resources below).
When developing a personal or desktop firewall I practice a very simple philosophy. If you aren't going to use it, don't open it. For example, if you are not hosting a Web site, do not open port 80. If you are not using telnet (and there is not a good reason on this Earth to use telnet), do not open port 23!
In an effort to follow my philosophy, the quickest way to port protection nirvana is the following iptables chain:
/sbin/iptables -A INPUT -p tcp --syn -j DROP
The previous statement will allow you to, as the user of the computer, performed all your normal Internet activities. You will be able to browse the Web, ssh out, or chat with a colleague on ICQ. On the other hand, the outside world, when trying to connect to your Linux box via TCP/IP, will simply be ignored. This is a reasonable solution for most Linux computers.
However, one of the benefits of Linux is its remote management capabilities. One of the more popular ways that people remotely manage Linux machines is via the SSH (see resources) suite. SSH typically operates on port 22 and thus, we would need to enable connections to port 22, while keeping the rest of the connections closed. This can be done with the following iptable chains:
/sbin/iptables -A INPUT -p tcp --syn --destination-port 22 -j ACCEPT /sbin/iptables -A INPUT -p tcp --syn -j DROP
It is probably not a good idea to let the world connect to your machine on port 22 unless you run a public server. Therefore, we can limit which machines can connect to port 22 by modifying the iptable chain, and adding the
-s option. The
-s in this example specifies what source address is allowed to connect to the server.
/sbin/iptables -A INPUT -p tcp --syn -s 192.168.1.110/32 --destination-port 22 -j ACCEPT /sbin/iptables -A INPUT -p tcp --syn -j DROP
The addition of the
-s 192.168.1.110/32 will enable only the remote machine with the IP address of 192.168.1.110 to connect to your protected host.
When you create an iptables-based firewall, each chain (for simplicity's sake, each line) will be read sequentially. Thus, it is possible to have the previous configuration of only one machine having rights to connect via SSH, and to run a public Web server. This could be done with the following commands:
/sbin/iptables -A INPUT -p tcp --syn -s 192.168.1.110/32 --destination-port 22 -j ACCEPT /sbin/iptables -A INPUT -p tcp --syn --destination-port 80 -j ACCEPT /sbin/iptables -A INPUT -p tcp --syn -j DROP
This is just an introduction to iptables, but it does give a reasonable representation of the bare essentials for a firewall. If you are currently running Linux with kernel 2.4, it may be a good time to review what your firewall looks like. On a closing note, if you are still running kernel 2.2 and you are looking for a good firewall configuration utility, take a look at Guard Dog (see resources).
|Peter 10/04/04 12:38:21 PM EDT|
Thank you... this is the info I have been looking for, a quick and simple way to secure a basic web server.
|Jules 07/24/04 02:19:10 PM EDT|
Thankyou! At last an article that shows me how to create a simple set of rules.
|Pankaj Kumar 09/27/03 12:17:26 AM EDT|
Good introductory article on iptables for newbies.
Established in 1998, Calsoft is a leading software product engineering Services Company specializing in Storage, Networking, Virtualization and Cloud business verticals. Calsoft provides End-to-End Product Development, Quality Assurance Sustenance, Solution Engineering and Professional Services expertise to assist customers in achieving their product development and business goals. The company's deep domain knowledge of Storage, Virtualization, Networking and Cloud verticals helps in delivering ...
Oct. 25, 2016 08:30 PM EDT Reads: 1,089
SYS-CON Events announced today that Enzu will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Enzu’s mission is to be the leading provider of enterprise cloud solutions worldwide. Enzu enables online businesses to use its IT infrastructure to their competitive advantage. By offering a suite of proven hosting and management services, Enzu wants companies to focus on the core of their online busine...
Oct. 25, 2016 08:15 PM EDT Reads: 1,369
In the next five to ten years, millions, if not billions of things will become smarter. This smartness goes beyond connected things in our homes like the fridge, thermostat and fancy lighting, and into heavily regulated industries including aerospace, pharmaceutical/medical devices and energy. “Smartness” will embed itself within individual products that are part of our daily lives. We will engage with smart products - learning from them, informing them, and communicating with them. Smart produc...
Oct. 25, 2016 07:30 PM EDT Reads: 1,536
November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Penta Security is a leading vendor for data security solutions, including its encryption solution, D’Amo. By using FPE technology, D’Amo allows for the implementation of encryption technology to sensitive data fields without modification to schema in the database environment. With businesses having their data become increasingly more complicated in their mission-critical applications (such as ERP, CRM, HRM), continued ...
Oct. 25, 2016 07:30 PM EDT Reads: 1,104
OnProcess Technology has announced it will be a featured speaker at @ThingsExpo, taking place November 1 - 3, 2016, in Santa Clara, California. Dan Gettens, OnProcess’ Chief Analytics Officer, will discuss how Internet of Things (IoT) data can be leveraged to predict product failures, improve uptime and slash costly inventory stock. @ThingsExpo is an annual gathering of IoT and cloud developers, practitioners and thought-leaders who exchange ideas and insights on topics ranging from Big Data in...
Oct. 25, 2016 07:15 PM EDT Reads: 280
SYS-CON Events announced today that SoftNet Solutions will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. SoftNet Solutions specializes in Enterprise Solutions for Hadoop and Big Data. It offers customers the most open, robust, and value-conscious portfolio of solutions, services, and tools for the shortest route to success with Big Data. The unique differentiator is the ability to architect and ...
Oct. 25, 2016 07:00 PM EDT Reads: 1,023
SYS-CON Events announced today that Cloudbric, a leading website security provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Cloudbric is an elite full service website protection solution specifically designed for IT novices, entrepreneurs, and small and medium businesses. First launched in 2015, Cloudbric is based on the enterprise level Web Application Firewall by Penta Security Sys...
Oct. 25, 2016 06:45 PM EDT Reads: 1,240
SYS-CON Events announced today that Transparent Cloud Computing (T-Cloud) Consortium will exhibit at the 19th International Cloud Expo®, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. The Transparent Cloud Computing Consortium (T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data proces...
Oct. 25, 2016 06:45 PM EDT Reads: 1,439
SYS-CON Events announced today that Roundee / LinearHub will exhibit at the WebRTC Summit at @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LinearHub provides Roundee Service, a smart platform for enterprise video conferencing with enhanced features such as automatic recording and transcription service. Slack users can integrate Roundee to their team via Slack’s App Directory, and '/roundee' command lets your video conference ...
Oct. 25, 2016 06:15 PM EDT Reads: 2,140
Successful digital transformation requires new organizational competencies and capabilities. Research tells us that the biggest impediment to successful transformation is human; consequently, the biggest enabler is a properly skilled and empowered workforce. In the digital age, new individual and collective competencies are required. In his session at 19th Cloud Expo, Bob Newhouse, CEO and founder of Agilitiv, will draw together recent research and lessons learned from emerging and established ...
Oct. 25, 2016 05:45 PM EDT Reads: 1,443
SYS-CON Events announced today that Coalfire will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Coalfire is the trusted leader in cybersecurity risk management and compliance services. Coalfire integrates advisory and technical assessments and recommendations to the corporate directors, executives, boards, and IT organizations for global brands and organizations in the technology, cloud, health...
Oct. 25, 2016 05:15 PM EDT Reads: 1,614
As ridesharing competitors and enhanced services increase, notable changes are occurring in the transportation model. Despite the cost-effective means and flexibility of ridesharing, both drivers and users will need to be aware of the connected environment and how it will impact the ridesharing experience. In his session at @ThingsExpo, Timothy Evavold, Executive Director Automotive at Covisint, will discuss key challenges and solutions to powering a ride sharing and/or multimodal model in the a...
Oct. 25, 2016 04:45 PM EDT Reads: 1,553
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, will discuss how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team a...
Oct. 25, 2016 03:15 PM EDT Reads: 428
A completely new computing platform is on the horizon. They’re called Microservers by some, ARM Servers by others, and sometimes even ARM-based Servers. No matter what you call them, Microservers will have a huge impact on the data center and on server computing in general. Although few people are familiar with Microservers today, their impact will be felt very soon. This is a new category of computing platform that is available today and is predicted to have triple-digit growth rates for some ...
Oct. 25, 2016 03:00 PM EDT Reads: 34,207
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
Oct. 25, 2016 03:00 PM EDT Reads: 2,024
The Internet of Things (IoT), in all its myriad manifestations, has great potential. Much of that potential comes from the evolving data management and analytic (DMA) technologies and processes that allow us to gain insight from all of the IoT data that can be generated and gathered. This potential may never be met as those data sets are tied to specific industry verticals and single markets, with no clear way to use IoT data and sensor analytics to fulfill the hype being given the IoT today.
Oct. 25, 2016 02:15 PM EDT Reads: 2,679
SYS-CON Events announced today that Numerex Corp, a leading provider of managed enterprise solutions enabling the Internet of Things (IoT), will exhibit at the 19th International Cloud Expo | @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Numerex Corp. (NASDAQ:NMRX) is a leading provider of managed enterprise solutions enabling the Internet of Things (IoT). The Company's solutions produce new revenue streams or create operating...
Oct. 25, 2016 01:30 PM EDT Reads: 2,708
SYS-CON Events announced today that MathFreeOn will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. MathFreeOn is Software as a Service (SaaS) used in Engineering and Math education. Write scripts and solve math problems online. MathFreeOn provides online courses for beginners or amateurs who have difficulties in writing scripts. In accordance with various mathematical topics, there are more tha...
Oct. 25, 2016 01:15 PM EDT Reads: 1,070
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
Oct. 25, 2016 12:45 PM EDT Reads: 4,961
@ThingsExpo has been named the Top 5 Most Influential Internet of Things Brand by Onalytica in the ‘The Internet of Things Landscape 2015: Top 100 Individuals and Brands.' Onalytica analyzed Twitter conversations around the #IoT debate to uncover the most influential brands and individuals driving the conversation. Onalytica captured data from 56,224 users. The PageRank based methodology they use to extract influencers on a particular topic (tweets mentioning #InternetofThings or #IoT in this ...
Oct. 25, 2016 12:30 PM EDT Reads: 8,498