VizagInfo.com Home | VizagInfo Mirror of LG


Automatic Firewall Hardening with Linux and IPTABLES

Written by Vasoo Veerapen (dive_mauritius@hotmail.com)  
Version 1.1, modified on the 20th of January 2002.
The original documents can always be found at http://www.islandsoft.net/veerapen.html

Please note that any content within this document is Copyrighted material at all times. Any reproduction, modification, or use of this document and/or contents from the islandsoft.net domain, in part or entirety, is prohibited  unless explicit permission is obtained from the author. 

The objective of this document is to show you how you can automatically harden your IPTABLES based firewall in real-time which is a technique used by commercial firewalls to prevent invalid packets from reaching protected networks. The content has been tested against Linux Mandrake 8.0 with Kernel 2.4.3 and IPTABLES 1.2.1a. Mandrake claim their distribution to be Red Hat compliant so the content in this article should be fully Red Hat compatible. I don't have any experience whatsoever with other distros, but then, I live on the island of Mauritius which is a hell of a journey from civilisation, and all of us here are scantily clad Zulu warriors :-) For more info about Mauritius click here

There are many books available on Linux Security. I like these ones.

Real World Linux Security (Intrusion, Prevention, Detection and Recovery)
Hacking Linux Exposed

Usually IPTABLES only logs messages via the SYSLOGD mechanism. Logs by themselves are fine for basic security but do not address advanced security issues. For advanced security you need to make your system run custom scripts as soon as illegal operations are logged by the firewall. Depending on the severity of the violations, you can program these scripts to perform various actions such as paging network admins or blocking offending IP addresses. All too often, firewall logs are checked once daily, or utilities such as LOGCHECK are used in scheduled CRON jobs to inform network admins of anything abnormal. By the time the logs are verified, the damage to your system is already done.

Linux SYSLOGD incorporates a neat feature which allows SYSLOGD to send the messages it receives to user defined pipes which can pass the message in turn to a script of your choice. The message flow is outlined below. 

IPTABLES > SYSLOGD > named pipe > custom script

 In the following exercise, I will show you how to add a DROP command to IPTABLES in order to block offending IP addresses in real-time as soon as a FIN scan is detected.  You could of course program  your scripts to do a multitude of other things as well. 

You can get the entire tarball for this exercise here.

Requirements for this exercise:

Machine X (192.168.0.1)
Needs IPTABLES, SYSLOGD enabled, the C shell(csh) and Apache. This is the machine that we will be tinkering with and where you will need to install the demo scripts.

Machine Y (192.168.0.2)
Install NMAP on Machine Y

This is what we will be doing:

(1) Create a firewall script using IPTABLES
(2) Create a named pipe.
(3) Create a firewall hardening script.
(4) Convey data from the named pipe to the firewall hardening script.
(5) Tell SYSLOGD to echo messages to the named pipe.
(6) Send SIGHUP to syslogd.
(7) Use NMAP to generate SYN/FIN scans

(1) Create a Firewall Script using IPTABLES

I have included the demo IPTABLES script as a text version for you to download. Make the script executable and run it. Don't forget to be logged in as root.

chmod 750 script_name
./script_name

      

#!/bin/sh
#
# Automatic Firewall Hardening
# by Vasoo Veerapen (dive_mauritius@hotmail.com)
# http://www.islandsoft.net/veerapen.html
#
# Please note that this script is Copyrighted material at all times.
# Any reproduction, modification or use of this document and/or its contents, 
# in part or entirety, is prohibited unless permission is obtained from the author.
#
# Maybe you are interested in scuba diving, marine conservation or my
# homeland, the paradise island of Mauritius where the Dodo used to live?
# Its simply
# http://www.islandsoft.net
#
# Revised on 1st of December 2001
#
# ----------------------------------------------------------------------
#
# This is a very basic IPTABLES script which checks for TCP scans with
# only the FIN bit set. FIN never occurs on its own and is an indication
# that someone is probably scanning your firewall and up to no good.
#
# If a scan is detected, it gets logged and the firewall is hardened
# against the offending IP address. This is a base for much more
# complex operations such as intrusion detection, paging  network
# admins, etc.
#
# The hardening is performed via syslogd which echoes messages
# to a named pipe rather than the screen. The named pipe then conveys
# data from syslogd to a hardening script of your choice.
#
# -----------------------------------------------------------------------
#
# Q: How do I generate SYN/FIN scans?
# A: Get NMAP at http://www.insecure.org/nmap
#
# Q: How do I create a named pipe?
# A: mknod /path/named_pipe p
#    chmod 600 /path/named_pipe
#
# Q: How do I tell syslogd to send data to the named pipe?
# A: Edit /etc/syslog.conf
#    Look for an entry starting like
#	*.info;mail.none;authpriv.none
#    Change the line to look like
#	*.info;mail.none;authpriv.none |/path/named_pipe
#
#	Replace the space between .none and | with a TAB!
#
# Q: How do I convey data from the named pipe to my script.
# A: (/path/my_script < /path/named_pipe)&
#    Then send kill -1 to syslogd.
#
#	Unless you want to type in this command every time you restart your
#	system I suggest that it be issued on system startup.
#	I use Red Hat/Mandrake, so in my case I put it into /etc/rc.d/rc.local

IPT="/sbin/iptables"

INT_IF="eth0"

LOG_LEVEL="notice"

$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD

$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP

#*******************************************************************************
#FILTER_FLAGS
#*******************************************************************************
echo Entering FILTER_FLAGS
$IPT -N FILTER_FLAGS
$IPT -F FILTER_FLAGS
##----------------------------------------------------------------------------##
$IPT -A FILTER_FLAGS -p tcp --tcp-flags ALL FIN -m limit \
	--limit 5/minute -j LOG --log-level $LOG_LEVEL \
	--log-prefix "*SCAN*"
$IPT -A FILTER_FLAGS -p tcp --tcp-flags ALL FIN -j DROP

##----------------------------------------------------------------------------##
echo Leaving FILTER_FLAGS

#*******************************************************************************
# BANNED
#*******************************************************************************
echo Entering BANNED
$IPT -N BANNED
$IPT -F BANNED
##----------------------------------------------------------------------------##
# Leave blank
##----------------------------------------------------------------------------##
echo Leaving BANNED

	$IPT -A INPUT -j BANNED
	$IPT -A INPUT -j FILTER_FLAGS

	$IPT -A OUTPUT -j BANNED
	$IPT -A OUTPUT -j FILTER_FLAGS

#------------- End firewall script
      

(2) Create a Named Pipe

This creates a FIFO buffer which can store information coming from syslogd.

mknod /path/my_pipe p
chmod 600 /path/my_pipe

You could also use the mkfifo command. For more information, man is your friend.

(3) Create a Firewall Hardening Script

This script analyses the messages sent from SYSLOGD. If the messages contain the *SCAN* string, they get processed and the appropriate action is taken. I have included the demo script as a text version for you to download.


#!/bin/csh -f
#
# Please note that this script is Copyrighted material at all times.
# Any reproduction, modification or use of this document and/or its contents, 
# in part or entirety, is prohibited unless permission is obtained from the author.
#
loop:
set x="$<"

echo "$x" | grep -q '*SCAN*'
if ($status == 0 ) then
	set banned_ip=`echo "$x" | sed "s/.*SRC=\([^ ]*\) .*/\1/"`
	echo "# IP address $banned_ip was terminated."
	/sbin/iptables -A BANNED -s $banned_ip -j DROP
	/sbin/iptables -A BANNED -d $banned_ip -j DROP
endif

goto loop
#-----End shell script
      

(4) Convey Data from the Named Pipe to Script

At the command line, type in the following

(/path/my_script < /path/my_pipe)&

Unless you want to type in this command every time you restart your system I suggest that it be issued on system startup. In my case I placed the above line into /etc/rc.d/rc.local

(5) Tell syslogd to echo messages to the named pipe.

Backup and edit /etc/syslog.conf
Look for an entry starting like 
*.info;mail.none;authpriv.none


If you can't/can find the line then add/change the line to look like 
*.info;mail.none;authpriv.none |/path/my_pipe 

Remember the following points:
Make sure that you do not use spaces between authpriv.none and the pipe sign | Always use TAB.
Do not leave spaces between the pipe sign | and /path/my_pipe. They must be side by side without any spaces between them.

(6) Send SIGHUP to syslogd

Run ps -ax to find the pid of SYSLOGD. Issue a kill -1 to SYSLOGD

kill -1 [pid of syslogd]

(7) Use NMAP to send SYN/FIN scans

I have Apache (httpd) running on machine X (192.168.0.1) and I have installed my state-of-the-art IPTABLES firewall without forgetting my extremely intelligent C shell script.

On Machine Y (192.168.0.2) I open my favorite web browser.

On Y, I type in http://192.168.0.1/ and get my default Apache page. Nothing abnormal here. Now trying something slightly more evil, I go to the command line and type

nmap -sF -p 80 192.168.0.1

Taking a look at the screen on Machine X, I see

IP Address 192.168.0.2 was terminated.

Issue the command iptables -L on Machine X to verify if this is indeed the case.

Now try to get access to http://192.168.0.1 from Machine Y


Please note that any content within this document is Copyrighted material at all times. Any reproduction, modification, or use of this document and/or contents from the islandsoft.net domain, in part or entirety, is prohibited  unless explicit permission is obtained from the author.