UbuntuHelp:DynamicFirewall
来自Ubuntu中文
![]() |
点击翻译: |
English |
请不要直接编辑翻译本页,本页将定期与来源同步。 |
Skill: Intermediate Complexity: Moderate Est``Time``To``Complete: 1.25 hours Related``Mod: Self:RoamingProfilesWithNetworkManager As part of your comprehensive security planning it is essential to enable and configure a firewall for your system. This is especially true for a roaming laptop. Firewalls manage network access. A firewall policy enforced on a laptop system helps deter network attacks and allows you, good sysdamin, full working knowledge of what ports applications are allowed to communicate on. While Ubuntu is quite good at limiting the number of default network services and keeping unneccessary network services turned off it is still good security practice to limit the network access. That is, "Deny everything in AND out, unless it is expressly allowed". However, as there is always a compromise between ultimate security, convienience and managability we are going to allow the laptop system to initiate any outbound network connection and highly restrict the types of external services that may initiate an inboud connection to the laptop. WARNING! Please evaluate your security needs and adjust the policy to suite your goals. This example policy demonstration may not be restrictive enough for your system security policy and procedures. Do not implement this in a production or live environment until you understand the security implications of the policy rules.
目录
- 1 Roaming Laptop Network Security
- 2 Iptables Firewall
- 2.1 Iptables INIT Script
- 2.2 FWBuilder
- 2.3 Build Firewall Policy
- 2.4 Open/Create New Policy File
- 2.5 New Firewall Object
- 2.6 Select Template
- 2.7 ADD WiFi Interface
- 2.8 Understanding Firewall Builder Policy Rules
- 2.9 Understanding the Template Policy
- 2.10 Season Rules
- 2.11 Compile Rules
- 2.12 Install Rules
- 3 Firewall Policy Reloads
- 4 Network Roaming Profiles
- 5 Creative Commons License
Roaming Laptop Network Security
One of the pleasures with Ubunto Feisty Fawn 7.04 is the NetworkManager. If you allow it to manage the network interfaces with DHCP you can move with relative ease between differnet networks. Unfortunately, NetworkManager doesn't seem to work well just yet with static ip or profiles. Nor, does it trigger any scripting to allow for re-jiggering any firewalls to adjust for new interface address assignments. Consequently, it can be painful to tailor your laptop for site specific services. e.g., default laser printers at work, default ink-jet printers at home. Or custom firewall policies based on location. e.g., more permissive firewall rules while at work, very restrictive rules while roaming. What follows is a setup for a roaming laptop using iptables for the firewall policy enforcement and laptop-net for profile/location management. With `laptop-net` you'll be able to set static ip addresses for your interfaces, assign default printers, re-configure the firewall and anything else you may want to distinguish between profiles.
Iptables Firewall
The Linux kernel supplied with Ubuntu provides a powerfull and dizzingly configurable statefull firewall service managed through iptables.
Iptables INIT Script
To assist with enabling/disabling the iptables firewall you may wish to install this init.d script. When called with `/etc/init.d/iptables start` the script will pull the previous firewall policy and run with that configuration. When called with `/etc/init.d/iptbales stop` the script will flush any currently configured rules and open the INPUT,FORWARD and OUTPUT chains to ACCEPT all connections. When called with `/etc/init.d/iptbales save` the currently running policy will be saved for future restarts. Save this script https://help.ubuntu.com/community/initd_iptables.txt to `?action=AttachFile&do=get&target=etc%2Finit.d%2Fiptables%60. Make the script executable.
chmod 755 /etc/init.d/iptables
FWBuilder
I use the incredible and competent fwbuilder to configure and manage firewall settings. Creating rules with iptables syntax is very tedious and complicated. Beyond single host management it is also adept at managing multiple hosts firewall configuration policies. Firewall Builder also includes a built in revision control system for easy reversions back to previously working policies. (This requires RCS.)
apt-get install fwbuilder
*It is assumed that you have a working GUI available as fwbuilder requires one For detailed documentation and User Guides visit: http://www.fwbuilder.org/
Build Firewall Policy
With fwbuilder we will build a base policy based on the principle of "Deny everything in AND out, unless it is expressly allowed'." However, as there is always a compromise between ultimate security, convienience and managability we are going to allow the laptop system to initiate any outbound network connection and highly restrict the types of external services that may initiate an inboud connection to the laptop.
Open/Create New Policy File
Start fwbuilder with `Alt-F2`. Select `Create new project file` and then name and save in the location of your choosing. Unless you have RCS installed or care to default to the named file on application start pass on selecting any options for the new file.
New Firewall Object
`Right-Click` on `User:Firewalls` folder and select `New Firewall`. Enter the name of the new object. e.g., Your hostname or someother unique identifier. Choose `iptables` as the firewall software. Choose `Linux 2.4/2.6` as the OS the firewall runs on. Select `Use preconfigured template firewall objects` to ease the policy creation. This is optional if you have more advanced requirements. Click `Next`.
Select Template
This documentation assumes a roaming laptop with wired and wireless interfaces with dynamicaly assigned addresses.
Choose `host fw template 1`.
Click `Finish`.
You should have something similar to the following:
ADD WiFi Interface
On my laptop the WiFi interface is dependent on restricted modules. That being said you must have networking working correctly before adding interfaces to the firewall policy. If you define a new interface that doesn't exist the installation of the rules will fail.
The `host fw template 1` already created the outside eth0 interface. If your wired interface is identified differently you'll need to change the name.
In the `User::Firewalls::<YourFWHostName>` menu heiarchy you should see `loopback` and `outside` interfaces. The `outside` interface should already be defined `dyn ext`.
`Right-Click` on the `outside` interface and `Duplicate...:place here`.
`Right-Click` on the new `outside` interface and `Edit`.
Rename the interface name to the `Name:` of your WiFi interface. This will be completely dependent on your system setup and WiFi hardware. In my case it is `ath0`. You may be able to identify the WiFi interface from the output of `ifconfig`.
Rename the `Label:` for the WiFi interface to something identifiable. e.g., `outside-wifi`.
Assure that `Address is assigned dynamically` is selected.
Assure that `This interface is external(insecure)` is checked.
Click `Apply Changes`.
You'll note that a new policy tab `outside-wifi` (or whatever label you assigned for the interface) is created. This is an automatic default anti-spoofing rule.
Your firewall policy will now look similar to the following:
Understanding Firewall Builder Policy Rules
Firewall Builder (fwbuilder) follows a rule based paradigm. Each rule attempts to match the source, destination and service to decide what action to perform. It is a top-down priority. The source, destination and service begins from the top of the policy at Rule0 and flows through each successive rule until matched or the rules are exhausted. If the source, destination and service request matches a rule set successive rule matching is terminated. Consequently, you encounter a shadow rule. (Don't worry fwbuilder attempts to alert for this condition.) A shadowing example: Say you have a web server running on your laptop that you let the world visit. Creating these simple rules produces a shadow. While you intend to let external sources connect to your running web service, this policy first matches the request at Rule0 and stops proccessing. Rule1 is never matched and external users never get to your web server.
Rule - Source - Destination - Service - Action 0 - Any - <YourLaptop> - Any - Deny 1 - Any - <YourLaptop> - HTTP - Allow
To achieve your intention of allowing external sources to only access the HTTP service the correct rule set would look something like the following.
Rule - Source - Destination - Service - Action 0 - Any - <YourLaptop> - HTTP - Allow 1 - Any - <YourLaptop> - Any - Deny
Understanding the Template Policy
In english, the `host fw template 1` for all inbound/outbound network communications the policy reads: Begin with Rule1 and allow any external host to connect to the laptop for icmp,ping and ssh services. If not matched then apply Rule1 and allow the laptop to connect to any external host for any service. If not matched then apply Rule2 and deny the connection request for any host to any destination for any service and log it. (The 'default' rule.) The anti-spoofing rule which is a rule for the outside interface(s) reads: Deny all network connection request inbound to the interface from the outside for any destination and any service, when the source is the laptop ip address and log it. It would make no sense for your laptop ip to be inbound to itself from the outside. It means someone has assumed your assigned address and is attempting to 'spoof' you. The loopback rule simply allows all traffic in any direction on the loopback (127.0.0.1) There is no neccessity for NAT rules in this configuration.
Season Rules
With a roaming laptop the chances are good that you'll have no need to ssh into your system from another remote host. Therefore, remove the service from Policy::Rule0. (If you wanted to go stealth, you could also remove Useful_ICMP and 'ping request'.)
Warning! As mentioned before the ideal situation is to also restrict outbound network connection requests from your laptop to a small set of known services. This may mitigate rogue applications from making spurious port connections. But, in the interest of managability and convienience we are more concerned about the outside world getting in then we are about the laptop getting out. So, we'll leave Policy::Rule1 alone. Adjust as you see fit.
You should always have a Default Rule which is always last and almost universally any-any-any-deny-log. It is the catch all rule that is the last word on what to do with network connection requests.
For my tastes I run the EKIGA open source VoIP and video conferencing application for GNOME. Ekiga uses both the H.323 and SIP protocols. So, I created the 5060 UDP SIP object and added the already existing 1720 TCP H323 object into Policy::Rule0.
When all is said and done you will have something like the following.
Compile Rules
Once satisfied with your firewall security policy compile it for potential errors and then we'll install it. Click on `Rules:Compile`. If there are any errors edit the policy and re-compile until successfull. Unless you modified where the policy install script is saved it will be in the same working directory as your created/saved fwbuilder policy. The compiled installation script will have the .fw extension.
Install Rules
Unfortunately you'll need to install the firewall policy from the command line. Open a terminal and `sudo -i` to root. Then run the script.
root@pokey:~#<pathToPolicy>/<policyFileName>.fw Activating firewall script generated Mon Jul 9 15:50:35 2007 by userName Rule 0 (eth0) Rule 0 (lo) Rule 0 (global) Rule 1 (global) Rule 2 (global)
Curious? The .fw installation file is a plain text shell script file that you may open to see how the rules are applied with iptables. Run `iptables -L` to see the running iptables firewall ruleset you just applied.
root@pokey:~# iptables -L ... Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT 0 -- anywhere anywhere state NEW RULE_2 0 -- anywhere anywhere Chain Cid46928FE0.0 (0 references) target prot opt source destination ACCEPT icmp -- anywhere anywhere icmp ttl-zero-during-transit ACCEPT icmp -- anywhere anywhere icmp ttl-zero-during-reassembly ACCEPT icmp -- anywhere anywhere icmp type 0 code 0 ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp type 8 code 0 ...
Oops
If something should go wrong you can disable the new rules and try again.
/etc/init.d/iptables stop
OK
If the firewall rules are running to your satisfaction save the current configuration.
/etc/init.d/iptables save
Firewall Policy Reloads
Now that you have a working firewall policy we need a mechanism to reload the policy installation script each time the address changes for either the wired or wireless interfaces. Without reloading the firewll configuration when network interface ip address assignments change, the current and running firewall policy would continue with previously set ip addresses. While your interface associated with an updated ip address the firewall, as configured from this guide, will prevent any network activity. It will appear as though the network is broken.
Manual
You could simply call the `fwbuilder` firewall generated `*.fw` script whenever you change locations. Or add a panel icon to call the script. e.g.,
sudo -i /etc/myfirewall.fw
However, either way requires a manual intervention and becomes unwieldy if you have diverse firewall policies for the different network associations. A better, automated and highly flexible way to reset the firewall for your dynamic interfaces is with Roaming Profiles through Network``Manager.
Network Roaming Profiles
Follow the guide Self:RoamingProfilesWithNetworkManager to install and configure a basic roaming profile with Network``Manager.
Creative Commons License
Author: James B. Crocker EMail: [email protected] [1] This work is licensed under a Creative Commons Attribution-Share Alike 3.0 License.