Notes from Fedora Linux Toolbox: 1000+ Commands for Fedora, CentOS, & Red Hat Power Users Christopher Negus 978-0470082911

sestatus results on my FC14

SELinux status: enabled

SELinuxfs mount: /selinux

Current mode: enforcing
Mode from config file: enforcing

Policy version: 24

Policy from config file: targeted
config file on my FC14
# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

# targeted - Targeted processes are protected,

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

/etc/blockhosts.cfg

/etc/logrotate.d/blockhosts

/etc/logwatch/conf/services/blockhosts.conf

/etc/logwatch/scripts/services/blockhosts

/usr/bin/bhrss.py

/usr/bin/blockhosts.py

/usr/share/doc/BlockHosts-2.4.0

/usr/share/doc/BlockHosts-2.4.0/CHANGES

/usr/share/doc/BlockHosts-2.4.0/INSTALL

/usr/share/doc/BlockHosts-2.4.0/LICENSE

/usr/share/doc/BlockHosts-2.4.0/README

/usr/share/doc/BlockHosts-2.4.0/bhrss.html

/usr/share/doc/BlockHosts-2.4.0/blockhosts.html

--- /etc/blockhosts.cfg

HOSTS_BLOCKFILE = "/etc/hosts.allow"

COUNT_THRESHOLD = 7 number of invalid attempts

AGE_THRESHOLD = 12 number of hours to block

WHITELIST list of IPs to always allow

BLACKLIST list of IPs to always block

LOGFILES – default list of logs to process (/var/log/secure)

--- /etc/hosts.allow

/etc/hosts.allow (or /etc/hosts.deny but only one not both files) - the hosts block file

Add following sections, in this order:

-- your permanent whitelist and blacklist of IP addresses (if needed)

-- blockhosts marker lines - two lines

-- execute command to kick off blockhosts.py on connects to services
Example below

# ----

ALL: 127.0.0.1 : allow

ALL: 192.168.0. : allow
# permanent blacklist addresses - these should always be DENIED access – edit as needed

ALL: 10. : deny

ALL: 192. : deny

ALL: 172. : deny

# next section is the blockhosts section - it will add/delete entries in

# between the two marker lines (#---- BlockHosts Additions)
#---- BlockHosts Additions

#---- BlockHosts Additions

# finally, the command to execute the blockhosts script, based on

# connection to particular service or services, for example, for

# sshd, proftpd, etc - if using pure-ftpd, etc, be sure to use those

# words instead - this is spread over multiple lines, so has \ at end of

# line to signal continuation:

--echo "%c-%s" --ipblock=iptables \

--whitelist="10\..*,127.0.0.1" --blacklist="192.168.1.1,192.168.1.2" \

#---
the version on zeus

sshd, proftpd, in.proftpd: ALL: spawn (/usr/bin/blockhosts.py \

--verbose --echo "%c-%s" >> /var/log/blockhosts.log 2>&1 )& : allow \

SELinux

Tripwire

chkroot

Basics

Show files rpm -ql httpd

/sbin/chkconfig httpd on

Important files / folders in httpd-2.2.6-1.fc7 and httpd-2.2.17-1.fc14.x86_64

• 
  /etc/httpd most of the config files or links to them
  
• 
  /etc/httpd/conf
  
• 
  /etc/httpd/conf.d module specific config files, see README
  

• 
  /etc/httpd/conf/httpd.conf main apache server config file
  for 'global environment', 'main or default server', & 'virtual hosts'
  

• 
  /etc/httpd/logs link to /var/log/httpd
  
• 
  /etc/httpd/modules link to /usr/lib64/httpd/modules
  
• 
  /etc/httpd/run link to /var/run
  
• 
  /etc/logrotate.d/httpd how often to rotate logs
  
• 
  /etc/rc.d/init.d/httpd startup script
  
• 
  /etc/sysconfig/httpd basic service config file for httpd startup script
  
  
  
• 
  /usr/bin/ab benchmarking tool
  
• 
  /usr/bin/htdigest manage user files for digest automation
  
• 
  /usr/bin/htpasswd manage user files for basic authentication
  
• 
  /usr/bin/logresolve resolve IP addresses to host names in log files
  
• 
  /usr/lib64/httpd/modules apache modules for added functionality
  
  
  
• 
  /usr/sbin/apachectl server control interface
  
• 
  /usr/sbin/httpd man server binary
  
• 
  /usr/sbin/rotatelogs
  
• 
  /usr/sbin/suexec switch user before executing, allows apache user not root
  
  
  
• 
  /var/www/error where error files are
  
• 
  /var/www/html main server html root
  
• 
  /var/www/icons server icons
  
  
  

• 
  system-config-httpd-1.4.3-1.fc7 and system-config-httpd-1.5.2-2.fc14.noarch
  
• 
  /usr/bin/system-config-httpd
  

ServerRoot "/etc/httpd"

PidFile run/httpd.pid

Timeout 120

KeepAlive Off

MaxKeepAliveRequests 100

KeepAliveTimeout 15

#Listen 12.34.56.78:80

Listen 80

# LoadModule foo_module modules/mod_foo.so DSO support

Include conf.d/*.conf

User apache

Group apache
### Section 2: 'Main' server configuration

ServerAdmin root@localhost

#ServerName www.example.com:80

UseCanonicalName Off

DocumentRoot "/var/www/html"

Options FollowSymLinks

AllowOverride None


# Note that from this point forward you must specifically allow

Options Indexes FollowSymLinks

AllowOverride None #controls what directives may be placed in .htaccess files

Order allow,deny

Allow from all

DirectoryIndex index.html index.html.var

AccessFileName .htaccess

ErrorLog logs/error_log

# http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzaie/rzaielogformat.htm

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

LogFormat "%h %l %u %t \"%r\" %>s %b" common

LogFormat "%h %l %u %t \"%r\" %>s %b %f %{host}i" debug
CustomLog logs/access_log debug

CustomLog logs/access_log combined

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

Alias /image /ftp/pub/image A request for http://example.com/image/foo.gif would cause the server to return the file /ftp/pub/image/foo.gif

User directories

~public/public_html

user directory (/home/durrett) must be chmod 711, but not all of its subdirectories

public_html & all of its subdirectories must be 755

UserDir enable test (you must list the users to enable)

Doing this makes it possible to find users on the system

An alternative to the above is:

create a new /var/www/html directory (mkdir DrJohn)

change ownership to the user:apache (chown durrett:apache /var/www/html/DrJohn)

add the user link to the directory (ln -s /var/www/html/DrJohn /home/durrett/DrJohn_site)

# Control access to UserDir directories. The following is an example

# for a site where these directories are restricted to read-only.

#

#

# Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec

#

# Order allow,deny

# Allow from all

#

#

# Order deny,allow

# Deny from all

#

#

#

# Use name-based virtual hosting.

NameVirtualHost *:53148

#

# NOTE: NameVirtualHost cannot be used without a port specifier

# SSL protocol.

#
#

# VirtualHost example:

# Almost any Apache directive may go into a VirtualHost container.

# The first VirtualHost section is used for requests without a known

# server name.

#

#

# DocumentRoot /www/docs/dummy-host.example.com

# ServerName dummy-host.example.com

# ErrorLog logs/dummy-host.example.com-error_log

# CustomLog logs/dummy-host.example.com-access_log common

#

(partially from Negus' Fedora Linux toolbox)

-- based on the iptables facility (www.netfilter.org)

-- lots of GUIs: sudo /usr/bin/system-config-firewall, firestarter, shorewall, fwbuilder
/etc/sysconfig/iptables -- config file (remember to BACK it UP before changing)

iptables -L -- display current iptables filter table

iptables-save -- send current iptables filter table to stdout ( > somefile to save it)

-------------------------------------------------------------------------

Other notes:

The basic structure of iptables
mangle (1) (3) mangle & filter nat

--------->Routing Decision -------> FORWARD -----POSTROUTING

| |

| filter OUTPUT

Decision

1. 
   when packet enters from network kernel looks at destination
   
2. 
   if destined for this machine packet goes to INPUT chain
   
   
   
3. 
   if not destined for this machine, if FORWARD chain exists rules in it are applied and packet is sent as specified in the rules, if FORWARD chain does not exist default policy is applied
   
   
   
4. 
   packets sent from local process are routed, then put on the OUTPUT chain
   

----------------------------------------------------------

iptables basic concepts

1. 
   different sets of rules for different chains within different tables
   
2. 
   initial tables are: NAT, FILTER, MANGLE
   
3. 
   initial chains are: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING
   
4. 
   targets to jump to are: ACCEPT, DROP, REJECT, LOG, SNAT, MASQUERADE
   
   

1. 
   Create a new chain (-N).
   
2. 
   Delete an empty chain (-X).
   
3. 
   Change the policy for a built-in chain. (-P).
   
4. 
   List the rules in a chain (-L).
   
5. 
   Flush the rules out of a chain (-F).
   
   

1. 
   Append a new rule to a chain (-A).
   
2. 
   Insert a new rule at some position in a chain (-I).
   
3. 
   Replace a rule at some position in a chain (-R).
   
4. 
   Delete a rule at some position in a chain, or the first that matches (-D).
   
   

1. 
   Each rule specifies a set of conditions the packet must meet, and what to do if it meets them (a `target')
   
2. 
   EX: wipe out (flush) all previous rules
   iptables -F
   
3. 
   EX: set default policies for INPUT chain
   iptables -P INPUT DROP
   
4. 
   EX: create a new chain in the filter table
   iptables -N okay
   
5. 
   EX: drop all ICMP packets coming from the IP address 127.0.0.1.
   iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
   
6. 
   EX: accept everything coming from the loopback address
   iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
   
7. 
   EX: accept packets for the local web server coming from the Internet (eth0)
   iptables -A INPUT -p TCP -i eth0 -s 0/0 --dport 80 -j ACCEPT
   
8. 
   EX: forward all packets addressed to a web server to gandalf
   iptables -t nat -A PREROUTING -p tcp -d $EXT_NIC --dport 80 \
   --to-destination $WEB_SVR
   
   

/sbin/iptables

/sbin/iptables-save

/etc/sysconfig/iptables-config

/etc/sysconfig/iptables -- test hint “how do I find this out?”

/etc/init.d/iptables

vi rc.firewall

WEB_SVR=”gandalf”

EXT_NIC=”eth0”

/sbin/iptables -P INPUT DROP # you are not going to get much now

...
:wq
sudo rc.firewall

/sbin/iptables -L

#an example

#!/bin/sh

# Simple masq firewall

#setup network for forwarding, dynamic ips

echo 1 > /proc/sys/net/ipv4/ip_dynaddr

DEPMOD=/sbin/depmod

MODPROBE=/sbin/modprobe
ANY=”0.0.0.0/0” # Match any IP address

CLASS_A="10.0.0.0/8" # Class-A Private (RFC-1918) Networks

CLASS_B="172.16.0.0/12" # Class-B Private (RFC-1918) Networks

CLASS_C="192.168.0.0/16" # Class-C Private (RFC-1918) Networks

EXTIF="eth0"

INTIF="eth1"

echo " External Interface: $EXTIF"

echo " Internal Interface: $INTIF"

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD

$IPTABLES -F INPUT

$IPTABLES -F OUTPUT

$IPTABLES -F -t nat

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

$IPTABLES -A FORWARD -j LOG

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

#$IPTABLES -A INPUT -i $EXTIF -d $ANY -p tcp --dport 0:1023 -j DROP

#$IPTABLES -A INPUT -i $EXTIF -d $ANY -p udp --dport 0:1023 -j DROP

# Deny TCP connection attempts

#$IPTABLES -A INPUT -i $EXTIF -p tcp --syn -j DROP
#accept packets for the local web server coming from the Internet (eth0)

$IPTABLES -A INPUT -p TCP -i $EXTIF -s 0/0 --dport 80 -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -s $ANY -p icmp --icmp-type echo-request -j DROP

http://firehol.sourceforge.net/

1. 
   Identify your network interfaces
   sudo ip link show
   

1: lo: mtu 16436 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

2: eth0: mtu 1500 qdisc noop state DOWN qlen 1000

link/ether 00:1f:c6:51:13:11 brd ff:ff:ff:ff:ff:ff

3: eth1: mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 00:1f:c6:51:13:12 brd ff:ff:ff:ff:ff:ff

2. 
   Think about what each interface should do
   Ignore lo, in the case above eth0 is not used and eth1 is everything
   Also think about what services ie servers you want.
   
   
   
3. 
   Create the FireHOL configuration structure
   In my Fedora 10 system the configuration file is /etc/firehol/firehol.conf
   and by default it says
   
   version 5
   

You should probably rename the interface if you are going to build a “real” firewall

4. 
   Now add servers and clients you wish to accept
   
   version 5
   
   
   

If you have special ports or have moved services you may define your own servers

server custom myservice proto/sports cports accept

If you want to move the ssh port to 41265 the above file becomes:

5. 
   Checking
   Run sudo /etc/rc.d/init.d/firehol debug
   And it will show you the iptables results or problems
   
   
6. 
   Pretty much done.
   You can do much more, routing tables, masquerade, NAT but this gets you started