Re: One for the Security Guru's

[Stephen Satchell <list@fluent2.pyramid.net>]

At 02:28 PM 10/25/02 +0200, Daniel Egger wrote:
>Don't laugh; I had such a box reinstalled from ground just the day
>before yesterday because I found a RedHat full Install on it. Not to
>mention that there're "admins" out there who use GNOME as root on a
>fairly busy mailserver <shudder>...

I'm not laughing, I inherited a firewall box that had a full install of Red 
Hat 7.1, complete with GUI.  I got the network information, loaded up 7.3 
with minimal installation, and cleaned up that "minimal install" by using 
"rpm -qa" (it's your friend) to identify and rid the system of every single 
package not necessary to the operation of a firewall.

GCC.  PERL.  Sendmail (!). The eight different version of FTP.  (I may be 
exaggerating, but the stream of packages that offer FTP client and server 
services seems to be endless.)  Things that a root kit would find extremely 
useful to install back doors and other nasties.  Debuggers.  Those were 
just the extra packages -- I also scanned for unnecessary SUID binaries 
when I was finished and blasted them to the ol' game grid.

I then used IPTABLES to implement the security policy of the client, and 
part of that policy was that the only packets that were allowed to talk 
directly  to the firewall was SSH, and only from my range of IP addresses, 
and ping from anywhere...and I rate-limited the ping to 10 per second so 
that a ping flood would not hose the return channel.

Incoming SYN requests to the firewall (except for SSH directed to the 
firewall) are alway dropped silently, and the vast majority of UDP packets 
also find their way to the bit bucket.  Oddball TCP attacks (the log showed 
a LAMP-TEST packet attack last week) are also given the heave-ho.  I have 
NAT in the outgoing direction, and only those ports necessary to the 
operation of the client are open.  That means no ICQ, at all, for 
example.  No streaming audio.  And, as you can guess, no outbound 
connections are accessible to the likes of BackOrfice.

I'm sure there is a hole somewhere in that firewall box, but I have plugged 
all the ones I found documented on CERT.

Oh, and a low-volume Web server was moved off the firewall and onto a 
separate box, with the firewall forwarding packet traffic via IPTABLES rules.