Printable View
Hey, I'm currently setting up an apache server on Linux SuSE 8.1 Pro. and I'm using the Firewall that came with the OS (SuSE Firewall 2) but I was wondering is this a bad firewall or are there better ones out there.
I know that a firewall is only as good as the rules for it are set. However help is needed.
Thanks in advance!
You answered your own question by saying "the firewall is only as good as the rules for it are set" i see it as coke or pepsi ,sprite or 7-up, ipfw or ipfilter , .......
I agree. The rules you set for it make it good. The SuSE firewall is a good one and when you set it up it does do good. Basically just set up your rules to work how you want and you should be fine :)
SuSE OWNS.
Nah, come on everyone, for linux iptables is the best firewall :D. (or ipchains if you haven't reset your linux box to upgrade for a few years)
Google for iptables if you need more information on setting up and configuring.
Have to agree with The3ntropy, iptables is the best around.
A firewall is a firewall regardless of who makes it or what it is. The defining points that make it a bad, good, or the best firewall are few. They include the user. This is the main point. I could take iptables (since The3ntropy feels it is the best) and I could take Outpost for Windows.. I could spend hours setting up Outpost and then add one rule to iptables that says allow all. I think it'd be obviously there which firewall is better. At the same time the customization plays a big part. Does your firewall let you customize things as much as you like. Visnetic Firewall from Deerfield.com would be a good example of this. IMHO they have built a great PC firewall but they have one BIG flaw. If you are a DSL user you need PPPoE enabled, however they have this blocked in a category they refer to as "Other Protocols". I can't enable just PPPoE.. I have to enable all of their "Other Protocols", this doesn't exactly allow for the customization I want. If you are a competent user and your firewall is fully customizable then you can't define bad, good or best.
As a side note SuSE Firewall2 is simply a script. It uses iptables to do it's actual firewalling.
The whole garbage about something being only as good as it is configured is really a BS answer. Different firewalls, like different operating systems offer different architectures and functionalities and levels of assurance.
If you are looking for a firewall that can verify the actual content of the data iptables is utterly worthless as it lacks this functionality. Just like Zone Alarm can prevent specific programs from sending connections and IPF cannot, IPF can hold state on UDP packets and Zone Alarm cannot. These are all different questions of functionality. After this comes level of assurances, for examples of assurance criteria, checkout the following ISO-15408 evaluations
http://www.radium.ncsc.mil/tpep/epl/cc_st.html
How does all of this relate to you SirDirge? Since it doesn't sound like you are segregating network traffic is you only wish to protect a single server (if this is the case) I do not think that a packet filtering type firewall would work well for you as you should close all the ports you don't want open rather than filtering them. A filtering firewall will not protect the services that you are allowing either. In this type of situation, though I am not sure your skill level, the FireWall Tool Kit (http://www.fwtk.org/ )is very good as it can actually protect the services that you are allowing everyone access to. Other commercial solutions are better of course, but FWTK is free. (it also has modules to handle port filtering as well if you decide you need it.)
catch
A dedicated oBSD box with authPF and packet filtering is nice and cozy.
Thanks to you all. Your help was much apreciated.
get started on with IPTABLEs here http://www.netfilter.org/documentati...-tutorial.html
http://www.sns.ias.edu/~jns/security/iptables/
You're pretty much covered with these post, I would just add one thing. Put the firewall and the apache server on seperate boxes if you have the budget. That way your firewall doesn't have programs (vulnerabilities) running that aren't necessary to firewall operations. It doesn't take much CPU firepower for a little ipfilter (etc) box. No Gnome, no xwidows just a firewall.
I don't have enough money for a separate firewall box. But I run the server with no GUI and I make sure that I never leave root logged on for to long. So hopefully the chances of being successfully hacked are pretty slim.
I asked this same question a while back, and the AO community came to the same conclusion with some useful info and links.
Go here http://www.antionline.com/showthread...803#post610803
Catch's response led me to a couple of questions that maybe someone could answer.
Since most programs (including servers) only listen on certain ports that you can specify in the config file, could one not just set the default at deny all incoming and outgoing, except for the port the program is using? This should have basically the same effect, and since a server should not have a bunch of programs needing open ports to the outside, not many would need to be opened.Quote:
Just like Zone Alarm can prevent specific programs from sending connections and IPF cannot...
I thought a "closed" was any port not accepting connections, and a "stealth" port was just one set to drop requests rather than deny them. Wouldn't the above situation I described fit this situation?Quote:
you should close all the ports you don't want open rather than filtering them
Pretty much any program can listen on or connect to whatever port you tell them to, so this method does not work. besides, maybe you want to allow your web browser to connect to port 80, but you don't want trojan_giving_system_informtion_to_a_website.exe to connect to port 80.Quote:
Since most programs (including servers) only listen on certain ports that you can specify in the config file, could one not just set the default at deny all incoming and outgoing, except for the port the program is using? This should have basically the same effect, and since a server should not have a bunch of programs needing open ports to the outside, not many would need to be opened.
Stealthing under many situations can actually give back _more_ information than just having the port closed, especially on server system. Stealthing is just another farce from the Steve Gibson camp. If you have a system that is listening on port 80 and stealthing everything else, the attacker obviously knows that a system exists there, and using timing attacks a sophistocated attack can even determine the type of firewall you are running as stealthing adds more latency than having the port just not being open. This latency may be calculated be using a carefully constructed request to any open services. Once this is accomplished, the attacker can make a good guess about the firewall based on this data.Quote:
I thought a "closed" was any port not accepting connections, and a "stealth" port was just one set to drop requests rather than deny them. Wouldn't the above situation I described fit this situation?
catch
I had no idea that stealthing could lead to the attacker identifying the firewall you employ, thanks. However, the whole point of a trojan is that once it is in your system, it can disable and then evade the firewall, right? I agree that firewalls have different features and the owner/admin should be aware of this, but I still believe that in most cases its configuration is much more important than it missing a feature or two.
It depends on the trojan and on the firewall and the firewall location. Configuration is where assurances come in. Assurances include things like configuration documentation, what good is the most functional firewall if you can't determine what the correct configurations are? other firewall systems will actually inform you of what type of risks are involved with the current configuration, etc, etc.Quote:
Originally posted here by KeyserSoze
I had no idea that stealthing could lead to the attacker identifying the firewall you employ, thanks. However, the whole point of a trojan is that once it is in your system, it can disable and then evade the firewall, right? I agree that firewalls have different features and the owner/admin should be aware of this, but I still believe that in most cases its configuration is much more important than it missing a feature or two.
When selecting a system or subsystem it is always important to consider capabilities and assurances, don't worry about configuration. With sufficient assurances the configuration will be correct, and with insufficient capabilities, it doesn't matter how well you have it configured, it still won't do what you want. The "a system is only as secure as the admin" argument is made by people who lack sufficient understanding of the systems in question to put forth any tangible points. This argument is most notable when dealing with operating systems.
Also, consider this argument with cars, a car is only as good as its driver. Well, is this correct? Is a better driver going to allow a porsche 911 to seat 12 comfortably? Of course not. Is a good driver going to enable a city bus to do 0-60 in under 4 seconds? Again of course not. Here too assurances come into play as well, with many top end performance cars, driving school is included in the purchase of the car, kinda like good documentation/training that is included with high assurance computer systems. :)
catch
iptables is pretty good or else u wanna code a custome one!
probably suse comes with it!(mean iptables)