Securing Slackware

Hey everyone,

Besides doing a paper on Slackware Linux VS Free BSD I also run two Slackware machines here at home, and well, besides wanting to have a cool discussion for the front page, I'd like too see how others do it at well.

So, how do YOU Secure your Slackware boxes?

I am still searching for a good firewall / front end to IPTables, which I've yet to find. Anything I find seems to want X loaded. Well I don't.

I don't always use X on my Slackware machines, and firestarter, shoewall, and most others either want KDE or GNOMe loaded to work. Firestarter I've used and found it easy to set up, but having to have GNOME loaded the whole time is just annoying. When you switch to Runlevel 3, it dies. And won't run in it.

So what is a good firewall you've found that works without X? I'd like to find something like the application Firestarter that will continue to run when I take down X.

I've just found something called GShield, which I'm looking at right now, and hoping it's actually good. There seems to be a real bad low amount of firewalls made for Slackware, and most of them are crap.

SUSEFirewall2 remains the best firewall I've seen for Linux, even though it is just a front end for IPTables, but at least it stays up when you shut X down.

Currently, I use Swaret, which before that I just used wget for my patches, and other than that I have nothing really in place but a hardware firewall. The only problem is, if I pop the box in my DMZ, poof, unprotected as hell.

I have been looking for a GOOD paper on IPTables, but the ones I find are very boring, very long, and not very informative. I've never used IPTables directly, and even though I'd like to, I haven't got the time right now to actually sit down and learn them.

This is a side effect of me working two jobs, going to college full time, and in the one day a week I get off, I have to do homework, and do things here at home, so I haven't had much time. Which is why I'd like to get a decent front end for IPtables so I can allow, say, SSH, Apache, and FTP through, and when I'm not using those, have all ports closed.

I've been trying to talk Pat into making a firewall for Slackware, but I haven't gotten a reply. Maybe SUSE will make a port of SUSE Firewall2 too Slackware. I have yet to find anything better. It has an easy to use interface, but also has a lot of advanced stuff to set by hand as well.

So has anyone here found something decent? What firewall do you use for Slackware?

Ig I could pick to change something in Slackware, I'd take out ProFTPd, and replace it with PureFTPd, I'd put a Firewall like "slackwarewall", something like that in it, and I'd make Postfix the default over Sendmail.

Heh, maybe one day I'll finally get good at C or ASM and make a tool for Linux called "SWAT" which I could say means "SlackWare Admin Tool". Damn I'm good with marketing lol.

Anyway, Please, don't reply saying you have some Windows firewall you like, I want this to be a good clean thread with some humor, and a lot of information. If you find something or use something really good, and you want me too, I'll add you to my paper and give you credit for finding it. I'm obviously going to talk about anything I find that I like, and if you want I'll add you in there.


A few minutes ago I found a bit in one of my books how to get IPtables going very easy, but of course it didn't work.

iptables -A INPUT -i eth0 -s 0/0 -d MyPrivateIPForSlackwarebox -p tcp \ --dport telnet -j DROP



I tried that but it says that the --dport is not valid. So like, does anyone know what is valid? I've looked at that command and it seems too me that a good guess is dport would be destination port, -i is interface, -p would be port, and -d would be destination. I'm only guessing here though.

http://www.justlinux.com/nhf/Securit...es_Basics.html
This is the tut I used to get the hang of IPtables before I went to harder stuff.

I am a slapt-get fan, I haven't used swaret yet.


Let's see some replies, Antionline Security Forum. This is a thread I have my eye on.

More important then a firewall are the services..
Remove (#) as much as you can from /etc/inetd.conf
Don't forget to /etc/rc.d/rc.inetd restart

I tend to like DIY firewalls..
A minimalistic NAT firewall like this

Code:

---

#!/bin/bash
# Minimal NAT rules

echo -n "Iptables "
  iptables --flush
  iptables --table nat --flush
  iptables --delete-chain
  iptables --table nat --delete-chain
echo "flushed"

echo -n "Iptables "
  iptables --table nat --append POSTROUTING --out-interface ppp0 -j MASQUERADE
  iptables --append FORWARD --in-interface eth1 -j ACCEPT
echo "nat"

---

Another version I like is the one from adsl4linux (dutch).

The firewall comes in an iptables and ipchains version and can be found here..
http://cvs.sourceforge.net/viewcvs.p...nux/templates/

You'll propably want the iptables version (unless you are running a 2.2 kernel)..
Download both firewall.iptables and firewall.iptables.conf

Copy the firewall.iptables.conf to /etc/
Copy the firewall.iptables to /usr/local/sbin/
And make it executable.. chmod +x /usr/local/sbin/firewall.iptables

The .conf file has loads of info and help.. And isn't in dutch ;)

Quote:

---

Heh, maybe one day I'll finally get good at C or ASM and make a tool for Linux called "SWAT" which I could say means "SlackWare Admin Tool". Damn I'm good with marketing lol.

---

Gore - Not that good - few have beaten you too it: SWAT - Special Weapons And Tactics, Samba Web Administration Tool .... been done to death ... back to the drawing board .....

gShield is good, I run that on Slack and Gentoo .... until I put life back into a little old computer and made it a dedicated firewall and shoved Smoothwall on it .... made life really simple with web interfaces for everything that needs doing.... a firewall that comes with Snort IDS, Squid Proxy Server, VPN, comprehensive log reports blah blah.... very easy to administer from a browser - and after a few easy mods (have to get dirty on the commandline here) its even running Dansguardian content filtering with clamv virus detection to stop the web nasties from getting in.

Along with a "mod" called Guardian - port scan my IP > Snort detects the odd behaviour > Guardian mod jumps into action > slam dunk !! your IP is on the banned/blocked list .... automagically - love it....

Smoothwall is worth looking at if you have an old box lying around and can afford to run a dedicated firewall.

But getting away from this sales pitch for Smoothwall - Bastille offered commandline "set up" for hardening a box, never did have any joy getting it running on Slack but didn't try that hard either once gShield was on.

Thymus' Securing Slackware Guide. Granted it's 8.1 but should cover most of the important areas.

Quote:

---

Originally posted here by gore
iptables -A INPUT -i eth0 -s 0/0 -d MyPrivateIPForSlackwarebox -p tcp \ --dport telnet -j DROP

---

Tried this?

iptables -A INPUT -i eth0 -s 0/0 -d MyPrivateIPForSlackwarebox -p tcp --dport 22 -j DROP

Steve

Oh, and -p is protocol

Quote:

---

Originally posted here by gore


I don't always use X on my Slackware machines, and firestarter, shoewall, and most others either want KDE or GNOMe loaded to work.

---

Are you referring to shorewall? Just curious, cause I didn't think it needed any desktop environment, unless you are using webmin to configure it. Only thing I believe I needed to do to get it running on Slack was grab the iproute utility (I had used a default install). I currently use it on both my slack boxes, and it has never complained when I'm in the console only.

Quote:

---

Besides doing a paper on Slackware Linux VS Free BSD {..}

---

I can only tell you how to secure FreeBSD ;)

My favorite *nix tool for firewalls is by far Firewall Builder 2.0. The latest revision of this great tool has been completely rewritten to use QT 3 for the gui API replacing GTK. This tool allows you to organize interfaces,networks,rules,policies and more into objects and templates which can easily be reused to create new firewalls or modify existing ones with ease. Firewall builder then creates the ruleset for the platform you require and supports all my favorites. (iptables,ipchains,ipfilter,pf,pix,and even custom linksys firmware!) FWB even checks all your rules for rule shadowing and other configuration errors and will then produce a script to install the new firewall and will connect via SSH to the target machine (which of course does not require X) and install the new firewall for you. This is easily the most kick ass firewall tool I am aware of and I reccomend anyone who is involved in building or maintaining firewalls (or anyone who would like to learn, the scripts provide an excellent way to study the diffrent rulesets) check this tool out. It is of course a sourceforge project. :)

http://www.fwbuilder.org/

Wow, this got more replies than I thought it would, heh. I'll check out everything here and see if there is something that stands out.

Heh, I can use IPFW with Free BSD but the Linux based one doesn't want to work. (IPFW was what made IPTables if my reading is correct). Thank you all, very good information here, and most likely when I start doing Firewalls for Slackware in my paper I'll point a link to this so you all get some credit for helping me out.

I've wanted to get a 486 and set it up as a firewall,. but I don't have a 486 yet. I'm thinking I'd use Slackware for that with an upgraded Kernel, because The Linux Kernel was the first Kernel to have a fully RFC Complient TCP stack. So I'd use that.

Thanks again guys, you certainly have given me quite a bit of reading to do.

I'm trying to talk my college into letting me have a copy of Sun Screen. I need the experience. Heh.

Quote:

---

Originally posted here by steve.milner
Tried this?

iptables -A INPUT -i eth0 -s 0/0 -d MyPrivateIPForSlackwarebox -p tcp --dport 22 -j DROP

Steve

Oh, and -p is protocol

---

"Bad argument --dport"

I just looked at the iptables help file and --dport isn't even an option it says. Does someone know if --dport has a new syntax? Or what? I'm looking here and there is nothing for --dport and I'm not sure what to switch it with.

Quote:

---

"Bad argument --dport"

I just looked at the iptables help file and --dport isn't even an option it says. Does someone know if --dport has a new syntax? Or what? I'm looking here and there is nothing for --dport and I'm not sure what to switch it with.

---

Code:

---

Source: Manpage IPTables
--destination-port [!] [port[:port]]
    Destination port or port range specification. The flag --dport is an alias for this option.

---

What version are you using?

Quote:

---

Originally posted here by gore
So, how do YOU Secure your Slackware boxes?

---

Very well thanks. :)
Seriously, it depends on the role of the box. Security's a rather complicated thing, and happens in layers. You can't say "these X instructions will work for all slack installs", since an application or service may have its own security documentation. A good example of this is Apache. I generally always apply the methods found in: InFocus: Securing Apache when doing apache installs, so they are a complement to securing your Slackware installation -- if it's a webserver.

It also varies greatly depending on the environment. Assuming someone does break into your system, if it is one in a series of machines you can get away with certain things, espsecially on servers, such as removing a compiler.

Quote:

---

I am still searching for a good firewall / front end to IPTables, which I've yet to find. Anything I find seems to want X loaded. Well I don't.

---

Use Vim. :)

Quote:

---

I've just found something called GShield, which I'm looking at right now, and hoping it's actually good. There seems to be a real bad low amount of firewalls made for Slackware, and most of them are crap.

---

Umm, linux is linux, so provided you can get the rules output as text it will work on any distribution.

Quote:

---

Ig I could pick to change something in Slackware, I'd take out ProFTPd, and replace it with PureFTPd, I'd put a Firewall like "slackwarewall", something like that in it, and I'd make Postfix the default over Sendmail.

---

Why when ProFTPd is better? ;) There's nothing about slack that MAKES you use one package over another. You can even customize the ISO to your liking. That's what I do here, I prefer VIm to ElVIs, so I don't even burn ISOs with ElVIs, and I have the VIm package contain a symlink to /usr/bin/vi. That is but one example. In both my opinion and my experiences, Slackware has proven to be the BEST distribution for customizing it to your liking. The simplicity of tarballs rules when trying to customize everything.

Quote:

---

Heh, maybe one day I'll finally get good at C or ASM and make a tool for Linux called "SWAT" which I could say means "SlackWare Admin Tool". Damn I'm good with marketing lol.

---

SWAT already exists, it stands for Samba Web Administration Tool.

Quote:

---

A few minutes ago I found a bit in one of my books how to get IPtables going very easy, but of course it didn't work.

iptables -A INPUT -i eth0 -s 0/0 -d MyPrivateIPForSlackwarebox -p tcp \ --dport telnet -j DROP

---

First off, -s 0/0 is assumed, so you don't need that. Secondly, you should NEVER have a rule like this in your rules. You should always default to DROP/REJECT, and only ACCEPT what you need to.
This is kind of beyond the scope of securing Slackware, as it applies to generally all firewall policies, and specifically to netfilter, which is available in linux in all kernels above 2.4.0 (IIRC).
Also, that rule works as of Slackware 9.0 (to my recollection), and guaranteedly so on 10.0:

Code:

---

$ iptables -A INPUT -i eth0 -s 0/0 -d 10.0.0.100 -p tcp --dport telnet -j DROP
$ iptables --list -n
Chain INPUT (policy ACCEPT)
target    prot opt source              destination
DROP      tcp  --  0.0.0.0/0            10.0.0.100        tcp dpt:23

Chain FORWARD (policy ACCEPT)
target    prot opt source              destination

Chain OUTPUT (policy ACCEPT)
target    prot opt source              destination

---

Gore: We've been satisfied with fwbuilder for iptables. It's got it's bugs but it does the trick..

As chsh said, security is a layered process. Or rather it should be. Most of the time it is not. Securing a slackware box is not any different that securing any other nix distro, it's a bitch and is time consuming. Not because it is nessesarly difficult, rather the methods inforced, the deployment of the security if you will. Before any IPtables are made, before kernels are updated. I say this because as I'm sure you all know, one of the first things you are looking to determine is what kind of services you will be running, what kind of risk are you looking at from running these services? Will there be any other users? How many if so? Who might try to take advantage of the situation? How about physical security? What if I have all of my software updated and configured properly then what? Most after asking themselves this question, IMO, would even if in a subconsious form belive that there work was done. They would put off updates and tweaks for months afterwards. By the time they get around to doing any more security focused work they find out that there system has been compromised.
So I believe that securing you slack box, or any one for that matter, the first question you should be asking is not where do I find the latest and greatest firewall or what configuration should my inetd have. Rather I think you should ask yourself; Do I have all my ducks lined in a row? In other words, am I ready to devout time to the security of my slack box? Sounds cheesy, gay whatever, but seriously, why would you just throw a firewall (which I think too many people use as a blanket rather than an additional line of security) on your system and think your good to go? You better have some time and patinence if you are seriously interested in locking down any box and keeping it locked down.

P.S.
For those of you who still didn't catch my drift on why securing any nix box is a bitch I will state it more clearly: Your work is never done.

Quote:

---

For those of you who still didn't catch my drift on why securing any nix box is a bitch I will state it more clearly: Your work is never done.

---

That's true of any security system, device or OS.

Quote:

---

Originally posted here by hatebreed2000
You better have some time and patinence if you are seriously interested in locking down any box and keeping it locked down.

---

I know. :P :D

BTW Ms.M I didn't want to start a whole new thread just for this and you aren't on IRC much, since you are a teacher I figured you might know some popular books among the proffessor types on Soloris and Oracle. I am trying to get a head start for next semester.

Quote:

---

.. since you are a teacher I figured you might know some popular books among the proffessor types on Soloris and Oracle.

---

Man. Been a while since I've used Oracle. Last one I used was 8. I did find, however, that many of the Oracle Press books to be decent. If you take an officially sanctioned Oracle course, you'll probably get their little spiral bound courseware which is to the point and little fluff (never seen those in stores).

Solaris was a pick up as I use it (sorta like my FreeBSD). Last version I used was 7 or 8. I haven't checked out the newer versions because I don't have a machine to run it (I was hoping to acquire a Sparc but haven't lucked out yet). Solaris Administration wasn't bad for 7 but not sure how it does for 9. A Practical Guide to Solaris was really good (but hasn't been updated unfortunately -- it looks like Sobell has switched to Linux). But the one book that I've found to be a sort of "be-all-end-all" kind of book is what's referred to as the "Purple Book": UNIX System Administration Handbook. Covers quite a few major Unixes and again, it may be dated somewhat. Perhaps a gander through the bookstore and see what's out there in regards to Solaris material (and don't rule out Sun published books)

Solaris Central might be a good place to start online besides Sun's website. :)

HTH

Awesome, thank you.

I wanted to do an update, I got what I needed today. A day off sort of, and my order from http://store.slackware.com came in today. I now have the Complete Linux reference, and the Slackware Essentials book. So I'll just read through these :)

I have a leet as hell Slackware TShirt and Pin now too. And Slackware 10 in a 4 CD set. I downloaded it when it came out but I want to support Slackware by buying it when I can.