How to setup a secure network

Hi,

I'm not sure why, but I feel really paranoid about using my home computer network. I feel as if someone has gotten in, and I don't trust anything (wireless router firmware, notebook firmware, etc).

I am in the process of rebuilding my network. What order do should I build everything in? I know it sounds like a silly question, but let me elaborate.

I am going to setup a gateway with openbsd. I am going to install the OS, configure it as best as I can, but at some point I will most likely need additional software. I do not want to go onto the internet w/o having everything locked down. This leads me to a strange situation where I don't want to go onto the internet (due to fears), but I need to to grab software/documentation.

The only real solution I can think of is to download anything I need ahead of time and burn it onto a CD. I guess my real question is: what do you need to have in place in order to feel "safe" from being attacked? Is a firewall enough?

I know that there are such things as IDS, but they are only useful for reporting purposes.

You're paranoid.... No problem with that though... :D

Start at the perimeters, (wired and wireless), then work back to the workstations themselves.

IDS' are great... Snort is the best and it's free... But it's a bit overkill for a home network unless you have extremely sensitive data there.

You don't list what type of Unix you have running so it's really hard to say. Most of the times IPTables or whatever firewall you use are good but then you need to think about permissions. And of course only using root when needed. Usually sudo can do this for you so you aren't doing things.

You may want to set a variable so that rm is actually using the -i options.

Quote:

---

You may want to set a variable so that rm is actually using the -i options.

---

Gore
Ok, I know that the rm -i option prompts the user before deleting files (which is a good thing if you want to make sure you don't accidentally wipe out your system), but how does this help with system security? Sorry, if this is really obvious, but I don't know.

Everyone who's used Unix for more than an hour has wondered what "rm -rf /" does. And as you said it stops you from screwing up. A secure system isn't just firewalled, it's protected from the users themselves.

Quote:

---

Originally posted here by gore
Everyone who's used Unix for more than an hour has wondered what "rm -rf /" does. And as you said it stops you from screwing up. A secure system isn't just firewalled, it's protected from the users themselves.

---

Ok, thank you.

Yea I think the best way of thinking about that is this:

"UNIX was never designed to stop you from doing stupid things. That would also stop you from doing clever ones.

I am going to be making the gateway OpenBSD. The gateway will have no services running on it, and serve only as a router/firewall.

An internal server will host an SSH/VPN server. There will also be an internal only mail server. All other services will be turned off.

Here are the things I'm planning on doing to secure the machines:

- Setup a tight firewall (authpf on the gateway)
- Setup AIDE/integrit
- Good permissions
- chroot jail for all services

There will also be a DMZ setup for my roommate's wireless network.

What else should I do to secure this network?

What services do you need to make available to the internet?
This is the root of your security issues, if you are concerned
about someone attacking you out of the blue.

If you offer no services to the net, your only problem is the connections
that you solicit; whether you have a browser that permits websites to
screw with you; if you execute e-mail attatchments; if you run illegally
cracked software. These problems can't be cured by a firewall, because
you will wind up config'ing it to allow the insecure things you insist on doing.
If you avoid the promiscuous behavior, the "protection" is redundant,
like a condom is only needed with an unclean partner.
:cool:

That's a very good point. Now that I think that it, your comment makes a lot of sense. If I don't have any services running, the only issues I can run across are those that I bring in.

For some strange reason, I always think that being compromised is "magic," but it clearly isn't now that I try to think of examples of how someone could get in.

Wireless adds a wrinkle. I've seen DMZ's that weren't worth a plugged nickel (belkin routers), but you should be ok with OpenBSD. I'd test the DMZ anyway from your roommate's wireless network to see if you can get back in on the rest of your network.

Port monitoring programs like Active Ports and TCP View (or for that matter, F-Port and Netstat) will tell you where your Windows machines are connecting if need be. I run Ettercap and Etherape from a linux unit to get a quick fix on any rogue IP's that may be camping out on my networks. And I run
Ethereal every now and then on my webserver (W2K) to see what's happening there. Snort's built-in to my FTP server (RH7) and it picks some things up, but I'm not as up on it as I'd like to be.

Either way, the best network defense you will have going for you is paying attention. Know all the devices on your network and their ip addresses. You're in for a learning experience.

Just my two bits.

Outside of defining what exactly you want your security level is going to be (what gets on the internet, what's denied explicitly, etc), I'd recommend not having your roomie's laptop as a DMZ. It's very much akin to having a firewall and just allowing any program to talk to the internet. By not having a DMZ (and in my opinion, there's really no reason good enough to have a machine outside the protection of your router/gateway), you can reduce the amount of security you'd have to layer on said wireless laptop. And it keeps prying eyes out on a lot of levels.

My network consists of the following:

My PC connected to the router via cat-5, static IP.
My server connected to the router via cat-5, static IP.
Fiance's laptop connected to the router, static IP wireless with WPA + password.

Router is a DLink Gaming router + wireless with everything turned off and MAC filtering enabled. Port forwaring exists only for the server utilities which are restricted to ports 80, 15234, and 22. All FTP is done over SFTP on port 22. Server has services like telnet turned off.

Keeping the laptop out of the network is beneficial for two reasons. One is that my roommate is always using Limewire to download music and other software. He doesn't believe that anything will happen to his system, despite my advice. As such, keeping him out of the DMZ is actually protecting my network.

My second reason is that I don't trust the wireless router. What if someone gets to the router (via port 80 for instance, which allows you to change its settings), or if one of my neighbors is able to crack the wireless password. This is also another mechanism for protecting my network.