LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-04-2013, 10:34 AM   #1
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Rep: Reputation: Disabled
Wink Laptop safe with OpenBSD.


Hallo everybody.
I,am selfemployed, my laptop is my workplace. Last 10 years i worked with Windows XP+SP3. In spite of all security mesurements - one day I lost everything. Now I decided to work with more stable and secure Linux.
Since few weeks i collect my experiences with Mint/Ubuntu/, Debian7/wheezy/
Ubuntu 12.04 Precise Pangolin and at least with OpenBSD.
What I need is clear manual or tutorial, HOWTU install and configure iptables firewall. There is a lot of stuff in network even ready to go scripts .src.
I downloaded a few of them meanwhile, but I never done it before and need support. Step after step. Script .src is ready to use, but how to implement it?
Please, whot I need is a tutorial or link with examples !!!
From the beginning to the end.

My laptop; Lenovo T60p, 4 GB RAM, CPU - IntelCoreDuo T-2600, 32-bit.
4 partitions, each with different OS.
 
Old 05-04-2013, 10:46 AM   #2
jdkaye
LQ Guru
 
Registered: Dec 2008
Location: Westgate-on-Sea, Kent, UK
Distribution: Debian Testing Amd64
Posts: 5,464

Rep: Reputation: Disabled
Is this any help?
http://www.thegeekstuff.com/2011/01/...-fundamentals/
jdk
 
Old 05-04-2013, 11:02 AM   #3
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Original Poster
Rep: Reputation: Disabled
Not especially. To understand iptables logic - it would take weeks, to implement it properly - years of experience.
I need it faster. I downloaded /one of many/ ready konfig script .src - for workstation. Now question is, whats next?
How to implement it, how to use it, how to make it - step after step. On Debian7 /for example/.
 
Old 05-04-2013, 11:34 AM   #4
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,284

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
OpenBSD does not use iptables -- it uses a different (and IMO superior) firewall called PF, which has a different configuration syntax. You can find the basic documentation here.

In order for us to provide more help, you really need to state more about what you're trying to accomplish. What services (if any) do you wish to allow? Do you wish to filter outgoing traffic as well as incoming, etc.?

A basic firewall script would simply deny all inbound traffic except that related to an outgoing connection that your system opened. Something like:

Code:
iptables -F ALL
iptables -P INPUT DENY
iptables -P OUTPUT DENY
iptables -P FORWARD DENY
iptables -A INPUT -i lo -s 127.0.0.1/8 -d 127.0.0.1/8 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j ACCEPT
Whether or not this will actually do what you want is another matter...
 
Old 05-04-2013, 11:53 AM   #5
guyonearth
Member
 
Registered: Jun 2012
Location: USA
Distribution: Ubuntu
Posts: 419

Rep: Reputation: 82
[QUOTE
I,am selfemployed, my laptop is my workplace. Last 10 years i worked with Windows XP+SP3. In spite of all security mesurements - one day I lost everything. Now I decided to work with more stable and secure Linux.[/QUOTE]

Whoa, there. I'm confused.

1. "Lost everything"?...you had no backups, given that a laptop is your main and only system?
2. Windows XP is a legacy OS, there are newer and better versions.
3. You used the same laptop for 10 years?
4. How could you "lose everything", short of a hard drive crash?
 
Old 05-04-2013, 12:32 PM   #6
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Original Poster
Rep: Reputation: Disabled
@guyonearth
I,am absolutely aware, it was my voult. I don,t wont talk about it. It was break in to my HDD. All data has gone.
But now everything what I need is much more secure laptop.There is no need to talk about konfiguration file, i got it.
There is a need to talk how to implement it an start.
NOW:
Downloaded file "firewall.src" is in katalog "Downloads"
Next to do:
----------
Next to do:
---------
Next to do:
---------
Finish.


@btmiller
How do you think, what will be easier for me to do: iptables with Debian or Ubuntu, OR Packet Filter with OpenBSD? I already downloaded iptables configuration file, with OpenBSD would be for me absolute beginning.

iptables forum ? OpenBSD forum ?

Last edited by Novi; 05-04-2013 at 12:44 PM.
 
Old 05-04-2013, 12:59 PM   #7
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Original Poster
Rep: Reputation: Disabled
@guyonearth
I,am absolutely aware, it was my voult. I don,t wont talk about it. It was break in to my HDD. All data has gone.
But now everything what I need is much more secure laptop.There is no need to talk about konfiguration file, i got it.
There is a need to talk how to implement it an start. My aim is "Stateful Packet Filtering"
NOW:
Downloaded file "firewall.src" is in katalog "Downloads"
# makra
ext_if = "xl0"
int_if = "fxp0"

tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"

comp3 = "192.168.0.3"

# opcje
set block-policy return
set loginterface $ext_if

set skip on lo0

# normalizacja datagramów
match in all scrub (no-df)

# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port 80 -> $comp3

# regułki filtra pakietów
block in

pass out keep state

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state

pass in on $ext_if inet proto tcp from any to $comp3 port 80 \
flags S/SA synproxy state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in quick on $int_if
Next to do:
----------
Next to do:
---------
Next to do:
---------
Finish.


@btmiller
How do you think, what will be easier for me to do: iptables with Debian or Ubuntu, OR Packet Filter with OpenBSD? I already downloaded iptables configuration file, with OpenBSD would be for me absolute beginning.

iptables forum ? OpenBSD forum ?

Last edited by Novi; 05-04-2013 at 01:06 PM.
 
Old 05-04-2013, 01:56 PM   #8
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,284

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
I don't think there's much of a difference between PF and iptables in terms of ease of use. You have to know something about firewalls to use either effectively.

The problem is that you still haven't answered my questions. You say that you want a more secure laptop, but you don't define specifically what you mean. Do you want to allow any external connections at all? if so, which hosts and services? The PF configuration that you downloaded is just a sample that is designed for a network gateway as opposed to a standalone machine -- it does a lot of things (e.g. reverse NAT via rdr to pass incoming port 80 [HTTP] requests to a Web server on the local network). It also allows incoming connections to port 22 (SSH) and 113 (identd). This is probably not something you want for a standalone laptop.

I hate to break it to you, but you can't just download random configurations from the Internet and expect to be able to use them without some understanding of what they're actually doing. It's not hard to gain that understanding, but you have to be willing to spend a little time reading and learning. This is true regardless of whether you use iptables or PF. For iptables, why not start with the small script I gave you in post #4 and adapt it to your needs? What I like to do to load the rules at boot is to save my iptables script somewhere (like /root/firewall.sh) and then add something to the network startup init script or rc.local to run the script at boot time. This is slightly suboptimal since there's a very brief window (a few seconds) between the time the network starts and when the firewall is brought up, but that hasn't been a huge concern in my environment. For you it might be different. Red Hat based distros used to have a command ("service iptables save" IIRC) that would save the currently loaded ruleset to a configuration file and lopad them when the network was brought up. I'm not entirely sure how Debian based boxes do it (hopefully someone more experience than I can tell you). I usually don't rely as much on host based firewalls since my work network has a fairly sophisticated network firewall with publicly accessible services off in a DMZ network, but of course for a laptop you will need to rely on the host based firewall.

Hopefully this is not too confusing. The summary is that setting up a firewall requires a little bit of knowledge and research on your part. You also need to know what you want to accomplish ... deny all incoming traffic, some incoming traffic, some outgoing traffic, etc. No one but you can decide on what you need. If you can state that clearly, we can help you craft a policy that will meet your needs.
 
Old 05-04-2013, 02:27 PM   #9
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Original Poster
Rep: Reputation: Disabled
Talking

@btmiller
I do nothing more, since a few days, as learning. The problem is im not sure if I,am not loosing my time reading absolute rubbish.
I, am not able to estimate what is good stof what is not.On this page:https://calomel.org/ is new PF script, just to use it.
I know what You think, but I,am self-made man, nobody never lerned me all details. My knowledge is unsystematic but really not small.I got idea, please ask me what You wont to know - I will answer and it will be a lesson for me.O,k?
 
Old 05-04-2013, 02:41 PM   #10
ulkoma
Member
 
Registered: Feb 2012
Distribution: CentOS
Posts: 69

Rep: Reputation: Disabled
Man I highly doubt you'll get any real help with this attitude! we dont even know what you mean by secure or about the connection betwen losing your data and your need to have a firewall!

I wish you good luck but the way I see it nobody can help you if you refuse to help yourself
 
Old 05-04-2013, 03:01 PM   #11
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Original Poster
Rep: Reputation: Disabled
@ulkoma
Everyone of you started with training or study, with teachers, books, exercises, homeworks, tests and so on.
I don,t expect so much. just a few questions to show me the proper direction - 20-30 questions.
many milions people are now in my situation, they never done it before - but they have to do it now! And what?
Dont you file it now, this subject will be not only for me but for others as well.
 
Old 05-04-2013, 03:15 PM   #12
guyonearth
Member
 
Registered: Jun 2012
Location: USA
Distribution: Ubuntu
Posts: 419

Rep: Reputation: 82
Most Linux implementations are fairly secure by default, and many already have a firewall configured (Ubuntu, OpenSuSE, etc.) Without knowing how your computer was compromised in the first place, it's hard to give advice. If you were originally compromised through an exploit that only ran on Windows, i.e. a trojan or malware, or something like that, there is no need to worry about that on a Linux system.
 
Old 05-04-2013, 03:30 PM   #13
Novi
LQ Newbie
 
Registered: May 2013
Posts: 19

Original Poster
Rep: Reputation: Disabled
@
I understand Your answer.
Closing this subject, my last question.What should I do to implement and start work this: OpenBSD v5.1 pf.conf from https://calomel.org/pf_config.html on OpenBSD? let me go ahead a few steps.

Last edited by Novi; 05-04-2013 at 03:34 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Fsck errors in the Linux filesystem on my OpenBSD laptop NOT caused by OpenBSD LXer Syndicated Linux News 1 08-31-2008 03:15 AM
LXer: I try OpenBSD 4.3 on the $0 Laptop LXer Syndicated Linux News 0 04-19-2008 02:11 AM
Openbsd question regarding Laptop mykyl *BSD 8 01-07-2008 03:47 AM
[OpenBSD] safe disk wipe out noir911 *BSD 2 03-08-2007 03:53 AM
how safe is it to assume a laptop will work? CowLoon Linux - Laptop and Netbook 10 01-07-2005 12:39 AM


All times are GMT -5. The time now is 08:17 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration