Firewall security question

Tyir · 02-03-2004, 10:35 AM

I installed the gui frontent guarddog to set up an rc.firewall script using iptables. It seems to work, as i checked a few scurity website to see if my ports were blacked, and they all seemed to be. But I have a couple questions..

If there a way i can see a log of what is hitting my firewall?
Also, a log of all activity tryign to connect to my box? (ALthough I guess that is the same)

I've also read that sendmail is insecure, but, I'm not 100% what it is, so i need it only if I'm running a mail server, or is it the front-end for my email client (sylpheed)?

Finally, I was thinking it would be nice if i was about to ssh into my box. Is that a good idea for a home box, or is it insecure? And if it is an ok idea, can you link me to instructions on how to set it up? Thanks

Nis · 02-03-2004, 11:28 AM

I'm not sure how guarddog works, I use Firestarter, but check its options to see if you can set logging to some place. I'm pretty sure you don't need sendmail; if you use an SMTP server to send your mail you definitely don't. And as for ssh I would have to say it's pretty secure. Everything sent through ssh is encrypted. Setting up is easy: make sure /etc/rc.d/rc.sshd is executable and when you boot the ssh daemon will be started.

synaptical · 02-03-2004, 12:15 PM

here are a few ssh sites, it's basically very easy. as Nis noted, ssh encrypts the data it sends, so if you are doing remote logins you really should use it instead of telnet, rlogin, etc.

http://www.suso.org/linux/tutorials/ssh.phtml
http://www.siliconvalleyccie.com/lin...m#_Toc52211944
http://www.rz.uni-karlsruhe.de/~ig25/ssh-faq/

chort · 02-03-2004, 12:43 PM

Sendmail is insecure because it is monlithic and runs as root. Most Linux distros come with Sendmail installed by default and usually also running. Check you rc.d scripts to see whether Sendmail is being started. Also, the quickest way to tell is usually to telnet to your own IP on port 25, ex:
$ telnet localhost 25
or
$ telnet a.b.c.d 25
(where a.b.c.d is your IP address).

If you get a banner that looks like this:
220 hostname.domainname ESMTP Sendmail 8.12.8/8.12.8; Tue, 3 Feb 2004 10:40:31 -0800
then you're running Sendmail.

If it looks something liks this:
220 hostname.domainname ESMTP Postfix
then you're running Postfix, which is the common replacement for Sendmail (Postfix often uses the name "sendmail" for it's binary file, but that is just so it will act as a seamless replacement for Sendmail).

jazernorth · 02-03-2004, 12:49 PM

I am not sure on your application, but in the rc.firewall script you will need 'LOG --log-level info' after each Drop or Reject. You can put it after any IPTABLES command, but your log file will get extremely large.

Your log will be in 'var/log/'. Usually named something like 'security' or 'firewall'.

Enjoy.

JN

Tyir · 02-05-2004, 10:23 PM

Ok, i couple follow ups, I'm a litte confused :|

So i checked guarddog, and all the logging options are checked.
But in /var/log, there doesn't seem to be anything for the firewall...

Code:

23:18:33-/var/log:ls
XFree86.0.log      maillog.2                samba.192.168.1.102.old  secure.2
XFree86.0.log.old  maillog.3                samba.192.168.1.103      secure.3
acpid              maillog.4                samba.192.168.1.104      secure.4
apache/            messages                 samba.192.168.1.104.old  setup/
cron               messages.1               samba.192.168.1.105      spooler
cron.1             messages.2               samba.192.168.1.105.old  spooler.1
cron.2             messages.3               samba.bessie             spooler.2
cron.3             messages.4               samba.bessie.old         spooler.3
cron.4             nfsd/                    samba.clarabelle         spooler.4
cups/              nvidia-installer.log     samba.clarabelle.old     swaret
debug              packages/                samba.marilyncomp        syslog
debug.1            proftpd.log              samba.marilyncomp.old    syslog.1
debug.2            removed_packages/        samba.mofette            syslog.2
debug.3            removed_scripts/         samba.nmbd               syslog.3
debug.4            samba/                   samba.nmbd.old           syslog.4
faillog            samba.127.0.0.1          samba.smbd               uucp/
gdm/               samba.192.168.1.100      samba.winbindd           wtmp
iptraf/            samba.192.168.1.100.old  scripts/                 wtmp.1
lastlog            samba.192.168.1.101      scrollkeeper.log         xferlog
maillog            samba.192.168.1.101.old  secure
maillog.1          samba.192.168.1.102      secure.

The iptraf folder was empty, and the secure files were just logs of when i su'ed.

So i couldn't find it anywhere....
The rc.ssh script IS in my rc.d folder, and when my comp boots, it says it loads, i havn't had a chance to test it yet..

Finally, in my email client, it looks like it doesn't use sendmail, so would it be a good idea to make ti not start at boot (would the best way be removing the permission for the rc.sendmail script?)

Thanks

chort · 02-05-2004, 10:42 PM

Did you try /var/log/messages or /var/log/debug? Since iptables is a kernel module it might be logging to /var/log/messages by default.

Depending on how your rc scripts work, you can do chkconfig -del sendmail, if you have an /etc/rc.conf you change sendmail=YES to sendmail=NO, or you can just move rc.sendmail to .rc.sendmail (notice the leading period '.').

Tyir · 02-05-2004, 10:57 PM

nope, it is in neither.... messages is information from the boot and printer stuff, no net stuff at all really

debug is filled with this, over & over...

Code:

 dhcpcd[161]: dhcpIPaddrLeaseTime=86400 in DHCP server response. 
Feb  2 08:58:52 MOFETTE dhcpcd[161]: dhcpT1value is missing in DHCP server response. Assuming 43200 sec 
Feb  2 08:58:52 MOFETTE dhcpcd[161]: dhcpT2value is missing in DHCP server response. Assuming 75600 sec

and that is about it....

witeshark · 02-06-2004, 10:31 PM

Well it's worth a whirl. How about var/log ipfw.log? That's how it looks in Mac/Console.

Tyir · 02-06-2004, 11:40 PM

Noe, check above, there is no file called that! :O:O
this si REALLY pissing me off, its got to be somewhere, right?

Its a regualr slack 9.1 install, with guarddog
I checked guarddog's docs, but it had nothing,...

EDIT:
I read through my rc.firewall script, and this is what i'm guessing is the most relevent portion:

Code:

# Set up our logging and packet 'executing' chains
iptables -N logdrop2
iptables -A logdrop2 -j LOG --log-prefix "DROPPED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence
iptables -A logdrop2 -j DROP 
iptables -N logdrop
iptables -A logdrop -m limit --limit 1/second --limit-burst 10 -j logdrop2
iptables -A logdrop -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4
iptables -A logdrop -j DROP
iptables -N logreject2
iptables -A logreject2 -j LOG --log-prefix "REJECTED " --log-level 4 --log-ip-options --log-tcp-options --log-tcp-sequence
iptables -A logreject2 -p tcp -j REJECT --reject-with tcp-reset
iptables -A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject2 -j DROP   
iptables -N logreject
iptables -A logreject -m limit --limit 1/second --limit-burst 10 -j logreject2
iptables -A logreject -m limit --limit 2/minute --limit-burst 1 -j LOG --log-prefix "LIMITED " --log-level 4
iptables -A logreject -p tcp -j REJECT --reject-with tcp-reset  
iptables -A logreject -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A logreject -j DROP

I hope that helps

witeshark · 02-06-2004, 11:55 PM

Sorry. Being an Apple dude all I can do is try.Google it?

chort · 02-07-2004, 12:59 AM

Hmm, what's your /etc/syslog.conf look like? It seems like guarddog is using a syslog facility that you are not logging.

rmanocha · 02-07-2004, 12:43 PM

Quote:

Originally posted by Nis
I'm not sure how guarddog works, I use Firestarter, but check its options to see if you can set logging to some place. I'm pretty sure you don't need sendmail; if you use an SMTP server to send your mail you definitely don't. And as for ssh I would have to say it's pretty secure. Everything sent through ssh is encrypted. Setting up is easy: make sure /etc/rc.d/rc.sshd is executable and when you boot the ssh daemon will be started.

i use firestarter too...just wondering how do you log traffic if you close down the window firestarter pops open?
also i am behind a router and whenever i am on the command line(no X running)...i keep getting the output off the UDP packets transferred from my router to my machine...is there any way to turn that off?
Thanks

Tyir · 02-07-2004, 07:21 PM

Hm... here is my /etc/syslog.conf

Code:

# Uncomment this to see kernel messages on the console.
#kern.*                                                 /dev/console

# Log anything 'info' or higher, but lower than 'warn'.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
*.info;*.!warn;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/messages

# Log anything 'warn' or higher.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
*.warn;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

# Debugging information is logged here.
*.=debug                                                -/var/log/debug

# Private authentication message logging:
authpriv.*                                              -/var/log/secure

# Cron related logs:
cron.*                                                  -/var/log/cron

# Mail related logs:
mail.*                                                  -/var/log/maillog

# Emergency level messages go to all users:
*.emerg                                                 *

# This log is for news and uucp errors:
uucp,news.crit                                          -/var/log/spooler

# Uncomment these if you'd like INN to keep logs on everything.
# You won't need this if you don't run INN (the InterNetNews daemon).
#news.=crit                                     -/var/log/news/news.crit
#news.=err                                      -/var/log/news/news.err
#news.notice                                    -/var/log/news/news.notice

I;'m assuming it should go in messages or syslog, but it is in neither...

Should I post my rc.firewall?