new firewall setup

bones996 · 07-30-2006, 09:02 PM

I was wondering what some of the security guru's might think about installing a new firewall this way & how well it might work.

Firewall

* Monolithic kernel - no usb, sound, video, mass storage, etc.

* all unnecessary services disabled

* extra users & groups removed - ftp, news,

* minimal install & remove extra base packages - install upgrades from trusted cd (all rpms gpg signed),

* Extra packages - bastille, blockhosts, sshdfilter,

* Daily checks with tripwire (database on cdr), rkhunter, chkrootkit, & antivir
Weekly checks with lsat & tiger

script is encrypted with shc (http://www.datsi.fi.upm.es/~frosal/)

* SSH on different port (not 22) - no root login

* /etc/hosts.deny
All: ALL

* /etc/hosts.allow
sshd: 192.168.1.5 (penguin command)

* /etc/rc.d/rc.local
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

* configure network access, get new updates if any

win32sux · 07-31-2006, 07:20 AM

sounds good to me...

BTW, isn't icmp_echo_ignore_broadcasts redundant since you're already using icmp_echo_ignore_all??

also, remember to activate spoof protecton:

Code:

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

and here's a few other kernel parameters you might want to look into:

Code:

echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
echo "0" > /proc/sys/net/ipv4/tcp_sack
echo "0" > /proc/sys/net/ipv4/tcp_timestamps
echo "1" > /proc/sys/net/ipv4/tcp_rfc1337

google them to determine whether you want them activated or disabled...

another thing you should look into is patching your kernel with grsecurity:

http://grsecurity.net/

just my

...