SUBJECT: iptables rules for an FTP server
I have just started using vsftpd and I want to see whether my firewall rules are good enough.
This topic is about firewalling. A second topic will follow where I request for comments (sic :P) on creating a secure but reasonable configuration for vsftpd. However, I want to give a complete picture of what I am trying to do, and so I am including vsftpd.conf and vsftpd.userlist.
I chose to enable passive mode so as to make it easier for the client to connect. One of my goals was to enable the Internet Explorer / Windows Explorer FTP client to work (some people don't even know how to install another FTP client) but as far as I understand the only compromise I had to do to enable the IE/Explorer client was to use passive mode. Which isn't a big compromise. Correct me if I am wrong about this.
I'd like you to take a look and tell me what you think. I have two main concerns:
1. I may have too broad rules.
2. I still don't know how I can add anti-DoS protection, meaning setting a limit on the connections an IP can do and how many IPs can connect at the same time.
I am grouping the rules by function (e.g.: enabling FTP client, enabling FTP server, etc). There are comments explaining my thoughts on some rules. Feel free to read them and give me feedback on anything you see.
Well, here it is!
/etc/rc.d/rc.firewall
Code:
#!/bin/sh
# Sample firewall rules to see whether my ftp server rules are fine-tuned.
# Default policy for the three chains.
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Flush (remove) all rules from default chains.
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
# Remove all custom chains.
iptables -X
# Allows input and output on loopback. From my experience, you will not feel
# the need to allow output on loopback if you don't use a Samba server.
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A OUTPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
# Allow traffic for sessions which are already established. This
# is the idea of a statefull firewall.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# SSH client.
# it appears that the SSH server rules are enough so this isn't needed
###iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
# FTP client.
iptables -A OUTPUT -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 1024:65535 -m state --state RELATED -j ACCEPT
#iptables -A OUTPUT -p tcp --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
# Outgoing ICMP (ping).
### it stoped working, now I have a more broad rule (and potentially dangerous too) ### iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
# Outgoing Nmap.
iptables -A OUTPUT -m state --state INVALID,NEW -j ACCEPT
### i was supposed to have this line too but it works without it ### iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED,INVALID -j ACCEPT
# SSH server, only on LAN (10.0.0.0/16).
iptables -A INPUT -s 10.0.0.0/16 -d 10.0.0.0/16 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 10.0.0.0/16 -d 10.0.0.0/16 -p tcp --sport 22 -j ACCEPT
# FTP server.
# the 1024:65535 part may not be necessary because of nf_conntrack_ftp
modprobe nf_conntrack_ftp
iptables -A INPUT -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
/etc/vsftpd.conf
Code:
# Option added by me. Allows passive mode. I wanted to enable this due
# to IE/Explorer but now I see that IE/Explorer can connect without this
# enabled. Sometimes.
pasv_enable=YES
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
# Uncomment this to allow local users to log in. This must be enabled for
# any non-anonymous login to work, including virtual users.
local_enable=YES
# Uncomment this to enable any form of FTP write command.
write_enable=YES
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
# Users cannot see the tree outside of their home directory. Added by me.
chroot_local_user=YES
# Allow only specific users to use FTP. Added by me.
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd.userlist
# Allow me to set /bin/false instead of a shell. Alternatively I could
# have added /bin/false in /etc/shells but this feels more right.
check_shell=NO
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
anon_mkdir_write_enable=YES
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
# Activate logging of uploads/downloads.
xferlog_enable=YES
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
# You may override where the log file goes if you like. The default is shown
# below.
xferlog_file=/var/log/vsftpd.log
# If you want, you can have your log file in standard ftpd xferlog format
xferlog_std_format=YES
# You may change the default value for timing out an idle session.
idle_session_timeout=600
# You may change the default value for timing out a data connection.
data_connection_timeout=120
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
# You may fully customise the login banner string:
ftpd_banner=QP938-ST49
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
ls_recurse_enable=YES
# To run vsftpd in standalone mode (rather than through inetd), uncomment
# the line below.
listen=YES
/etc/vsftpd.userlist
Code:
# List of users allowed to use FTP. Read by vsftpd. Config file by me.
antagonist
leon
