Linux Microsoft VMware
Showing posts with label SElinux. Show all posts
Showing posts with label SElinux. Show all posts

Monday, September 3, 2012

Linux: Iptables Examples For New SysAdmins Part -->3


Before see this post please read my previous post (Linux: Iptables Examples For New SysAdmins Part -->2)


#12: Log and Drop Packets

 

Type the following to log and block IP spoofing on public interface called eth1

# iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j LOG --log-prefix "IP_SPOOF A:

# iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

Linux: Iptables Examples For New SysAdmins Part -->2


Before see this post please read my previous post (Linux: Iptables Examples For New SysAdmins Part -->1)

#3: Delete Firewall Rules

To display line number along with other information for existing rules, enter:

# iptables -L INPUT  -n --line-numbers
# iptables -L OUTPUT -n --line-numbers
# iptables -L OUTPUT -n --line-numbers | less
# iptables -L OUTPUT -n --line-numbers | grep 192.0.43.10

Linux: Iptables Examples For New SysAdmins Part -->1


Linux comes with a host based firewall called Netfilter. According to the official project site:
netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.
This Linux based firewall is controlled by the program called iptables to handles filtering for IPv4, and ip6tables handles filtering for IPv6. I strongly recommend that you first read our quick tutorial thatexplains how to configure a host-based firewall called Netfilter (iptables) under CentOS / RHEL / Fedora / Redhat Enterprise Linux. This post list most common iptables solutions required by a new Linux user to secure his or her Linux operating system from intruders.

Redhat / CentOS Iptables Firewall Configuration


H
ow do I configure a host-based firewall called Netfilter (iptables) under CentOS / RHEL / Fedora / Redhat Enterprise Linux?
Icon reference for Firewall


Netfilter is a host-based firewall for Linux operating systems. It is included as part of the Linux distribution and it is activated by default. This firewall is controlled by the program called iptables. Netfilter filtering take place at the kernel level, before a program can even process the data from the network packet.

What is sysctl.conf in Linux


sysctl is an interface that allows you to make changes to a running Linux kernel. With /etc/sysctl.conf you can configure various Linux networking and system settings such as:
1.      Limit network-transmitted configuration for IPv4
2.      Limit network-transmitted configuration for IPv6
3.      Turn on execshield protection
4.      Prevent against the common 'syn flood attack'
5.      Turn on source IP address verification
6.      Prevents a cracker from using a spoofing attack against the IP address of the server.
7.      Logs several types of suspicious packets, such as spoofed packets, source-routed packets, and redirects.

sysctl command

The sysctl command is used to modify kernel parameters at runtime. /etc/sysctl.conf is a text file containing sysctl values to be read in and set by sysct at boot time. To view current values, enter:

# sysctl -a

# sysctl -A

# sysctl mib

# sysctl net.ipv4.conf.all.rp_filter

To load settings, enter:

# sysctl -p

Sample /etc/sysctl.conf

Edit /etc/sysctl.conf and update it as follows. The file is documented with comments. However, I recommend reading the official Linux kernel sysctl tuning help file (see below):
# The following is suitable for dedicated web server, mail, ftp server etc. 
# ---------------------------------------
# BOOLEAN Values:
# a) 0 (zero) - disabled / no / false
# b) Non zero - enabled / yes / true
# --------------------------------------
# Controls IP packet forwarding
net.ipv4.ip_forward = 0
 
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
 
# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
 
# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
 
# Controls whether core dumps will append the PID to the core filename
# Useful for debugging multi-threaded applications
kernel.core_uses_pid = 1
 
# Controls the use of TCP syncookies
#net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
 
########## IPv4 networking start ##############
# Send redirects, if router, but this is just server
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
 
# Accept packets with SRR option? No
net.ipv4.conf.all.accept_source_route = 0
 
# Accept Redirects? No, this is not router
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
 
# Log packets with impossible addresses to kernel log? yes
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
 
# Ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
net.ipv4.icmp_echo_ignore_broadcasts = 1
 
# Prevent against the common 'syn flood attack'
net.ipv4.tcp_syncookies = 1
 
# Enable source validation by reversed path, as specified in RFC1812
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
 
########## IPv6 networking start ##############
# Number of Router Solicitations to send until assuming no routers are present.
# This is host and not router
net.ipv6.conf.default.router_solicitations = 0
 
# Accept Router Preference in RA?
net.ipv6.conf.default.accept_ra_rtr_pref = 0
 
# Learn Prefix Information in Router Advertisement
net.ipv6.conf.default.accept_ra_pinfo = 0
 
# Setting controls whether the system will accept Hop Limit settings from a router advertisement
net.ipv6.conf.default.accept_ra_defrtr = 0
 
#router advertisements can cause the system to assign a global unicast address to an interface
net.ipv6.conf.default.autoconf = 0
 
#how many neighbor solicitations to send out per address?
net.ipv6.conf.default.dad_transmits = 0
 
# How many global unicast IPv6 addresses can be assigned to each interface?
net.ipv6.conf.default.max_addresses = 1
 
########## IPv6 networking ends ##############
 
#Enable ExecShield protection
kernel.exec-shield = 1
kernel.randomize_va_space = 1
 
# TCP and memory optimization 
# increase TCP max buffer size setable using setsockopt()
#net.ipv4.tcp_rmem = 4096 87380 8388608
#net.ipv4.tcp_wmem = 4096 87380 8388608
 
# increase Linux auto tuning TCP buffer limits
#net.core.rmem_max = 8388608
#net.core.wmem_max = 8388608
#net.core.netdev_max_backlog = 5000
#net.ipv4.tcp_window_scaling = 1
 
# increase system file descriptor limit    
fs.file-max = 65535
 
#Allow for more PIDs 
kernel.pid_max = 65536
 
#Increase system IP port limits
net.ipv4.ip_local_port_range = 2000 65000

Wednesday, August 29, 2012

CentOS / RHEL: Disable or Enable SELinux Policy Modules


H
ow do I disable or enable SELinux policy modules under Red Hat Enterprise Linux running on Dell hardware?

You need to use the semodule command. This command is used to manage SELinux policy modules, including installing, upgrading, listing, disabling and removing modules.

Task: See currently installed modules

Type the following command as the root user:

semodule –l
semodule -l | more
semodule | less

Sample outputs:

abrt    1.2.0
accountsd       1.0.0
ada     1.4.0
afs     1.5.3
aiccu   1.0.0
aide    1.5.0
aisexec 1.0.0
amanda  1.12.0
amavis  1.10.3
amtu    1.2.0
apache  2.1.2
apcupsd 1.6.1
arpwatch        1.8.1
asterisk        1.7.1
audioentropy    1.6.0
automount       1.12.1
avahi   1.11.2
awstats 1.2.0
bind    1.10.2
bitlbee 1.2.1
bluetooth       3.2.2
....
..
..
 Output truncated
....
..
uuidd   1.0.0
varnishd        1.1.0
vdagent 1.0.0
vhostmd 1.0.0
virt    1.4.0
vmware  2.2.0
vpn     1.12.0
w3c     1.0.0
wdmd    1.0.0
webadm  1.1.0
webalizer       1.10.0
wine    1.6.1
xen     1.9.2
xfs     1.6.0
xguest  1.0.1
zabbix  1.2.0
zarafa  1.0.0
zebra   1.10.1
zosremote       1.1.0

Task: SELinux disable module

To disable existing module, type:

 semodule -d MODULE_NAME_HERE

OR

 semodule --disable=MODULE_NAME_HERE

To disable module called webalizer, enter:

# semodule -v -d webalizer

To verify new settings, enter:

# semodule -l | grep webalizer

Sample outputs:

[root@rhel6 ~]# semodule -v -d webalizer
Attempting to disable module 'webalizer':
Ok: return value of 0.
Committing changes:
Ok: transaction number 0.
[root@rhel6 ~]# semodule -l | grep webalizer
webalizer       1.10.0  Disabled

Task: SELinux enable module

To enable existing module, type:

 semodule -e MODULE_NAME_HERE 

OR

# semodule --enable=MODULE_NAME_HERE

To enable module called webalizer, enter:

# semodule -v -e webalizer

Sample outputs:

Attempting to enable module 'webalizer':
Ok: return value of 0.
Committing changes:
Ok: transaction number 0.

Powered by Blogger.