Secure: PC Tips by Anu

Showing posts with label Secure. Show all posts

Sunday, January 29, 2012

Best practices to stay safe on Facebook and avoid being hacked

Sunday, January 29, 2012

Anu

Tuesday, March 22, 2011

Hack & Crack proof SSH on Linux...

Tuesday, March 22, 2011

Anu

It’s inevitable: if your computer is Internet-connected you will have people coming a-knockin’. Fortunately Linux users are more savvy than to think any keep-alive ping or other piece of Internet flotsam is a hack attempt.

Even so, it’s simply a matter of time before your router’s lights flash heavily and /var/log/auth.log (/var/log/secure on RedHat) fills with chilling messages like these:

$ tail /var/log/auth.log
Aug 1 20:23:41 www.PCTipsbyAnu.tk sshd[15577]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.218.125.178
Aug 1 20:23:44 www.PCTipsbyAnu.tk sshd[15577]: Failed password for invalid user edward from 210.48.230.5 port 43812 ssh2
Aug 1 20:23:46 www.PCTipsbyAnu.tk sshd[15581]: Invalid user javed from 210.48.230.5
Aug 1 20:23:46 www.PCTipsbyAnu.tk sshd[15581]: (pam_unix) check pass; user unknown
Aug 1 20:23:46 www.PCTipsbyAnu.tk sshd[15581]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.218.125.178
Aug 1 20:23:49 www.PCTipsbyAnu.tk sshd[15581]: Failed password for invalid user javed from 210.48.230.5 port 44088 ssh2
Aug 1 20:23:51 www.PCTipsbyAnu.tk sshd[15585]: Invalid user code from 210.48.230.5
Aug 1 20:23:51 www.PCTipsbyAnu.tk sshd[15585]: (pam_unix) check pass; user unknown
Aug 1 20:23:51 www.PCTipsbyAnu.tk sshd[15585]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.218.125.178
Aug 1 20:23:53 www.PCTipsbyAnu.tk sshd[15585]: Failed password for invalid user code from 210.48.230.5 port 44346 ssh2

The warnings are clear: someone is trying to log in via sshd, the secure shell daemon, trying random username and password combinations. And, as great as high-bandwidth is, the downside is that malicious forces can attempt thousands of login attempts in a very short time.

Now, the right term for a person who attempts to exploit security is a cracker, but “hacker” – rightfully an inquisitive and enthusiastic person – has been popularised as a malicious meddler. Nevertheless, at this point in time semantics are the last thing on your mind: whether you're being hacked or cracked you’ve got to secure your system and keep out the bad guys.

In fact, someone successfully logging in is only one of your worries. Firstly, each attempt adds several lines to your log files. In time, a lot of disk space is wasted and your logs become almost meaningless with other information you might be seeking being well hidden amongst the tens of thousands of repetitive entries.

And, more importantly, a high-speed multi-threaded attack runs the risk of denying your service by consuming all your bandwidth – let alone system resources. And if your system is too busy handling these connections, how will you log in, yourself?

So then - what do you do?

Lock down sshd
The very first step is to beef up the security on SSH itself.

Firstly, you don’t want anyone logging in to your system as root. This gives unfettered power. This doesn’t stop you remoting in to your system using an ordinary user account and su’ing to root. Edit the /etc/ssh/sshd_config file and ensure it has an entry “PermitRootLogin no”. This means ssh will just prevent root logins; any attempt will fail even if the password is right. Best of all, the failure message gives no hint the connection failed because of this rule; it looks like any other bad username/password combo. This means your cracker has to guess a genuine username and password so their work is made much harder.

Depending on how flexible your network is, you might also consider changing the port number that SSH listens on. By default, it uses port 22 and this is the port crackers will be attempting to use. You could change this to some other arbitrary port. You will still be able to SSH in, specifying the appropriate port number, but others will have no success unless they realise firstly there’s another port open, and secondly that it is used for SSH (the fact a non-standard port is open gives no immediate information as to the protocol it uses.) Once again, edit /etc/ssh/sshd_config and set a customised port number on the ListenAddress line.

This is a good start. Yet, there’s still more to do. The biggest problem is there’s no built-in mechanism to stop repeated login attempts from the same IP address, even if it is failing continually.

Fortunately, all modern Linux distros come standard with a built-in firewall package known as netfilter/iptables. Netfilter is the framework that interacts with the kernel to inspect network packets; iptables is a firewall component which uses netfilter to filter packets based on specified rules. (Previously, the predominant package for this purpose was ipchains.)

Well and good, but unfortunately, iptables has no built-in rules to protect against brute force attacks. It’s installed, but it’s just sitting there idle.

Recently, CODE MOBILE faced this very problem. He solved his issue with two dead simple iptables rules that everyone can use. These are:

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

This pair of commands rate-limits all incoming SSH connections to eight per minute. A valid user who knows their username and password won’t be inconvenienced at all, but brute-force crackers will have their connection attempts – each being a try at a username and password – dropped right down to eight from the lofty number otherwise offered by high-speed data networks.

You can use iptables –L at any time to list your firewall rules and you can use iptables –F at any time to flush the rules. It’s definitely worthwhile checking Kevin’s blog for more detail on his rules, including how to make them take effect upon system boot.

iptables – Plan B

The rules above are clear and concise. The problem is they don’t really send a strong message to the cracker to go away. 2020Code strive for more protection with stricter iptables rules:

-N SSH
-N SSH_ABL
-A SSH -m recent --name SSH_ABL --update --seconds 3600 -j REJECT
-A SSH -m recent --name SSH --rcheck --seconds 60 --hitcount 5 -j SSH_ABL
-A SSH_ABL -m recent --name SSH_ABL --set -j LOG --log-level warn --log-prefix "ABL: +SSH: "
-A SSH_ABL -j REJECT
-A SSH -m recent --name SSH --rcheck --seconds 2 -j LOG --log-level warn --log-prefix "RATE: "
-A SSH -m recent --name SSH --update --seconds 2 -j REJECT
-A SSH -m recent --name SSH_ABL --remove -j LOG --log-level warn --log-prefix "ABL: -SSH: "
-A SSH -m recent --name SSH --set -j ACCEPT
-A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j SSH

The net effect of these rules is threefold.

Firstly, a two-second pause is forced between successive SSH connections from the same host, slowing down login attempts.

Secondly, if the same host attempts (and fails) connection five times within the span of one minute, the host is automatically blacklisted.

Thirdly, this block lapses after a full hour passes with no connection attempts from the host.

This is much more industrial strength. Now the cracker only gets five chances every sixty-one minutes. They’ll soon move on to other grounds. The downside is fat-fingered legitimate users can potentially lock themselves out, and this is especially problematic if you have possibly many users from behind a NAT’d network who legitimately need to connect to your system and some of the users are slightly forgetful or password-challenged.

sshblack

You might prefer not to edit the iptables rules yourself. Or, you may want rules which exercise more intelligence so that genuine users, albeit absent-minded, aren’t locked out.

In this case, sshblack is a freely-downloaded Perl script that eases the burden. It actively monitors log files for any concerning activity and reacts to aggressive attacks by adding their IP address to a blacklist. Any host attempting a connection which is found in the blacklist is prevented from making an SSH connection. After a period of time, the host is removed from the blacklist. The script can send e-mail notices keeping you aware of any possible concerns.

The downsides to sshblack are that it hasn’t been updated since 2006, and also that it works by parsing log files. This means it doesn’t necessarily react instantaneously to cracking attempts depending on the processor’s load.

DenyHosts

We've saved the best to last. Now you know the problem and approaches to solving it, there’s another terrific option, the SourceForge project called DenyHosts, written in Python. Like all the above, the fundamental purpose is to thwart SSH attacks by blocking IP addresses which appear to be engaging in malicious behaviour. Where DenyHosts differs is that it isn’t running in isolation. The above solutions will reject hosts after they’ve already made failed attempts on your computer; by contrast DenyHosts uses a communal database to proactively protect your system. You need not even suffer one connection attempt by a host which has been detected as hostile by others.

DenyHosts is a snap to set up. Just install the RPM or unpack the tarball – both available for free download from SourceForge. Out of all the methods surveyed here, DenyHosts is the slickest and most elegant. Its one catch is that it is tied to the version of Python installed. This means you need to exercise caution whenever upgrading Python. Alternatively, you can install multiple versions of Python in different directories.

It’s not uncommon to have crackers survey your system. Sadly, it’s also not uncommon for people to overlook security options. The above techniques can make the difference on your computer and bolster your security and peace of mind.

Secure your self with IP tables rules... (10 TP tables rules)

Tuesday, March 22, 2011

Anu

The iptables tool is a magnificent means of securing a Linux box. But it can be rather overwhelming. Even after you gain a solid understanding of the command structure and know what to lock down and how to lock it down, iptables can be confusing. But the nice thing about iptables is that it’s fairly universal in its protection. So having a few iptables rules to put together into a script can make this job much easier.

With that in mind, let’s take a look at 10 such commands. Some of these rules will be more server oriented, whereas some will be more desktop oriented. For the purpose of this article, I’m not going to explain all of the various arguments and flags for iptables. Instead, I’ll just give you the rule and explain what it does.

For more information on the specifics of the rule, you can read the man page for iptables, which will outline the arguments and flags for you.

1: iptables -A INPUT -p tcp -syn -j DROP

This is a desktop-centric rule that will do two things:

First it will allow you to actually work normally on your desktop. All network traffic going out of your machine will be allowed out, but all TCP/IP traffic coming into your machine will simply be dropped. This makes for a solid Linux desktop that does not need any incoming traffic. What if you want to allow specific networking traffic in —

for example, ssh for remote management? To do this, you’ll need to add an iptables rule for the service and make sure that service rule is run before rule to drop all incoming traffic.

2: iptables -A INPUT -p tcp –syn –destination-port 22 -j ACCEPT

Let’s build on our first command.
To allow traffic to reach port 22 (secure shell), you will add this line. Understand that this line will allow any incoming traffic into port 22. This is not the most secure setup alone.
To make it more secure, you’ll want to limit which machines can actually connect to port 22 on the machine.
Fortunately, you can do this with iptables as well. If you know the IP address of the source machine, you can add the -s SOURCE_ADDRESS option (Where SOURCE_ADDRESS is the actual address of the source machine) before the –destination-port portion of the line.

3: /sbin/iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

This will allow all previously initiated and accepted exchanges to bypass rule checking.

The ESTABLISHED and RELATED arguments belong to the –state switch.

The ESTABLISHED argument says, “Any packet that belongs to an existing connection,” and the RELATED argument says, “Any packet that does not belong to an already existing connection but is related to an existing connection.”
The “state machine” of iptables is a means for iptables to track connections with the help of the kernel level “conntrack” module. By tracking connections, iptables knows what connections can be allowed and what can’t. This reduces the amount of work the administrator has to do.

Here’s how state works. If the local user initiates a connection, that packet (to that connection) is set as NEW in the prerouting chain. When the local user gets a return packet, the state is changed to ESTABLISHED in the prerouting chain. So when a state is set as ESTABLISHED, it can be allowed with the right iptables rule.

4: iptables -N LOGDROP

With this handy chain, iptables will log all dropped packets. Of course, this is only part of the chain.
To complete it, you need to add the follow two rules:

iptables -A logdrop -J LOG
and
iptables -A logdrop -J DROP

Now all matching packets (in this case, anything that has been dropped) will be added to the logdrop chain which will log them and then drop them.

5: iptables -t nat -A PREROUTING -i WLAN_INTERFACE -p tcp –dportPORTNUMBERS -j DNAT –to-destination DESTINATION_IP

When you need to route packets from external sources to specific ports on specific internal machines, this is what you want to do. This rule takes advantage of network address translation to route packets properly.
To suit your needs, the WLAN_INTERFACE must be changed to the WLAN interface that bridges the external network to the internal network, the PORTNUMBERS must be changed, and DESTINATION_IP must be changed to match the IP address of the destination machine.

6: iptables -A INPUT -p tcp –syn –dport 25 -j ACCEPT

This is the beginning of a SYN flood protection rule. This portion of the rule blocks DoS attacks on a mail server port. (You can change this to suit your mail server needs.) There are three more portions of this rule set. The first is to add the same rule but modify the port to whatever is being served up by whatever ports you have open.
The next portion is iptables -A INPUT -p tcp –syn -m limit –limit 1/s –limit-burst 4 -j ACCEPT, which is the actual SYN flood protection.
Finally, iptables -A INPUT -p tcp –syn -j DROP will drop all SYN flood packets.

7: iptables -A INPUT -p tcp -m tcp -s MALICIOUS_ADDRESS -j DROP

This is where you can take care of malicious source IP addresses. For this to work properly, you must make sure you know the offending source IP address and that, in fact, it’s one you want to block. The biggest problem with this occurs when the offending address has been spoofed. If that’s the case, you can wind up blocking legitimate traffic from reaching your network. Do your research on this address.

8: iptables -N port-scan

This is the beginning of a rule to block furtive port scanning. A furtive port scan is a scan that detects closed ports to deduce open ports. Two more lines are needed to complete this rule:

iptables -A port-scan -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j RETURN iptables -A port-scan -j DROP

Notice that the above rule set is adding a new chain called “port-scan”. You don’t have to name it such; it’s just easier to keep things organized. You can also add timeouts to the above rule set like so:

iptables -A specific-rule-set -p tcp --syn -j syn-flood iptables -A specific-rule-set -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j port-scan

9: iptables -A INPUT -i eth0 -p tcp -m state –state NEW -m multiport –dports ssh,smtp,http,https -j ACCEPT

What you see here is a chain making use of the multiport argument, which will allow you to set up multiple ports. Using the multiport argument lets you write one chain instead of multiple chains. This single rule saves you from writing out four separate rules, one each for ssh, smtp, http, and https. Naturally, you can apply this to ACCEPT, DENY, REJECT.

10: iptables -A PREROUTING -i eth0 -p tcp –dport 80 -m state –state NEW -m nth –counter 0 –every 4 –packet 0 -j DNAT –to-destination 192.168.1.10:80

If you’re looking to load balance between multiple mirrored servers (in the example case, load balancing a Web server at 192.168.1.10), this rule is what you want. At the heart of this rule is the nth extension, which tells iptables to act on every “nth” packet. In the example, iptables uses counter 0 and acts upon every 4th packet. You can extend this to balance out your mirrored sites this way. Say you have four mirrored servers up and you want to balance the load between them. You could have one line for each server like so:

1: iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth

--counter 0 --every 4 --packet 0 -j DNAT --to-destination 192.168.1.10:80

2: iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW

-m nth --counter 0 --every 4 --packet 1 -j DNAT --to-destination 192.168.1.20:80

3: iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW

-m nth --counter 0 --every 4 --packet 2 -j DNAT --to-destination 192.168.1.30:80

4: iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW

-m nth --counter 0 --every 4 --packet 3 -j DNAT --to-destination 192.168.1.40:80

As you can see the server on .10 will be routed every 0 packet, the server on .20 will be routed every 1st packet, the server on .30 will be routed every 2nd packet, and the server on .40 will be routed every 3rd packet.

Other options?

These 10 iptables rules will help you secure your Linux server. Of course, with anything Linux, there are multiple possibilities to achieve the same results. But these rules should serve as an outstanding springboard for Linux server security — as well as Linux security discussion.

Thanks...

Tuesday, March 8, 2011

What you can do to help prevent from being hacked?

Tuesday, March 08, 2011

Anu

This is a very serious Situation for all of use since we are all in a technological age to were we use phones and computers to help with our day to day lives

Sadly I have been a victim of Hacking a few times once during the end of the year some one Hacked in to my Pay pall account and stole 271 dollars and again just recently some one hacked into my e-mail account and was sending all types of Porn and spam mail to my friends and family

Talk about embarrassing when Your Dad calls you to ask why you have sent him a link to your ADULT web sight

So I thought this form would be a good Idea to have so we can share Ideas on what to do when you are hacked and ways of helping Preventing it form Happening

To Prevent it form happening

*Change your pass words often
I know that its simple to keep the same password the same but believe me when I say the computer biological code is 010011001 and those represent not only numbers but also letters

*Clear Private Data from your web browser
Most if not all internet browser have away to clear private data as well as cookies from your computer. Not only dose this help protect you passwords it also helps Keep your computer in good Maintenances.

*For Passwords Uses a Series of Capital letters and numbers
This will actually give you a stronger protection then any thing else.The stronger your password the harder it is for you to be hacked

*Get some sort of Malware scanner for your computer
believe it or not most virus and hacks happen because of Malware on your computer.Malware are found most of the times in the pop-ups that happen on your computer

*If you Have a pop-up blocker on your browser uses it
Those pop up protection's are there for your safety and if you clear your private data the pop-up counter will also be cleared

*Be sure to run virus scans and Malware scans regularly
This not only protects your computer it protects you too a lot of your Private information is stored on your computer hard drive.

How to clear Private Data

This is Pretty simple
* Find the tools tab on your browser and click down to Clear Private data
* Once the tab for clear private data you wanna make sure every box is checked by doing this it also erases any saved password you might have on your browser

* Click the Clear Private Data now button and you are done all of your private data has been erased You have also bee longed out of any account that might have been opened that you forgot about

If you are Hacked

* Change all password and Pins As soon as possible

* Tell Family and Friends so they can advise you if they receive any thing that you did not send them*

* Run every scan you have to check for malwear and virus

* Clear all private data on every browser

FEW MORE TIPS

Regularly download your updates for your Operating System, especially if you use Microsoft Windows, and any version of XP, Vista, and Windows 7. Microsoft OS's are always patchy, and full of bugs, protect yourself by staying up to date.

Regularly download and update the virus definitions for your Anti-Virus program, whether its bought off the shelf, or freeware like AVG. This will help to protect your PC from Malware and Virus infection.

Don't turn your Anti-Virus program off, leave it on at all times, especially when you use the Internet, are connected to the Internet, disconnect from the Internet, and when you use USB flash-drives, and external devices like an external hard-drive. Viruses can be copied onto your PC from a USB Flash drive, it happens.

If you use any kind of device with a portable onboard memory that 'plugs' into your PC, like a USB Flash Drive or an MP3 Player, use your Anti-Virus program and 'scan it' for viruses. It's that easy to infect your PC with a virus if you don't take proper precautions and scan the USB flash drive when you first plug it in. If you are switching the Flash drive between different PC's you can easily infect the other PC if there's a virus on one already.

Becareful what you download. Avoid Peer-to-Peer programs like Kazaa, and Q-Lite where you can join a global network of PC's and download stuff. You could be downloading viruses, and trojans too.

Avoid websites that your Anti-Virus program pops up a warning about. Get out of there and leave the place. It's likely to be fairly bad for your PC if you hand around.

Becareful of downloading 'Freeware' that is software that is opensource, an you can download and use for free. If you want opensource packages like OpenOffice, go to the actual developer's website and download it from there directly, or find a reputable website with good online security, and download it there. Don't go to third-party sites.

Do not give out your passwords to anyone. You wouldn't give a stranger the keys to your house. Think first, and be sensible.

Be cautious about using different websites to buy stuff online. Check out their security policies first, especially for end-user protection, changing of passwords, and secure logins to the website itself, data-encryption, and protection of passwords.
If you are ever about to 'login' to a website login the 'Secure' way. Check the address bar and the URL (that's the thing that reads WWW.WEBSITE.COM). If you can login securely it should have this: 'HTTPS:' in place of the 'HTTP:' before the website URL address, in the address bar in your browser window. The HTTPS stands for the 'Secure Hypertext Transfer Protocol' it means that when you login your password is encrypted. Banks use this type of login alot when you use online banking. The web address for secure login should read (HTTPS: before the website URL).

Clear cookies, caches, and browser history regularly.

Do not write your passwords down on your PC, it doesn't take much for a person to plant a keylogger program onboard your hard-drive, so that they can record every keystroke you make.

If you shop online using a direct debit card or a credit card, check out with your bank on what security measure you can take to protect yourself on their end, and make certain that you only shop with websites that have a stringent, and tight online security and protection policy.

Regularly use your Anti-Virus program and do a 'Full System Scan' or a 'Whole System Scan' to scan every single inch of your computer's internal hard-drive to detect for viruses.

I can only hope and pray that this information helps you from getting hacked as well. If you have tips for helping or preventing Hacking please feel free to share your tips.

Can't think of anything else at the moment...

tHANKS...

Monday, November 8, 2010

How to secure your PC?

Monday, November 08, 2010

Anu

So you have just bought a newpersonal computer for your home (rather than for a workplace or as a server)and want to secure it (including protecting it from viruses andspyware). Privacy (including encryption, cryptography and anonymity) is a part of security but broad enough to need coveringseparately. Think of Privacy as the flipside of the coin. Making backups ofdata, defragging, system restore points are only indirectly related. Backupscan actually make your data easier to steal and retrieve.

This article assumes you wish to usea network (such as the internet), share files on pendrives and that your PC might bephysically accessible to others. If none of those apply, then your many ofthese steps may be redundant as your PC will already be quite secure.

Choose an operating system based on its security and vulnerability (Linux has no known active viruses in the wild, OpenBSD is focused on security). Find out if it uses limited user accounts, file permissions and is regularly updated. Make sure you update your operating system with security updates and update your other software too.
Choose a web browser based on its security and vulnerabilities because most malware will come through via your web browser. Disable scripts too (NoScript, Privoxy and Proxomitron can do this). Look at what independent computer security analysts (such as US-CERT) and crackers (similar to hackers) say.
When setting up, use strong passwords in your user account, router account etc. Hackers may use dictionary attacks and brute force attacks.
When downloading software (including antivirus software), get it from a trusted source (softpedia, download, snapfiles, tucows, fileplanet, betanews, sourceforge) or your repository if you are using Linux.
Install good antivirus software (particularly if you use P2P). Antivirus software is designed to deal with modern malware including viruses, trojans, keyloggers, rootkits, and worms. Find out if your antivirus offers real-time scanning, on-access or on-demand. Also find out if it is heuristic. Avast and AVG are very good free editions. Choose one, download and install it and scan regularly. Keep your virus definitions up to date by updating regularly.
Download and install software to deal with spyware such as Spybot Search and Destroy, HijackThis or Ad-aware and scan regularly. I can't state this enough - you need to run a good anti spyware and anti malware program like Spybot if you search the web at all. Many websites out there exploit weaknesses and holes in the security of Microsoft Explorer and will place malicious code on your computer without you knowing about it until its too late!
Download and install a firewall. Either ZoneAlarm or Comodo Firewall (Kerio, WinRoute or Linux comes with iptables). If you use a router, this gives an added layer of security by acting as a hardware firewall.
Close all ports. Hackers use port scanning (Ubuntu Linux has all ports closed by default).
Perform Penetration Testing. Start with ping, then run a simple nmap scan. Backtrack Linux will also be useful.
Consider running intrusion detection software (HIDS) such as ossec, tripwire or rkhunter.
Don't forget to think in terms of physical security (in case of theft/unauthorised access), like setting a BIOS password and preventing access to your machine or its removable devices (USB, CD drive etc.). Don't use an external hard drive or USB device for important data, these represent another vulnerability, as they are easier to steal/lose.

Encryption can be effective againsttheft. Encrypt at least your entire user account rather than just a few files.It can affect performance but can prove worth it. Truecrypt works on Windows, OS X, Linux, FreeOTFE works onWindows and Linux. In OS X (10.3 or later) System Preferences Security, clickFileVault (this can take minutes to hours). In Linux Ubuntu (9.04 orlater) installation Step 5 of 6 choose "Require my password to loginand decrypt my home folder". This uses ecryptfs.

Wednesday, October 20, 2010

How to hide the data in Notepad without any software/tools?

Wednesday, October 20, 2010

Anu

Friday, October 8, 2010

How to delete an IP from Deny Host List?

Friday, October 08, 2010

Anu

Saturday, September 11, 2010

How to make a firewall just in ten minutes?

Saturday, September 11, 2010

Anu

Each major version of Linux has had a different firewalling software suite. 2.0 kernels had ipfwadm, 2.2 had ipchains, and 2.4 has iptables. (2.4 can support ipchains-style rules if you load the ipchains module.)

Each offers great improvements from its predecessors. Iptables, aka Netfilter offers extreemly powerful network controls, and can route packets to and from different machines and ports in ways beyond belief and understanding.

Because of it's potential compexity, iptables can be intimidating.

I intend to help you whip up a firewall in ten minutes or less. First, some lame ASCII art:

LAN

192.168.1.0/24

+--- machine

Internet ----- Firewall ----+

+--- machine

We're going to use a dedicated firewall machine with two network cards, and put all our machines behind it on the LAN. Let's assume we pick 192.168.1.0/24 as the LAN network, offering us a maximum of 254 hosts back there.

We'll use 192.168.1.1 for the firewall's LAN IP address (let's assume this is eth0) and assume that the IP address for the Internet side is 300.3.3.3 on eth1.

Our firewall won't do much. We'll turn off all services except for ssh, which you should lock down by configuring your TCP Wrappers to deny all hosts except the lan:

ADMIN$ cat /etc/hosts.allow
sshd: 192.168.1.
ADMIN$ cat /etc/hosts.deny
ALL: ALL

The only other thing we'll run on the firewall is a DHCPD server to distribute IP addresses to the LAN machines. We'll configure iptables to re-write all outbound packets from LAN hosts, thus masquerading all outbound connections as if they came from the firewall itself.

This setup should work for any kind of Internet connectivity you have, be it dedicated DSL, dialup modem, or anything. The only tricky part may be making sure you have some way to know the IP address given to you by your ISP. While I'll call it 300.3.3.3 here, it's up to you to figure out what it is, and find some way to re-run our configuration should it change.

First, let's set up our DHCP server by creating an /etc/dhcpd.conf file. We need to specify a blank configuration for the Internet-connected side (300.3.3.0/24, presumably) and then our actual data for inside:

ANU007TIGER$ cat /etc/dhcpd.conf

     subnet 300.3.3.0 netmask 255.255.255.0 { }

     subnet 192.168.1.0 netmask 255.255.255.0 {
            allow bootp;
            option routers 192.168.1.1;
            option subnet-mask 255.255.255.0;
            option broadcast-address 192.168.1.255;

            # Adjust these lines
            option domain-name "example.com";
            option domains-name-servers A.B.C.D E.F.G.H;

            range dynamic-bootp 192.168.1.50 192.168.1.254;
            default-lease-time 18000;
            max-lease-time 18000;
            get-lease-hostnames on;
     }

ANU007TIGER# /etc/init.d/dhcp start
Internet Software Consortium DHCP Server 2.0pl4
Copyright 1995, 1996, 1997, 1998, 1999 The Internet Software Consortium.
All rights reserved.

Please contribute if you find this software useful.
For info, please visit http://www.isc.org/dhcp-contrib.html

Listening on LPF/eth1/00:10:18:77:bd:28/192.168.1.0
Sending on   LPF/eth1/00:10:18:77:bd:28/192.168.1.0
Listening on LPF/eth0/00:e0:74:28:e9:e6/300.3.3.0
Sending on   LPF/eth0/00:e0:74:28:e9:e6/300.3.3.0
Sending on   Socket/fallback/fallback-net

ANU007TIGER#

Ok, now that we've gotten our DHCP server started, internal machines will be able to use DHCP to get an address in the 192.168.1.50 - 192.168.1.254 range. I like to leave some IPs on the Class C for non-DHCP hosts, so 192.168.1.2-49 are available for these machines if you wish.

Ok, time to create your firewall rules. Create a startup script in /etc/init.d and link to it from the /etc/rcX.d directories as appropriate for your machine. Rather than hit each section piece by piece, I'll comment the script itself.

#!/bin/sh

# Definitions

EXT_INTERFACE=eth1

EXT_IP=300.3.3.3

INT_INTERFACE=eth0

INT_IP=192.168.1.1

# Ok, let's load some of the modules we'll need to

# support NAT and protocols that act stupid.

modprobe iptable_nat

modprobe ip_conntrack_ftp ip_nat_ftp

modprobe ip_conntrack_irc ip_nat_irc

# Whew. Now that all those are out of the way, down to

# the nitty gritty. Let's set up our iptables rules.

# Flush any existing tables

iptables --flush

iptables -t nat --flush

# Drop packets on the Internet side going to/from the private use

# multicast, reserved, and loopback networks. Perform egress

# filtering as well, to make sure we don't spoof others.

for network in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \

224.0.0.0/4 240.0.0.0/5 127.0.0.1/32

iptables -A INPUT -i $EXT_INTERFACE -s $network -j DROP

iptables -A OUTPUT -o $EXT_INTERFACE -s $network -j DROP

done

# Ok, now time to tell iptables that we want it to

# re-write all connections that initiate from inside

# to use it's external interface IP address, and re-write

# any of the responses appropriately.

iptables -t nat -F

iptables -t nat -A POSTROUTING -o $EXT_INTERFACE \

-j SNAT --to-source $EXT_IP

# End of script

DOWNLOAD THIS SCRIPT

That's it. If you lock down your firewall so it is secure, then you can provide Internet connectivity for your internal machines, while keeping them from being directly accessible from the internet.

Undoubtably some folks will point out that there are many things I've left out, and I agree. For example this is a classic case of 'default allow' programming, which is a tried and true bad idea. You can create much more complicated firewall scripts that will protect against lots of things not covered here. For the paranoid folks with a good amount of time on their hands, you should write your scripts to explicitly define appropriate connections both inbound and outbound. But for a ten minute firewall installation, this solution offers a good deal of security beyond your typically direct-connected box.

These days there seem to be hundreds of ready-to-go firewall scripts out there. I'd love to hear folks impressions and recomendations of those they've used in the past. I'll collect and summarize them next week for folks.

NOTES:

[1] http://www.netfilter.org/

[2] This type of firewall protects crackers from getting to your computers directly. But any vulnerabilities in your client software or protocol-related hacks are still are not protected.

[3] Some might say that writing your own iptables rulesets is like acting as your own lawyer....

Blog Archive

Popular Posts

Sunday, January 29, 2012

Best practices to stay safe on Facebook and avoid being hacked

Tuesday, March 22, 2011

Hack & Crack proof SSH on Linux...

Secure your self with IP tables rules... (10 TP tables rules)

2: iptables -A INPUT -p tcp –syn –destination-port 22 -j ACCEPT

3: /sbin/iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

4: iptables -N LOGDROP

5: iptables -t nat -A PREROUTING -i WLAN_INTERFACE -p tcp –dportPORTNUMBERS -j DNAT –to-destination DESTINATION_IP

6: iptables -A INPUT -p tcp –syn –dport 25 -j ACCEPT

7: iptables -A INPUT -p tcp -m tcp -s MALICIOUS_ADDRESS -j DROP

8: iptables -N port-scan

9: iptables -A INPUT -i eth0 -p tcp -m state –state NEW -m multiport –dports ssh,smtp,http,https -j ACCEPT

10: iptables -A PREROUTING -i eth0 -p tcp –dport 80 -m state –state NEW -m nth –counter 0 –every 4 –packet 0 -j DNAT –to-destination 192.168.1.10:80

Other options?

Tuesday, March 8, 2011

What you can do to help prevent from being hacked?

Monday, November 8, 2010

How to secure your PC?

Wednesday, October 20, 2010

How to hide the data in Notepad without any software/tools?

Friday, October 8, 2010

How to delete an IP from Deny Host List?

Step # 1: Stop DenyHosts

Step # 2: Remove Your IP From /etc/hosts.deny

Step # 3: Remove Your IP From /usr/share/denyhosts/data Directory

Step # 4: Start DenyHosts

THANKS

Saturday, September 11, 2010

How to make a firewall just in ten minutes?

Followers

Facebook

Networked Blogs