Architecture. Dual homed box Internet /8

Transcription

1 Firewalls Sources: * C. Hunt. TCP/IP Networking (?) * Simson & Garfinkel. Practical Unix & Internet Security. * W. Stallings. Computer Networks. (?) * iptables man page * Brad Fisher: February/ html * Joe Kopena: n=swat.netfilterqueuenotes * G. Maier: * netinet/ip.h header, netinet/tcp.h header, and netinet/udp.h header * R. Russell & H. Welte. Linux Netfilter Hacking HOWTO. Rttp:// * B. Burns et al. Security Power Tools. 1

2 Motivation Definition: System designed to keep out unauthorized users/attackers Many different types Differing complexity and robustness Different scope Single system Subnet Entire network Why we need it 2

3 Architecture Dual homed box Internet /8 3

4 Filtering Recall ISO networking protocol layer scheme: Firewalls can be layer 3, 4, or 7 7: 7: Application Application 6: 6: Presentation Presentation 5: 5: Something Something 4: 4: Transport Transport 3: 3: Network Network 2: 2: Data Data Link Link 1: 1: Physical Physical 4

5 Perimeter Networks Sometimes, need hosts on both sides of firewall Ex: public DNS/web versus private DNS/intranet Internet DMZ network private DNS/intranet server Internal network public web server public DNS 5

6 Perimeter Networks Different architecture: only dual-homed hosts Internet DMZ network Internal network private DNS/intranet server public web server public DNS 6

7 Port Scanning for i = 1 to 255 for p = 1 to ip=" %d" % i try: s=socket( ( ip,port) ) s.close() lst.append( (ip,port) ) except SocketError: pass 7

8 Port Scanning Sometimes, attackers use intermediaries If you can read this, you have excellent vision. 8

9 Port Knocking Defense against port scanning TCP: connect to 512 TCP: connect to 44 TCP: connect to 1111 Drop! Drop! Drop! TCP: connect to 22 OK port 22 now open for

10 Explanation Port knocking: Makes it more stealthy Suppose attacker sends packet to port 22 (ssh). If response comes back: Password guessing Solution: Turn off ssh. What about remote admins? Port knocking: Definition Note: no answer received to knocks either! Susceptible to sniffing If attacker can watch sequence of packets going in, can replicate the knock Users might reveal knock to unauthorized personnel Good for protecting against distant attackers 10

11 IPTables Filter NAT Mangle Raw Tables Chains 11

12 IPTables Architecture Highest level: Tables Filter (default): Most commonly used. Chains: INPUT, FORWARD, OUTPUT NAT: Network Address Translation Only consulted when new connection established Chains: PREROUTING, OUTPUT, POSTROUTING Mangle: Alters packets Ex: Transparent web proxy Chains: PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING Raw: Highest priority table Rarely used. Chains: PREROUTING, OUTPUT 12

13 IPTables Outgoing Packet Incoming Packet Send to HW Output Prerouting Output Postrouting Prerouting Output Output Routing Deliver to Process Postrouting Forward Forward Input Dest= Remote Prerouting Routing Dest=Local Input Kernel Code Filter NAT Mangle Raw 13

14 Rules of Thumb NAT chains only traversed on initial packet of connection Future packets disposed of in same way as 1 st packet For basic filtering (i.e., protecting local machine): Exclusively uses Filter table Rules in Input chain: Protect local box Rules in Forward chain: If this is firewall, used to protect network Output chain usually empty 14

15 IPTables Basic actions Flush: empty a chain: iptables -F INPUT Append a rule: iptables -A INPUT...rule... Insert a rule: iptables -I INPUT index...rule... Delete a rule: iptables -D INPUT index Set policy: iptables -P INPUT policy Policy is ACCEPT or DROP (but not REJECT) List rules: iptables --list [--verbose] Create a new chain: iptables -N name Delete a chain: iptables -X name 15

16 TCP/UDP Layer Suppose we are running a web server. No one should be able to access any other services: iptables -F INPUT iptables -P INPUT DROP iptables -A INPUT -p tcp --dport 80 -j ACCEPT "Default Deny" policy: if it's not port 80, reject This is more secure than default allow Default allow: Allow everything except what you explicitly reject If you forget to block something...can be problems! 16

17 More Specifics Complex protocols: DNS Send UDP packet asking for IP address Need to allow response packet in First attempt: iptables -A INPUT -m udp -p udp --sport 53 -j ACCEPT Always allows packets from UDP source port 53 into network Attackers began sending attack probes from port 53 Countermeasure: Connection Tracking 17

18 Connection Tracking Kernel has table Knows packets it's sent and state associated with them State = (remote ip, port) pair Can request it only pass packet if part of active conversation Revised rule iptables -A INPUT -m state state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --dport http -j ACCEPT iptables -A INPUT -j REJECT Allows any packet part of ongoing conversation OR web server on local machine 18

19 Firewall Box Interwebs eth eth1 eth Web DNS

20 Example Protect the firewall machine: iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -s /16 -m tcp -p tcp --dport 22 -i eth1 -j ACCEPT iptables -P INPUT DROP Allow all internal machines to send outgoing traffic: iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth1 -j ACCEPT Allow the outside world to get to our dns and web servers but nothing else iptables -A FORWARD -i eth0 -d m tcp -p tcp --dport 80 -j ACCEPT iptables -A FORWARD -i eth0 -d m udp -p udp --dport 53 -j ACCEPT iptables -P FORWARD DROP Suppose we want to prevent use of WoW by local users: iptables -I FORWARD 1 -i eth1 -m tcp -p tcp --dport j REJECT 20

21 Recent -m recent Options: --name: Specify a list name --set: Add IP address to list --rcheck: Check if address in list --remove: Remove IP from list --update: If address in list, set "last-seen" timestamp --seconds amount: For rcheck and update: Only match if last-seen timestamp is < amount seconds in the past --hitcount amount: Only match if amount hits occurred 21

22 Example Prevent brute force password attacks: iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --name ssh-list --set For every packet initiating an ssh connection: add to the ssh-list list. No -j, so nothing happens to packet yet iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --name ssh-list --update --seconds hitcount 5 -j REJECT If more than 5 TCP SYN packets from source in last five minutes: Start rejecting packets Continue rejecting until 5 minutes of "quiet time" Then reallow host 22

23 Port Knocking Can use for port knocking. Ex: to access port 22: requires a knock at 1000, 3000, 2000 in that order. Then you have a 1 minute window to start connection with ssh port 23

24 Port Knocking Simple knock: port 1000, then 10 sec window to ssh in: iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --dport m state --state NEW -m recent --name thousand --set -j DROP iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name thousand --rcheck --seconds 10 -j ACCEPT iptables -P INPUT DROP 24

25 Port Knocking More complex: Must send packet to port 1000 then 2000: iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --dport m state --state NEW -m recent --name thousand --set -j DROP iptables -N ListTwo iptables -A INPUT -p tcp --dport m state --state NEW -m recent --name thousand --rcheck --seconds 10 -j ListTwo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name twothousand --rcheck --seconds 10 -j ACCEPT iptables -P INPUT DROP iptables -A ListTwo -m recent --name twothousand --set -j DROP 25

26 Port Knocking Must knock 1000, then 2000, then 3000: iptables -N ListTwo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -N ListThree iptables -A INPUT -p tcp --dport m state --state NEW -m recent --name thousand --set -j DROP iptables -A INPUT -p tcp --dport m state --state NEW -m recent --name thousand --rcheck --seconds 10 -j ListTwo iptables -A INPUT -p tcp --dport m state --state NEW -m recent --name twothousand --rcheck --seconds 10 -j ListThree iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent-- name threethousand --rcheck --seconds 10 -j ACCEPT iptables -A INPUT -j DROP iptables -A ListTwo -m recent --name twothousand --set -j DROP iptables -A ListThree -m recent --name threethousand --set -j DROP 26