Unix security refers to the means of
securing a
Unix
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, and ot ...
or
Unix-like
A Unix-like (sometimes referred to as UN*X or *nix) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Unix-li ...
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
. A secure environment is achieved not only by the design concepts of these operating systems, but also through vigilant
user
Ancient Egyptian roles
* User (ancient Egyptian official), an ancient Egyptian nomarch (governor) of the Eighth Dynasty
* Useramen, an ancient Egyptian vizier also called "User"
Other uses
* User (computing), a person (or software) using an ...
and
administrative
Administration may refer to:
Management of organizations
* Management, the act of directing people towards accomplishing a goal
** Administrative Assistant, traditionally known as a Secretary, or also known as an administrative officer, administ ...
practices.
Design concepts
Permissions
A core security feature in these systems is the
file system permissions
Most file systems include attributes of files and directories that control the ability of users to read, change, navigate, and execute the contents of the file system. In some cases, menu options or functions may be made visible or hidden depending ...
. All files in a typical
Unix filesystem
In Unix and operating systems inspired by it, the file system is considered a central component of the operating system. It was also one of the first parts of the system to be designed and implemented by Ken Thompson in the first experimental ...
have permissions set enabling different access to a file.
Permissions on a file are commonly set using the
chmod
In Unix and Unix-like operating systems, is the command (computing), command and system call used to change the File-system permissions, access permissions and the #Special modes, special mode flags (the setuid, ''setuid'', ''setgid'', and stick ...
command and seen through the
ls command. For example:
-r-xr-xr-x 1 root wheel 745720 Sep 8 2002 /bin/sh
Unix permissions
Most file systems include attributes of files and directories that control the ability of users to read, change, navigate, and execute the contents of the file system. In some cases, menu options or functions may be made visible or hidden dependin ...
permit different users access to a file. Different ''user groups'' have different permissions on a file.
More advanced Unix filesystems include the ''Access Control List'' concept which allows permissions to be granted to multiple users or groups. An ''Access Control List'' may be used to grant permission to additional individual users or groups. For example:
/pvr
::rwx,g::r-x,o::r-x/u::rwx,u:sue:rwx,g::r-x,m::rwx,o::r-x
In this example, which is from the command on the
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
operating system, the user sue is granted ''write'' permission to the ''/pvr'' directory.
User groups
Users under Unix style operating systems often belong to managed groups with specific access permissions. This enables users to be grouped by the level of access they have to this system. Many Unix implementations add an additional layer of security by requiring that a user be a member of the ''
wheel
A wheel is a circular component that is intended to rotate on an axle Bearing (mechanical), bearing. The wheel is one of the key components of the wheel and axle which is one of the Simple machine, six simple machines. Wheels, in conjunction wi ...
''
user privileges group in order to access the
su
command.
Root access
![Sudo on Ubuntu](https://upload.wikimedia.org/wikipedia/commons/0/01/Sudo_on_Ubuntu.png)
Most Unix and Unix-like systems have an account or group which enables a user to exact complete control over the system, often known as a
root
In vascular plants, the roots are the organs of a plant that are modified to provide anchorage for the plant and take in water and nutrients into the plant body, which allows plants to grow taller and faster. They are most often below the sur ...
account. If access to this account is gained by an unwanted user, this results in a complete breach of the system. A root account however is necessary for administrative purposes, and for the above security reasons the root account is ''seldom'' used for day to day purposes (the
sudo
sudo ( or ) is a program for Unix-like computer operating systems that enables users to run programs with the security privileges of another user, by default the superuser. It originally stood for "superuser do", as that was all it did, and it i ...
program is more commonly used), so usage of the root account can be more closely monitored.
Root access "as it should be" can be visualised by those familiar with the
Superman
Superman is a superhero who appears in American comic books published by DC Comics. The character was created by writer Jerry Siegel and artist Joe Shuster, and debuted in the comic book ''Action Comics'' #1 (cover-dated June 1938 and publi ...
stories using the following
analogy
Analogy (from Greek ''analogia'', "proportion", from ''ana-'' "upon, according to" lso "against", "anew"+ ''logos'' "ratio" lso "word, speech, reckoning" is a cognitive process of transferring information or meaning from a particular subject ( ...
:
::Using a root account is rather like being Superman; an administrator's regular user is more like Clark Kent. Clark Kent becomes Superman for only as long as necessary, in order to save people. He then reverts to his "disguise". Root access should be used in the same fashion. The Clark Kent disguise doesn't really restrict him though, as he is still able to use his super powers. This is analogous to using the sudo program.
User and administrative techniques
Unix has many tools that can improve security if used properly by users and administrators.
Passwords
Selecting a strong
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
and guarding it properly are probably the most important things a user can do to improve Unix security.
In Unix systems, the essential information about users is stored under the file
/etc/passwd
This file keeps track of the users registered in the system and their main definitions. Passwords, or more correctly, the hash of the password, can also be stored in the same place. The entries in
/etc/passwd
occupy exactly one line each, and have the following form:
nickname:password_hash:UserID:GroupID:Complete_Name:home_dir:shell_bin
An example would be:
xfze:$$1zuW2nX3sslp3qJm9MYDdglEApAc36r/:1000:100:Daniel Ernesto Ortiz Costa:/home/xfze:/bin/bash
Since all users must have read access to the
/etc/passwd
file to do many common tasks (
ls -l /home
will use
/etc/passwd
to map UIDs to login names for example), anyone could also read the password hashes of other users. To solve this problem, the file
/etc/shadow
was created to store the password hashes, with only
root
In vascular plants, the roots are the organs of a plant that are modified to provide anchorage for the plant and take in water and nutrients into the plant body, which allows plants to grow taller and faster. They are most often below the sur ...
having read access. Under password shadowing, the 2nd field (
password hash
In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function (which typically uses a crypto ...
) is replaced by an 'x' which tells the system to retrieve the corresponding user's password via the
/etc/shadow
file.
The
/etc/shadow
file often only contains values for the first two fields:
xfze:$$1zuW2nX3sslp3qJm9MYDdglEApAc36r/:::::
The remaining fields in the
/etc/shadow
file include:
#The minimum number of days between password changes
#The maximum number of days until the password must be changed
#The number of days of warning given before the password must be changed
#The number of days after the password must be changed when the account becomes unusable
#The date (expressed as the number of days since
January 1st, 1970) when the account is expired
These fields may be used to improve Unix security by enforcing a password security policy.
Users and accounts
Administrators should delete old accounts promptly.
*
su,
sudo
sudo ( or ) is a program for Unix-like computer operating systems that enables users to run programs with the security privileges of another user, by default the superuser. It originally stood for "superuser do", as that was all it did, and it i ...
,
ssh
The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution.
SSH applications are based on a ...
only, no remote root logins
Software maintenance
Patching
Operating systems, like all software, may contain bugs in need of fixing or may be enhanced with the addition of new features. Patching the operating system in a secure manner requires that the software come from a trustworthy source and not have been altered since it was packaged. Common methods for verifying that operating system patches have not been altered include the use of the
digital signature
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very high confidence that the message was created b ...
of a
cryptographic hash
A cryptographic hash function (CHF) is a hash algorithm (a map of an arbitrary binary string to a binary string with fixed size of n bits) that has special properties desirable for cryptography:
* the probability of a particular n-bit output re ...
, such as a
SHA-256
SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compression ...
based checksum, or the use of read-only media.
From a security standpoint, the specific packaging method, such as the
dpkg package manager or the
RPM Package Manager
RPM Package Manager (RPM) (originally Red Hat Package Manager, now a recursive acronym) is a free and open-source package management system. The name RPM refers to the file format and the package manager program itself. RPM was intended primaril ...
format originally from
Debian
Debian (), also known as Debian GNU/Linux, is a Linux distribution composed of free and open-source software, developed by the community-supported Debian Project, which was established by Ian Murdock on August 16, 1993. The first version of D ...
and
Red Hat Linux
Red Hat Linux was a widely used Commercial software, commercial Open-source software, open-source Linux distribution created by Red Hat until its discontinuation in 2004.
Early releases of Red Hat Linux were called Red Hat Commercial Linux. R ...
, respectively is not as important as the use of features which ensure the integrity of the patch itself.
Source distributions
Source distributions include the ability to examine the code for suspicious content. The drawback, absent an accompanying cryptographic hash value, is that the user must be able to perform a security analysis of the code themselves.
RPM packages
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
distributions which use the
RPM Package Manager
RPM Package Manager (RPM) (originally Red Hat Package Manager, now a recursive acronym) is a free and open-source package management system. The name RPM refers to the file format and the package manager program itself. RPM was intended primaril ...
format for providing base functionality and software updates make use of
cryptographic hash
A cryptographic hash function (CHF) is a hash algorithm (a map of an arbitrary binary string to a binary string with fixed size of n bits) that has special properties desirable for cryptography:
* the probability of a particular n-bit output re ...
es and
GPG to ensure content integrity. The hash values are packaged with the RPM file and verified when the package is installed.
Debian packages
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
distributions which use the
Debian
Debian (), also known as Debian GNU/Linux, is a Linux distribution composed of free and open-source software, developed by the community-supported Debian Project, which was established by Ian Murdock on August 16, 1993. The first version of D ...
.deb package format for providing base functionality and software updates make use of
GPG signatures to ensure content integrity. A signature is computed when the package is constructed and verified later when the package is installed.
Other vendors and distributions
Regardless of the vendor or distribution, all software distributions should provide a mechanism for verifying that the software is legitimate and has not been modified since it was originally packaged.
Services
Unnecessary system software should not be installed or configured on a system. Software which is no longer required should be removed completely, if possible.
*Identify what services are running
**
**
**
** (
FreeBSD
FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...
)
The commands
inetd
inetd (internet service daemon) is a super-server daemon on many Unix systems that provides Internet services. For each configured service, it listens for requests from connecting clients. Requests are served by spawning a process which runs the ...
and
xinetd
In computer networking, xinetd (''Extended Internet Service Daemon'') is an open-source super-server daemon which runs on many Unix-like systems, and manages Internet-based connectivity.
It offers a more secure alternative to the older inetd ( ...
act as super-servers for a variety of network protocols such as
rlogin
The Berkeley r-commands are a suite of computer programs designed to enable users of one Unix system to log in or issue commands to another Unix computer via TCP/IP computer network. The r-commands were developed in 1982 by the Computer Systems ...
,
telnet
Telnet is an application protocol used on the Internet or local area network to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. User data is interspersed in-band with Telnet control i ...
and
ftp
The File Transfer Protocol (FTP) is a standard communication protocol used for the transfer of computer files from a server to a client on a computer network. FTP is built on a client–server model architecture using separate control and data ...
.
Turning off unnecessary services
*using ''update-rc.d'' on
Debian
Debian (), also known as Debian GNU/Linux, is a Linux distribution composed of free and open-source software, developed by the community-supported Debian Project, which was established by Ian Murdock on August 16, 1993. The first version of D ...
*using ''chkconfig'' on
Red Hat Linux
Red Hat Linux was a widely used Commercial software, commercial Open-source software, open-source Linux distribution created by Red Hat until its discontinuation in 2004.
Early releases of Red Hat Linux were called Red Hat Commercial Linux. R ...
*using ''/etc/rc.conf'' and ''/usr/local/etc/rc.d'' on FreeBSD (mention /etc/rc.local)
*using ''rc-update'' on
Gentoo Linux
Gentoo Linux (pronounced ) is a Linux distribution built using the Portage package management system. Unlike a binary software distribution, the source code is compiled locally according to the user's preferences and is often optimized for the ...
This approach is usually called ''proactive security''. There are some operating systems which are ''secure by default''. Amongst others, the free BSD flavours (
FreeBSD
FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...
,
NetBSD
NetBSD is a free and open-source Unix operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was forked. It continues to be actively developed and is a ...
, and
OpenBSD
OpenBSD is a security-focused, free and open-source, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. According to the website, the OpenBSD project em ...
) are proactively secure. For example, the output of netstat on a NetBSD 3.0 workstation clearly outlines this technique:
$ netstat -a
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost.smtp *.* LISTEN
tcp 0 0 *.ssh *.* LISTEN
Active Internet6 connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp6 0 0 localhost.smtp *.* LISTEN
tcp6 0 0 *.ssh *.* LISTEN
Active UNIX domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
c0d10d80 dgram 0 0 0 c0cd8680 0 c0cb7000 -> /var/run/log
c0cb7000 dgram 0 0 0 c0cd8680 0 0 -> /var/run/log
c0cd8680 dgram 0 0 cb9639e8 0 c0d10d80 0 /var/run/log
The following example from a BSD system
$ sockstat -4
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root sendmail 569 4 tcp localhost.smtp *.*
root sshd 593 4 tcp *.ssh *.*
shows that on this machine only the
SSH
The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution.
SSH applications are based on a ...
service is listening to all public network interfaces of the computer.
sendmail
Sendmail is a general purpose internetwork email routing facility that supports many kinds of mail-transfer and delivery methods, including the Simple Mail Transfer Protocol (SMTP) used for email transport over the Internet.
A descendant of the ...
is listening to the
loopback
Loopback (also written loop-back) is the routing of electronic signals or digital data streams back to their source without intentional processing or modification. It is primarily a means of testing the communications infrastructure.
There are m ...
interface
Interface or interfacing may refer to:
Academic journals
* ''Interface'' (journal), by the Electrochemical Society
* ''Interface, Journal of Applied Linguistics'', now merged with ''ITL International Journal of Applied Linguistics''
* '' Inte ...
only. Access to a service may be further restricted by using a
firewall
Firewall may refer to:
* Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts
* Firewall (construction), a barrier inside a building, designed to limit the spre ...
.
File systems
File system security
File system security within
UNIX
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, and ot ...
and
Unix-like
A Unix-like (sometimes referred to as UN*X or *nix) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Unix-li ...
systems is based on 9 permission bits, set user and group ID bits, and the
sticky bit
In computing, the sticky bit is a user ownership File system permissions, access right Flag (computing), flag that can be assigned to Computer file, files and Directory (computing), directories on Unix-like systems.
There are two definitions: one ...
, for a total of 12 bits. These permissions apply almost equally to all filesystem objects such as files, directories and devices.
The 9 permission bits are divided into three groups of three bits each. The first group describes the permissions of the file owner, the second group describes the permissions of the
GID assigned to the file, which by default is the group associated with the file owner or the directory containing the file when it is ''
set-GID'', and the third group describes the permissions associated with any process which does not have the same user ID as the file. Each group of three bits contains a bit indicating the read, write or execute access is granted. In the case of directories, execute access is interpreted as the permission to perform a filename lookup within the directory.
The set user ID and set group ID bits, commonly abbreviated ''set-UID'' and ''set-GID'' respectively, are used to change the identity of the process which executes a file having either or both of those bits set. A file having the ''
set-UID'' permission bit set will cause a process which executes that file to temporarily switch the effective user ID to that of the file owner. A file having the ''
set-GID'' permission bit set will cause a process which executes that file to temporarily switch the effective group ID to that of the file group. A process may then alternate between the effective user or group ID which it inherited from the file and the real user or group ID which it inherited when the user logged on to the system. This provides a mechanism by which a process may limit the access rights it possesses to those code regions which require those access rights. This is a form of a security technique known as
privilege separation
In computer programming and computer security, privilege separation is one software-based technique for implementing the principle of least privilege. With privilege separation, a program is divided into parts which are limited to the specific pri ...
and improves program security by limiting the unintended or undesirable actions of a processes.
A directory having the ''set-GID'' permission bit set will cause a newly created file to have an initial file group value equal to the file group of the directory. This provides a mechanism whereby a subsystem, such as the system's mail subsystem, can create files which have a common file group value so that ''set-GID'' processes within that subsystem are then able to read or write the file.
The ''sticky bit'', formally known as the ''save text on swap'' bit, derives its name from its original purpose. Originally the ''sticky bit'' caused a process's initial memory image to be stored as a contiguous image on the disk drive which was used to store real memory pages when they were not in use. This improved the performance of commonly executed commands by making the initial memory image readily available. Modern UNIX systems no longer perform that function when the bit is set, but the name has been preserved nonetheless. In the case of files, the ''sticky-bit'' may be used by the system to indicate the style of
file locking
File locking is a mechanism that restricts access to a computer file, or to a region of a file, by allowing only one user or process to modify or delete it at a specific time and to prevent reading of the file while it's being modified or deleted ...
to be performed. In the case of directories, the ''sticky bit'' prevents any process, other than one which has super-user privileges or one having an effective user ID of the file owner, from deleting a file within that directory. The ''sticky bit'' is most commonly used on publicly writable directories, such as the various temporary working space directories on the system.
Root squash
Root squash
is a special mapping of the remote
superuser
In computing, the superuser is a special user account used for system administration. Depending on the operating system (OS), the actual name of this account might be root, administrator, admin or supervisor. In some cases, the actual name of t ...
(root) identity when using
identity authentication
Identity may refer to:
* Identity document
* Identity (philosophy)
* Identity (social science)
* Identity (mathematics)
Arts and entertainment Film and television
* ''Identity'' (1987 film), an Iranian film
* ''Identity'' (2003 film), an ...
(local user is the same as remote user). Under root squash, a client's uid 0 (root) is mapped to 65534 (nobody). It is primarily a feature of
NFS but may be available on other systems as well.
Root squash is a technique to avoid privilege escalation on the client machine via suid executables
Setuid
The Unix
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Rit ...
. Without root squash, an attacker can generate suid binaries on the server that are executed as root on other client, even if the client user does not have superuser privileges. Hence it protects client machines against other malicious clients. It does not protect clients against a malicious server (where root can generate suid binaries), nor does it protect the files of any user other than root (as malicious clients can impersonate any user).
SELinux
SELinux
Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies, including mandatory access controls (MAC).
SELinux is a set of kernel modifications and user-space t ...
is the set of kernel extensions to control access more precisely, strictly defining both if and how files, folders, network ports and other resources can be accessed by the confined process. This system is mostly used to restrict processes (database, server) rather than human users. It can also limit processes that run as root. Other distributions use comparable alternatives like
AppArmor
AppArmor ("Application Armor") is a Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the ...
.
Viruses and virus scanners
Unix-like operating systems are immune to most Microsoft Windows viruses because binaries created to run on Windows generally won't run on other platforms. However, many Unix like installations provide file storage services to Microsoft Windows clients, such as through the use of
Samba software
Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Wi ...
, and may unintentionally become a repository for viruses stored by users. It is common for Unix servers to act as
mail transfer agent
The mail or post is a system for physically transporting postcards, letters, and parcels. A postal service can be private or public, though many governments place restrictions on private systems. Since the mid-19th century, national postal syst ...
s and as a consequence email virus scanning is often installed. The
ClamAV
Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, ...
virus scanner is available in source code form and may be used to scan Unix file systems for viruses which infect other operating systems.
There are viruses and worms that target Unix-like operating systems. In fact, the first computer worm—the
Morris worm—targeted Unix systems.
Firewalls
Network firewall
In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted ne ...
protects systems and networks from network threats which exist on the opposite side of the firewall. Firewalls can block access to strictly internal services, unwanted users and in some cases filter network traffic by content.
iptables
iptables
iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules. The filters are organized in different tables, which ...
is the current user interface for interacting with
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
kernel
netfilter
Netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers. Netfilter offers various functions and operations for packet filtering, network addre ...
functionality. It replaced
ipchains
Linux IP Firewalling Chains, normally called ipchains, is free software to control the packet filter or firewall capabilities in the 2.2 series of Linux kernels. It superseded ipfirewall (managed by ipfwadm command), but was replaced by iptables ...
. Other
Unix
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, and ot ...
like operating systems may provide their own native functionality and other
open source
Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...
firewall products exist. More detailed information about iptables is contained elsewhere. A brief discussion is contained here in order to describe how iptables may be used to configure a Linux firewall.
netfilter
Netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers. Netfilter offers various functions and operations for packet filtering, network addre ...
provides a state-full packet filter which can be configured according to
network interface,
protocol
Protocol may refer to:
Sociology and politics
* Protocol (politics), a formal agreement between nation states
* Protocol (diplomacy), the etiquette of diplomacy and affairs of state
* Etiquette, a code of personal behavior
Science and technology
...
,
source and/or destination address,
source and/or destination port and the state of the packet. A network packet traverses several ''chains'' between the time it is received by a network interface and the time it is accepted by the host or forwarded to another host. The common chains are , and . The ''chain'' is traversed for all packets as they are received by a network interface, regardless of whether they are to be accepted by the host or forwarded to another host. The ''chain'' is traversed for all packets as they are transmitted by a network interface. The chain is traversed for those packets are being routed through the host from one network interface to another, such as is the case for a multi-homed system (a system with more than one physical network interface).
Each of the built-in chains has a default ''policy'' which defines what action is taken for a packet which reaches the end of the chain. Packet traversal ends when a ''rule'' matches the packet and has an action of , , or .
The simplest
iptables
iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules. The filters are organized in different tables, which ...
firewall consists of ''rules'' for each desired service, followed by a rule which indicates that any packets which reach this rule are dropped. A system which only permitted, for example, incoming email traffic would have a rule which accepted connections on the
SMTP
The Simple Mail Transfer Protocol (SMTP) is an Internet standard communication protocol for electronic mail transmission. Mail servers and other message transfer agents use SMTP to send and receive mail messages. User-level email clients typical ...
port, and then dropped others. A rule would be required which indicated that all established connections were also permitted so that outgoing connections would receive responses from other systems.
INPUT chain
The following example shows a simple packet filter for the chain for the above described example:
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all—any any anywhere anywhere state ESTABLISHED
0 0 ACCEPT tcp—any any anywhere anywhere tcp dpt:smtp
0 0 LOG all—any any anywhere anywhere LOG level warning
0 0 DROP all—any any anywhere anywhere
The addition of an explicit action ensures that the packets are discarded should the default policy of the chain accidentally be changed to .
OUTPUT chain
There is less need for an chain and the default ''policy'' of the chain can safely be set to . In some instances it may be desirable for a firewall to limit certain outgoing connections to a certain set of approved systems. This is known as
egress filtering
In computer networking, egress filtering is the practice of monitoring and potentially restricting the flow of information outbound from one network to another. Typically, it is information from a private TCP/IP computer network to the Internet tha ...
and may be used to prevent viruses within the firewall from escaping to other systems. For example, it may be the policy of a network to limit outgoing email connections to a single authorized email servers as a way of combating
e-mail spam
Email spam, also referred to as junk email, spam mail, or simply spam, is unsolicited messages sent in bulk by email (spamming).
The name comes from a Monty Python sketch in which the name of the canned pork product Spam is ubiquitous, unavoida ...
. This could be achieved by the following example:
Chain OUTPUT (policy ACCEPT)
pkts bytes target prot opt in out source destination
0 0 DROP tcp—any any !server anywhere tcp dpt:smtp
There is no need to include any other rules in this example as the default policy for the chain is . This rule assumes that the host which is acting as the firewall will not be sending email itself, such as to the email server. This is a good assumption as typically a firewall system contains the minimal amount of system code needed to act as a firewall.
A more restrictive chain would contain permissive () entries for those services which may be accessed outside the firewall and then a restrictive () policy for the chain itself.
General
Secure network communication:
*Layer 7:
*Layers 4,5:
*Layer 3:
*Layer 2:
PPTP
The Point-to-Point Tunneling Protocol (PPTP) is an obsolete method for implementing virtual private networks. PPTP has many well known security issues.
PPTP uses a TCP control channel and a Generic Routing Encapsulation tunnel to encapsulate PP ...
Packet sniffing:
*
tcpdump
tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. Distribut ...
,
Wireshark
Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, the project was renamed Wireshark in May 2006 d ...
Attacks:
*
Man in the middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
*
LAND
Land, also known as dry land, ground, or earth, is the solid terrestrial surface of the planet Earth that is not submerged by the ocean or other bodies of water. It makes up 29% of Earth's surface and includes the continents and various islan ...
,
ping of death
A ping of death is a type of attack on a computer system that involves sending a malformed or otherwise malicious ping to a computer.
A correctly formed ping packet is typically 56 bytes in size, or 64 bytes when the Internet Control ...
,
Christmas tree packet
In information technology, a Christmas tree packet is a packet with every single option set for whatever protocol is in use.
Background
The term derives from a fanciful image of each little option bit in a header being represented by a differen ...
,
Denial of service
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connect ...
et al.
*Software tools based password/passphrase/key stealing attacks on the system. Such as strace/truss/tusc/dtrace/SystemTap based ones.
Advanced
*
rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...
s, kernel modules, chkrootkit
*exploit details,
buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memory ...
s, local vs remote
Service details
*banners
*
SMTP
The Simple Mail Transfer Protocol (SMTP) is an Internet standard communication protocol for electronic mail transmission. Mail servers and other message transfer agents use SMTP to send and receive mail messages. User-level email clients typical ...
-
spam
Spam may refer to:
* Spam (food), a canned pork meat product
* Spamming, unsolicited or undesired electronic messages
** Email spam, unsolicited, undesired, or illegal email messages
** Messaging spam, spam targeting users of instant messaging ( ...
*
Sendmail
Sendmail is a general purpose internetwork email routing facility that supports many kinds of mail-transfer and delivery methods, including the Simple Mail Transfer Protocol (SMTP) used for email transport over the Internet.
A descendant of the ...
- banners help header version etc.
*
Domain Name System
The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...
- reverse mapping dnssec
References
General
* ''Practical UNIX and Internet Security,'' Simson Garfinkel and Gene Spafford, O'Reilly & Associates, 2003.
External links
''The Unix Security Model for web server administration'' Robert K. Moniot 2000
Robert B. Reinhardt 1993
{{Unix
Operating system security
System administration
Unix
Linux administration
Linux security software