Staying protected on the Internet

Hi all,

I'm still new to linux. I'm using Fedora and want to access the internet.
With Windows it's easy to keep protected using firewall and antivirus software, but with Linux it seems FAR more complicated. How do I setup my system to make sure no-one can hack into my computer? I don't want anyone to be snooping around my data files without me knowing about it. But at the moment I don't know enough about security to stop them. Any help appreciated.

Thanks,
Freerider.
FreeriderAsked:
Who is Participating?
 
bobgunzelConnect With a Mentor Commented:
If all you want do do is access the internet from a stand-alone machine that doesn't run any services like the Apache web server, Nat and so on, you're probable safe enough. If you want to check, go to http://grc.com/default.htm and choose the ShieldsUP! link.
I'm not familiar with the Fedora start-up scripts. Usually they are to be found in /etc/rc.d.
In several distributions it suffices to create a link named rc.firewall to /etc/firewall/gShield.rc, in others you'll have to start it up by editing rc.local.
You can also run the script manually by typing /etc/firewall/gShield.rc from the shell prompt, which is maybe the safe way to do in case the firewall is misconfigured at first. Running the script manually means it won't be loaded automatically at reboot.

Bob Gunzel
0
 
bobgunzelCommented:
Get gshield, http://muse.linuxmafia.org/gshield/ 

Bob Gunzel
0
 
jlevieCommented:
Unless you specifically disabled it, Fedora would have installed a default local firewall that allows you to access Internet resources, but prevents an Internet host from accessing anything on your system. So in that respect it is far less complicated. Probably the most important issue with a Linux system is religiously keep it up to date w/respect to security updates as soon as they are released. It's been a long time since there was an active exploit for a Linux box that the fix wasn't available at least a month before the exploit surfaced.  For example the security fix for the Slapper worm as available from all Linux vendors over a month before the exploit surfaced, but still something in excess of 20,000 systems were compromised by Slapper.

And, you can't neglect internal security. Right now Stanford is fighting a problem where user names/passwords have been captured, used to log in to Linux an Solaris systems, and local elevation of privlege exploits are being used to crack the systems "from the inside". Obviously, if those systems were completely up to date, such an attack wouldn't be possible. There's a tendancy to overly trust a firewall and neglect updates on machines behind the firewall, or allow machines behind a firewall to use insecure protocols, like telnet, FTP, rlogin, etc.
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
FreeriderAuthor Commented:
Thanks both.

I downloaded and started reading the documentation for gShield. It says at the start "gShield requires iptables in order to work it's magic." I noticed at bootup I get an "OK" after the configuration of iptables. Does this mean the "default local firewall" has been configured? How do I make sure?

Also jlevie, something I have wondered about for some time concerns the open source idea where almost anyone can improve the Linux kernel. What is there to stop anyone writing some kind of virus which could be mistaken as an "upgrade"?

Freerider.
0
 
jlevieCommented:
It is easy enough to cehck to see it the default firewall is running and has a restrictive rule set by executing 'iptables -L'. An empty rule set would show:

wilowisp> sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

and an active firewall would look very different, e.g.:

praetorian> sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
tcpflags   tcp  --  anywhere             anywhere           tcp flags:SYN,RST/SYN,RST
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN/FIN,SYN
ACCEPT     icmp --  anywhere             anywhere           icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere           icmp destination-unreachable
...

Well, OpenSource doesn't work exactly that way. While anyone can contribute a patch or feature for consideration to, say the kernel, there's an extensive code review that goes on before that contribution makes it into the release version. So it is highly unlikely that malicious code could wind up in something critical like the kernel. And in the case of something sponsored or provided by a commercial Linux vendor RedHat's Fedora, RHEL, Mandrake, SuSE, etc., the Linux vendor also conducts code audits and runs test suites against anything they distribute.
0
 
owensleftfootCommented:
You can get the bastille rpm for fedora here -
http://download.atrpms.net/production/packages/fedora-1-i386/atrpms/bastille-linux-2.1.1-1.rhfc1.at.i386.rpm

This is a set of scripts which will interactively guide you through securing your pc. Installation instructions -

    * install the Bastille RPM, like this:

        rpm -ivh Bastille-2.1.1-1.0.i386.rpm

    * Install perl-Tk (for our GUI) or perl-Curses (for console/text mode).
      Get the right one by consulting this table.

        rpm -ivh perl-Tk-a.b-c.i386.rpm
or
        rpm -ivh perl-Curses-d.e-f.i386.rpm

      Note: you can also install perl-Tk/perl-Curses via CPAN, if you know how. On Red Hat 8.0, this is definitely the easiest way to get perl-Tk (GUI) right now.

Running
Type: "bastille" to start the full custom hardening script.

Don't forget: Reboot the machine when you're done!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.