Solved

Staying protected on the Internet

Posted on 2004-04-10
6
251 Views
Last Modified: 2007-12-19
Hi all,

I'm still new to linux. I'm using Fedora and want to access the internet.
With Windows it's easy to keep protected using firewall and antivirus software, but with Linux it seems FAR more complicated. How do I setup my system to make sure no-one can hack into my computer? I don't want anyone to be snooping around my data files without me knowing about it. But at the moment I don't know enough about security to stop them. Any help appreciated.

Thanks,
Freerider.
0
Comment
Question by:Freerider
6 Comments
 
LVL 4

Expert Comment

by:bobgunzel
ID: 10797671
Get gshield, http://muse.linuxmafia.org/gshield/

Bob Gunzel
0
 
LVL 40

Expert Comment

by:jlevie
ID: 10798060
Unless you specifically disabled it, Fedora would have installed a default local firewall that allows you to access Internet resources, but prevents an Internet host from accessing anything on your system. So in that respect it is far less complicated. Probably the most important issue with a Linux system is religiously keep it up to date w/respect to security updates as soon as they are released. It's been a long time since there was an active exploit for a Linux box that the fix wasn't available at least a month before the exploit surfaced.  For example the security fix for the Slapper worm as available from all Linux vendors over a month before the exploit surfaced, but still something in excess of 20,000 systems were compromised by Slapper.

And, you can't neglect internal security. Right now Stanford is fighting a problem where user names/passwords have been captured, used to log in to Linux an Solaris systems, and local elevation of privlege exploits are being used to crack the systems "from the inside". Obviously, if those systems were completely up to date, such an attack wouldn't be possible. There's a tendancy to overly trust a firewall and neglect updates on machines behind the firewall, or allow machines behind a firewall to use insecure protocols, like telnet, FTP, rlogin, etc.
0
 

Author Comment

by:Freerider
ID: 10798221
Thanks both.

I downloaded and started reading the documentation for gShield. It says at the start "gShield requires iptables in order to work it's magic." I noticed at bootup I get an "OK" after the configuration of iptables. Does this mean the "default local firewall" has been configured? How do I make sure?

Also jlevie, something I have wondered about for some time concerns the open source idea where almost anyone can improve the Linux kernel. What is there to stop anyone writing some kind of virus which could be mistaken as an "upgrade"?

Freerider.
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 40

Expert Comment

by:jlevie
ID: 10798401
It is easy enough to cehck to see it the default firewall is running and has a restrictive rule set by executing 'iptables -L'. An empty rule set would show:

wilowisp> sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

and an active firewall would look very different, e.g.:

praetorian> sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
tcpflags   tcp  --  anywhere             anywhere           tcp flags:SYN,RST/SYN,RST
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN/FIN,SYN
ACCEPT     icmp --  anywhere             anywhere           icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere           icmp destination-unreachable
...

Well, OpenSource doesn't work exactly that way. While anyone can contribute a patch or feature for consideration to, say the kernel, there's an extensive code review that goes on before that contribution makes it into the release version. So it is highly unlikely that malicious code could wind up in something critical like the kernel. And in the case of something sponsored or provided by a commercial Linux vendor RedHat's Fedora, RHEL, Mandrake, SuSE, etc., the Linux vendor also conducts code audits and runs test suites against anything they distribute.
0
 
LVL 17

Expert Comment

by:owensleftfoot
ID: 10798688
You can get the bastille rpm for fedora here -
http://download.atrpms.net/production/packages/fedora-1-i386/atrpms/bastille-linux-2.1.1-1.rhfc1.at.i386.rpm

This is a set of scripts which will interactively guide you through securing your pc. Installation instructions -

    * install the Bastille RPM, like this:

        rpm -ivh Bastille-2.1.1-1.0.i386.rpm

    * Install perl-Tk (for our GUI) or perl-Curses (for console/text mode).
      Get the right one by consulting this table.

        rpm -ivh perl-Tk-a.b-c.i386.rpm
or
        rpm -ivh perl-Curses-d.e-f.i386.rpm

      Note: you can also install perl-Tk/perl-Curses via CPAN, if you know how. On Red Hat 8.0, this is definitely the easiest way to get perl-Tk (GUI) right now.

Running
Type: "bastille" to start the full custom hardening script.

Don't forget: Reboot the machine when you're done!
0
 
LVL 4

Accepted Solution

by:
bobgunzel earned 100 total points
ID: 10801912
If all you want do do is access the internet from a stand-alone machine that doesn't run any services like the Apache web server, Nat and so on, you're probable safe enough. If you want to check, go to http://grc.com/default.htm and choose the ShieldsUP! link.
I'm not familiar with the Fedora start-up scripts. Usually they are to be found in /etc/rc.d.
In several distributions it suffices to create a link named rc.firewall to /etc/firewall/gShield.rc, in others you'll have to start it up by editing rc.local.
You can also run the script manually by typing /etc/firewall/gShield.rc from the shell prompt, which is maybe the safe way to do in case the firewall is misconfigured at first. Running the script manually means it won't be loaded automatically at reboot.

Bob Gunzel
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now