Staying protected on the Internet

Posted on 2004-04-10
Medium Priority
Last Modified: 2007-12-19
Hi all,

I'm still new to linux. I'm using Fedora and want to access the internet.
With Windows it's easy to keep protected using firewall and antivirus software, but with Linux it seems FAR more complicated. How do I setup my system to make sure no-one can hack into my computer? I don't want anyone to be snooping around my data files without me knowing about it. But at the moment I don't know enough about security to stop them. Any help appreciated.

Question by:Freerider

Expert Comment

ID: 10797671
Get gshield, http://muse.linuxmafia.org/gshield/ 

Bob Gunzel
LVL 40

Expert Comment

ID: 10798060
Unless you specifically disabled it, Fedora would have installed a default local firewall that allows you to access Internet resources, but prevents an Internet host from accessing anything on your system. So in that respect it is far less complicated. Probably the most important issue with a Linux system is religiously keep it up to date w/respect to security updates as soon as they are released. It's been a long time since there was an active exploit for a Linux box that the fix wasn't available at least a month before the exploit surfaced.  For example the security fix for the Slapper worm as available from all Linux vendors over a month before the exploit surfaced, but still something in excess of 20,000 systems were compromised by Slapper.

And, you can't neglect internal security. Right now Stanford is fighting a problem where user names/passwords have been captured, used to log in to Linux an Solaris systems, and local elevation of privlege exploits are being used to crack the systems "from the inside". Obviously, if those systems were completely up to date, such an attack wouldn't be possible. There's a tendancy to overly trust a firewall and neglect updates on machines behind the firewall, or allow machines behind a firewall to use insecure protocols, like telnet, FTP, rlogin, etc.

Author Comment

ID: 10798221
Thanks both.

I downloaded and started reading the documentation for gShield. It says at the start "gShield requires iptables in order to work it's magic." I noticed at bootup I get an "OK" after the configuration of iptables. Does this mean the "default local firewall" has been configured? How do I make sure?

Also jlevie, something I have wondered about for some time concerns the open source idea where almost anyone can improve the Linux kernel. What is there to stop anyone writing some kind of virus which could be mistaken as an "upgrade"?

WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

LVL 40

Expert Comment

ID: 10798401
It is easy enough to cehck to see it the default firewall is running and has a restrictive rule set by executing 'iptables -L'. An empty rule set would show:

wilowisp> sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

and an active firewall would look very different, e.g.:

praetorian> sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
tcpflags   tcp  --  anywhere             anywhere           tcp flags:SYN,RST/SYN,RST
tcpflags   tcp  --  anywhere             anywhere           tcp flags:FIN,SYN/FIN,SYN
ACCEPT     icmp --  anywhere             anywhere           icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere           icmp destination-unreachable

Well, OpenSource doesn't work exactly that way. While anyone can contribute a patch or feature for consideration to, say the kernel, there's an extensive code review that goes on before that contribution makes it into the release version. So it is highly unlikely that malicious code could wind up in something critical like the kernel. And in the case of something sponsored or provided by a commercial Linux vendor RedHat's Fedora, RHEL, Mandrake, SuSE, etc., the Linux vendor also conducts code audits and runs test suites against anything they distribute.
LVL 17

Expert Comment

ID: 10798688
You can get the bastille rpm for fedora here -

This is a set of scripts which will interactively guide you through securing your pc. Installation instructions -

    * install the Bastille RPM, like this:

        rpm -ivh Bastille-2.1.1-1.0.i386.rpm

    * Install perl-Tk (for our GUI) or perl-Curses (for console/text mode).
      Get the right one by consulting this table.

        rpm -ivh perl-Tk-a.b-c.i386.rpm
        rpm -ivh perl-Curses-d.e-f.i386.rpm

      Note: you can also install perl-Tk/perl-Curses via CPAN, if you know how. On Red Hat 8.0, this is definitely the easiest way to get perl-Tk (GUI) right now.

Type: "bastille" to start the full custom hardening script.

Don't forget: Reboot the machine when you're done!

Accepted Solution

bobgunzel earned 400 total points
ID: 10801912
If all you want do do is access the internet from a stand-alone machine that doesn't run any services like the Apache web server, Nat and so on, you're probable safe enough. If you want to check, go to http://grc.com/default.htm and choose the ShieldsUP! link.
I'm not familiar with the Fedora start-up scripts. Usually they are to be found in /etc/rc.d.
In several distributions it suffices to create a link named rc.firewall to /etc/firewall/gShield.rc, in others you'll have to start it up by editing rc.local.
You can also run the script manually by typing /etc/firewall/gShield.rc from the shell prompt, which is maybe the safe way to do in case the firewall is misconfigured at first. Running the script manually means it won't be loaded automatically at reboot.

Bob Gunzel

Featured Post

WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Fine Tune your automatic Updates for Ubuntu / Debian
If you are looking for an automated solution for backup single or multiple Office 365 user mailboxes to Outlook data file, then you can use Kernel Office 365 Backup & Restore tool. Go through the video to check out the steps to backup single or mult…
Watch the video to learn how one can deal with PST file corruption issue with an outstanding Kernel for Outlook PST Repair Tool easily. Using this tool, non-technical users can swiftly perform the repair process to restore their essential data witho…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question