Hardening TCP/IP stack in Linux

Protecting TCP/IP stack is a very challenging task in a culture where easy access to information prevails over security concerns. The key problem here is that the need for an efficient enterprise to provide relatively unfettered access to data, combined with the highly decentralized nature of operations, is irrevocably connected with the potential for serious security breaches. Maintaining and, especially, improvement of large enterprises IT security is a huge challenge and introduction of new OSes like Linux is only one relatively minor problem among many others.

We sing out the following critical issues :

1. That maturity of a OS platform from the security standpoint is highly dependent of the availability and quality of virtualization components

   Network infrastructure and server complexity in the large enterprises has increased so significantly that it has become a constraint on how flexible a business can be. Server consolidation based on virtual machine concept in a large enterprise environment is the necessity that no large enterprise can avoid. This movement already started in AIX space and Windows space (sometimes under VMware, which is this case can be reused for Linux virtualization purposes), but it will definitely accelerated in the future.
    

2. "security via obscurity" is a viable strategy.  

   Linux's growing popularity is attracting unwanted attention from virus writers, script kiddies  and criminal elements. In response, Linux advocates are putting a new emphasis on security measures and working to reassure large enterprises that the OS is secure for important enterprise applications.

   Using different compiler to make application less susseptable to off-the-shelf exploits is one promising avenue. Recompiling such component as sendmail is easy.

   Many exploits are complier dependent and the necessity to cover both gcc and Sun Studio 10 compliers significantly complicates the creation of working exploit.  For example Intel compiler is definitely recommended for compiling bind and Sendmail.  Obscurity understood here as using less popular  software platforms with some additional security features is a viable method to secure any complex operating environment and being off the most popular (and the most vulnerable) applications is always a plus.  
    

3. It's very important to distinguish between security of the Linux itself (OS platform) and security of major open source applications (like Apache, Bind, Perl, PHP, Postgress, Sendmail, etc).  Most vulnerabilities that are sited as Linux vulnerabilities actually are the vulnerabilities of the applications that are deployed on Linux.
4. Open Source software are ideal for quick prototyping and can help to avoid costly deployment mistakes that often happen with proprietary products.  For this particular purpose Linux has an upper hand as most applications were tested on Linux and work "out of the box" in a Linux environment; the current Linux distributions can be installed on typical corporate PCs without problems.  The role of Linux as a antidote to red-tape should not be underestimated in a large corporate environment. Many prototypes on Linux can be created using regular workstations instead of servers with zero or minimal (the cost of additional memory) acquisition costs.   Often early prototyping can prove that open source solution are more economical than proprietary closed solutions  or can deliver at least 80% of functionality for, say, 20% of costs and thus can substantially lower software acquisition costs. In case the decision is make to go with the proprietary vendor experience gained with the open source prototype provides a much more realistic estimate of deployment costs than any other method as well as dramatically improves negotiating power in talks with the vendor and help to avoid costly mistakes.

IPv6

• On by default
• There are daemons that are IPv6 aware: sshd, apache, bind, xinetd, etc
• Ip6tables has to be specifically setup
• Could have service unexpectedly open to attack

Detection

• ifconfig | grep inet6
• inet6 addr: fe80::21d:7eff:fe00:af5d/64 Scope:Link
• inet6 addr: ::1/128 Scope:Host

• Create a file /etc/modprobe.d/ipv6
• Add this line inside: install ipv6 /bin/true

Zeroconf

• On by default
• Used by avahi for local service discovery
• Requires a hole in firewall to allow access
• Advertises services to others

route | grep link-local

link-local

*

255.255.0.0 U 0

0

0 eth2

Disabling

Edit /etc/sysconfig/network

Add NOZEROCONF=yes

Then remove the avahi package and its dependencies

Review Listening Daemons

• Default install is tuned for general use
• Probably a few things that are unnecessary

Detection

netstat -tanp | grep LISTEN

Typical output:

[root ]# netstat -tanp | grep LISTEN

tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN 2256/nasd

tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 2166/mysqld

tcp 0 0 127.0.0.1:4690 0.0.0.0:* LISTEN 2376/prelude-manage

tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2057/cupsd

tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2244/master

tcp 0 0 :::22 :::* LISTEN 2068/sshd

Disabling Listening Daemons

Locate the pid in the netstat command

cat /proc/<pid>/cmdline

If not full path, run which or locate to find utility

rpm -qf full-path-of-daemon

rpm -e package

If difficult to remove due to dependencies:

chkconfig <service> off

/etc/sysctl.conf settings

# Don't reply to broadcasts. Prevents joining a smurf attack

net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable protection for bad icmp error messages

net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable syncookies for SYN flood attack protection

net.ipv4.tcp_syncookies = 1

# Log spoofed, source routed, and redirect packets

net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.default.log_martians = 1

# Don't allow source routed packets

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.default.accept_source_route = 0

# Turn on reverse path filtering

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

# Don't allow outsiders to alter the routing tables

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.default.secure_redirects = 0

# Don't pass traffic between networks or act as a router

net.ipv4.ip_forward = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

Iptables

• Default should be pretty good
• To see rules: service iptables status
• Use a GUI tool if not familiar with iptables rule syntax
• Use nmap from another machine to check  effectiveness

tcp_wrappers

• Even if iptables is in use, configure this just in case
• Set /etc/hosts.deny to ALL: ALL
• Many daemons compiled with support
• Find by using: egrep libwrap /usr/bin/* /usr/sbin/* | sort
• For each program found, use its base name to set
• expected access rights (if there are any)

Example:

smbd: 192.168.1.

Unused Daemon Removal

Remove all daemons (and packages) not being used

This reduces attack footprint and improves performance

Many daemons listen on the network and could be accessible

Viewing

chkconfig –list

Disabling

rpm -qf /etc/rc.d/init.d/name 
rpm -e package-name

chkconfig <service> off

Leave cpuspeed for speedshifting cpu and irqbalance for multicore

CPU

Disable readahead, mcstransd, firstboot, (and NetworkManager for machines without wireless networking) since they are not needed.

System Time

• Keep system time in sync
• You may need to correlate the time of disparate events
• across several machines to determine a chain of events
• Near impossible without common time base
• Use ntp in cron job
• Create a file /etc/cron.daily/ntpdate containing the following crontab:

#!/bin/sh
/usr/sbin/ntpdate ntp-server

• where ntp-server is the hostname or IP address of the site NTP server

At & cron

Only allow root and people with verified need to run cron jobs

Setup cron.allow and cron.deny

Setup equivalents if you have 'at' installed

Sshd

• Enable only ssh2 protocol (this is default in RHEL5)
• If multi-homed, consider if it needs to listen on all addresses or just one
• Do not allow root logins
• Consider adding group permission for logins, AllowGroups wheel

MySQL

• If database is used internally to machine, make it listen on localhost

Bind

• Use chroot package
• Use ACLs
• Consider who the DNS server is used for (internal/external) and
• only serve DNS for those. Do not do both in one server instance.
• Do not allow zone transfers
• Do not do recursion

Apache

• Remove all unneeded modules
• Use mod_security to weed out injection attacks
• Set correct SE Linux Booleans to maintain functionality and protection

• Hide Apache Information

  You should hide apache banner information from being displayed so the attackers are not aware of what version of Apache version you are running and thus making it more difficult for them to exploit any system holes and thus making vulnerability scanners work harder and in some cases impossible without knowing banner information.

  How To:

  Modify /etc/httpd/conf/httpd.conf

  Change the ServerSignature line to: ServerSignature Off

  Change the ServerTokens line to: ServerTokens Prod

  Restart Apache: /sbin/service httpd restart

Init

• Disable interactive boot by editing /etc/sysconfig/init
• Make PROMPT=no to disable
• Also add password to single user mode. Edit /etc/inittab
• Add the following:S:wait:/sbin/sulogin

TCP stack protection

A "SYN Attack" is a denial of service attack that consumes all the resources on a machine. Any server that is connected to a network is potentially subject to this attack.

Disable IP Source Routing

Source Routing is used to specify a path or route through the network from source to destination. This feature can be used by network people for diagnosing problems. However, if an intruder was able to send a source routed packet into the network, then he could intercept the replies and your server might not know that it's not communicating with a trusted server.

To enable Source Route Verification, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.accept_source_route = 0

To enable TCP SYN Cookie Protection, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.tcp_syncookies = 1

ICMP redirects are used by routers to tell the server that there is a better path to other networks than the one chosen by the server. However, an intruder could potentially use ICMP redirect packets to alter the hosts's routing table by causing traffic to use a path you didn't intend.

To disable ICMP Redirect Acceptance, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.accept_redirects = 0

IP spoofing is a technique where an intruder sends out packets which claim to be from another host by manipulating the source address. IP spoofing is very often used for denial of service attacks. For more information on IP Spoofing, I recommend the article IP Spoofing: Understanding the basics.

To enable IP Spoofing Protection, turn on Source Address Verification. Edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.rp_filter = 1

If you want or need Linux to ignore ping requests, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.icmp_echo_ignore_all = 1

Enable Ignoring Broadcasts Request

If you want or need Linux to ignore broadcast requests, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.icmp_echo_ignore_broadcasts = 1

To alert you about bad error messages in the network, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.icmp_ignore_bogus_error_responses = 1

To turn on logging for Spoofed Packets, Source Routed Packets, and Redirect Packets, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.log_martians = 1

Recommended Links

Softpanorama Recommended

Top articles

Sites

Top articles

Sites

• Linux Hardening
• Linux PAM
• Protective partitioning
• Seccheck
• Warning banners
• Network Security with /proc/sys/net/ipv4
• IP Spoofing: Understanding the basics

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last updated: March 12, 2019