Softpanorama

May the source be with you, but remember the KISS principle ;-)
Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and  bastardization of classic Unix

Hardening TCP/IP stack in Linux

News See Also Recommended Links   TCP Flow Control
TCP handshake Sequence numbers IP troubleshooting Humor Etc

Protecting TCP/IP stack is a very challenging task in a culture where easy access to information prevails over security concerns. The key problem here is that the need for an efficient enterprise to provide relatively unfettered access to data, combined with the highly decentralized nature of operations, is irrevocably connected with the potential for serious security breaches. Maintaining and, especially, improvement of large enterprises IT security is a huge challenge and introduction of new OSes like Linux is only one relatively minor problem among many others.

We sing out the following critical issues :

  1. That maturity of a OS platform from the security standpoint is highly dependent of the availability and quality of virtualization components

    Network infrastructure and server complexity in the large enterprises has increased so significantly that it has become a constraint on how flexible a business can be. Server consolidation based on virtual machine concept in a large enterprise environment is the necessity that no large enterprise can avoid. This movement already started in AIX space and Windows space (sometimes under VMware, which is this case can be reused for Linux virtualization purposes), but it will definitely accelerated in the future.
     

  2. "security via obscurity" is a viable strategy.  

    Linux's growing popularity is attracting unwanted attention from virus writers, script kiddies  and criminal elements. In response, Linux advocates are putting a new emphasis on security measures and working to reassure large enterprises that the OS is secure for important enterprise applications.

    Using different compiler to make application less susseptable to off-the-shelf exploits is one promising avenue. Recompiling such component as sendmail is easy.

    Many exploits are complier dependent and the necessity to cover both gcc and Sun Studio 10 compliers significantly complicates the creation of working exploit.  For example Intel compiler is definitely recommended for compiling bind and Sendmail.  Obscurity understood here as using less popular  software platforms with some additional security features is a viable method to secure any complex operating environment and being off the most popular (and the most vulnerable) applications is always a plus.  
     

  3. It's very important to distinguish between security of the Linux itself (OS platform) and security of major open source applications (like Apache, Bind, Perl, PHP, Postgress, Sendmail, etc).  Most vulnerabilities that are sited as Linux vulnerabilities actually are the vulnerabilities of the applications that are deployed on Linux.
  4. Open Source software are ideal for quick prototyping and can help to avoid costly deployment mistakes that often happen with proprietary products.  For this particular purpose Linux has an upper hand as most applications were tested on Linux and work "out of the box" in a Linux environment; the current Linux distributions can be installed on typical corporate PCs without problems.  The role of Linux as a antidote to red-tape should not be underestimated in a large corporate environment. Many prototypes on Linux can be created using regular workstations instead of servers with zero or minimal (the cost of additional memory) acquisition costs.   Often early prototyping can prove that open source solution are more economical than proprietary closed solutions  or can deliver at least 80% of functionality for, say, 20% of costs and thus can substantially lower software acquisition costs. In case the decision is make to go with the proprietary vendor experience gained with the open source prototype provides a much more realistic estimate of deployment costs than any other method as well as dramatically improves negotiating power in talks with the vendor and help to avoid costly mistakes.

 

IPv6

Detection

Disabling

Zeroconf

Detection

route | grep link-local

link-local

*

255.255.0.0 U 0

0

0 eth2

Disabling

Edit /etc/sysconfig/network

Add NOZEROCONF=yes

Then remove the avahi package and its dependencies

Review Listening Daemons

Detection

netstat -tanp | grep LISTEN

Typical output:

[root ]# netstat -tanp | grep LISTEN

tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN 2256/nasd

tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 2166/mysqld

tcp 0 0 127.0.0.1:4690 0.0.0.0:* LISTEN 2376/prelude-manage

tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2057/cupsd

tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2244/master

tcp 0 0 :::22 :::* LISTEN 2068/sshd

Disabling Listening Daemons

Locate the pid in the netstat command

cat /proc/<pid>/cmdline

If not full path, run which or locate to find utility

rpm -qf full-path-of-daemon

rpm -e package

If difficult to remove due to dependencies:

chkconfig <service> off

/etc/sysctl.conf settings

# Don't reply to broadcasts. Prevents joining a smurf attack

net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable protection for bad icmp error messages

net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable syncookies for SYN flood attack protection

net.ipv4.tcp_syncookies = 1

# Log spoofed, source routed, and redirect packets

net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.default.log_martians = 1

# Don't allow source routed packets

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.default.accept_source_route = 0

# Turn on reverse path filtering

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

# Don't allow outsiders to alter the routing tables

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.default.secure_redirects = 0

# Don't pass traffic between networks or act as a router

net.ipv4.ip_forward = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

Iptables

tcp_wrappers

Example:

smbd: 192.168.1.

Unused Daemon Removal

Remove all daemons (and packages) not being used

This reduces attack footprint and improves performance

Many daemons listen on the network and could be accessible

Viewing

chkconfig –list

Disabling

rpm -qf /etc/rc.d/init.d/name 
rpm -e package-name
OR
chkconfig <service> off
Notes

Leave cpuspeed for speedshifting cpu and irqbalance for multicore

CPU

Disable readahead, mcstransd, firstboot, (and NetworkManager for machines without wireless networking) since they are not needed.

System Time

#!/bin/sh
/usr/sbin/ntpdate ntp-server

At & cron

Only allow root and people with verified need to run cron jobs

Setup cron.allow and cron.deny

Setup equivalents if you have 'at' installed

Sshd

MySQL

 

Bind

Apache

Init

TCP stack protection

Enable TCP SYN Cookie Protection

A "SYN Attack" is a denial of service attack that consumes all the resources on a machine. Any server that is connected to a network is potentially subject to this attack.

Disable IP Source Routing

Source Routing is used to specify a path or route through the network from source to destination. This feature can be used by network people for diagnosing problems. However, if an intruder was able to send a source routed packet into the network, then he could intercept the replies and your server might not know that it's not communicating with a trusted server.

To enable Source Route Verification, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.accept_source_route = 0

To enable TCP SYN Cookie Protection, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.tcp_syncookies = 1
Disable ICMP Redirect Acceptance

ICMP redirects are used by routers to tell the server that there is a better path to other networks than the one chosen by the server. However, an intruder could potentially use ICMP redirect packets to alter the hosts's routing table by causing traffic to use a path you didn't intend.

To disable ICMP Redirect Acceptance, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.accept_redirects = 0
Enable IP Spoofing Protection

IP spoofing is a technique where an intruder sends out packets which claim to be from another host by manipulating the source address. IP spoofing is very often used for denial of service attacks. For more information on IP Spoofing, I recommend the article IP Spoofing: Understanding the basics.

To enable IP Spoofing Protection, turn on Source Address Verification. Edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.rp_filter = 1
Enable Ignoring to ICMP Requests

If you want or need Linux to ignore ping requests, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.icmp_echo_ignore_all = 1
This cannot be done in many environments.

Enable Ignoring Broadcasts Request

If you want or need Linux to ignore broadcast requests, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.icmp_echo_ignore_broadcasts = 1
Enable Bad Error Message Protection

To alert you about bad error messages in the network, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.icmp_ignore_bogus_error_responses = 1
Enable Logging of Spoofed Packets, Source Routed Packets, Redirect Packets

To turn on logging for Spoofed Packets, Source Routed Packets, and Redirect Packets, edit the /etc/sysctl.conf file and add the following line:

  net.ipv4.conf.all.log_martians = 1

Recommended Links

Google matched content

Softpanorama Recommended

Top articles

Sites

Top articles

Sites



Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D


Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last updated: March 12, 2019