Basic Security

[SteveRiley]

Thanks for the illustrations, that helps a lot.

My suggestion would be to bind all your services only to localhost (127.0.0.1 for IPv4, ::1 for IPv6). This eliminates the need to configure iptables. It's the approach I've taken for services that run on my server but shouldn't be visible outside the box itself (PostgreSQL, SpamAssassin, ClamAV, OpenDKIM).

Alternately, you could leave the services at their defaults (that is, bound to the real NIC) and then create iptables rules to block inbound traffic from everything except localhost.

[FrankBarmentlo]

well, it is a laptop, being dragged from a NAT network to an enterprise-class network infrastructure(school),
I need to run a webserver for testing purposes, that SHOULD not be available to other systems on the network,

this is my setup at home:

the kubuntu-laptop is the Samsung at the left
router to internet is a NAT-router from our ISP

networks are:
left side of Astaro(my systems): 192.168.123.0/24
right side(other stuff): 192.168.2.0/24
but as I said, I also drag it to school, where we use 10.0.0.0/?, or family(192.168.1.0/24, 192.168.2.0/24, 172.16.1.0/24),
I get around a lot of different networks(NAT networks, Enterprise class networks, or just some non-internetconnected testing networks),



I just don't want other people to see what I am doing on that local webserver, since it's non of their bussiness.
I do some webdevelopment for myself, and I am just experimenting with coding(HTML,PHP, CSS and their powers). it's just a little bit of privacy I want

[SteveRiley]

Is the computer behind a NAT router or gateway? Please describe your network architecture a bit more. You might even draw a quick diagram, label the interface IP addresses, and post a photo of it.

[FrankBarmentlo]

ok, question about the same subject..
what if I want to run a webserver(lamp-stack), for testing purposes, but it shouldn't be reachable from outside?
just add rules to block traffic incoming for port 80/443, from everywhere except localhost?

[FrankBarmentlo]

The wisdom of the modern world is found on t-shirts, not libraries.

books are old-school

thanks for all the information, time and patience, guys. I really appreciate it to be helped as a new user

[SteveRiley]

A Microsoft buddy of mine once wore a shirt with that phrase at TechEd. Nearly got fired for it. Alas, those who bear witness for the truth must also bear the consequences...

[dmeyer]

That would explain 95% of Windows problems. Honestly, WIndows wouldn't be half as problematic if the average user weren't so stupid. The average Linux user is definitely a step up.

[kubicle]

The wisdom of the modern world is found on t-shirts, not libraries.

[SteveRiley]

[kubicle]

I agree with most of what's been said here, the way most people set up firewalls is rather redundant, with this I mean using a firewall to block traffic to ports that aren't listening (redundant) and allowing all traffic to services that are listening (you normally want to allow at least some traffic to listening services to actually use them, but a firewall that allows all traffic doesn't protect the services at all).

Still, firewall can be used to blanket protect from user ignorance. It's fairly easy in linux to install services that will listen to outside connections without really knowing what these services do or how to configure them securely ("I'll install an ssh server because that sounds cool...and then forget about it").

[SteveRiley]

I'm pretty sure that an air gap approach to network security would = 1 000% increase in productivity for me

This should work.



(from the Sourcefire computer security calendar)

= = =

Of similar interest, you might enjoy reading about Marcus Ranum's Ultimate Firewall. Marcus, along with Bruce Schneier, have strongly informed my own thinking about matters such as these.

[dmeyer]

I'm pretty sure that an air gap approach to network security would = 1 000% increase in productivity for me Though this probably doesn't apply to everybody.

On SteveRiley and HalationEffect's point, Fedora sometimes gets so carried away with strict default security measures that it actually can get in the way of you using your system. I once tried to configure a Fedora Apache test server and after two hours gave up because some SELinux thing was thwarting me.

[SteveRiley]

I was internalizing the notion of "start with things that are necessary, stop when you've reached a sufficient point." IOW, I was leaving out the major while loop

while isUseful ( Computer ) do
  switch ( CompensatingControl_1.Necessity ) {
    case NO:
      break;
    case YES:
      switch ( CompensatingControl_1.Sufficiency ) {
        case YES:
          break;
        case NO:
          find_another ( CompensatingControl_2 )
        }
  }
loop

Of course, even if the above pseudo code is still not of necessary quality to express the notion, it's probably sufficient. LOL

[HalationEffect]

The only thing that code doesn't address is the 'not too much' principle. For example, if I were to unplug the ethernet cable between my PC and my router, I would be 100% safe from all network attacks, but at the price of an unacceptable loss of functionality.

I guess the concept of necessity could inherently include that principle though, e.g. "It is necessary for me to do X, Y and Z on a public network without getting pwned". Then, the necessity check could be characterised as "Do I need this (or any) additional compensating control to achieve that?".

[SteveRiley]

I would argue along these lines: Is the compensating control necessary? If no, then don't implement it; no further evaluation is required. If yes, then is the compensating control sufficient? If yes, then stop; mitigation has been satisfied. If no, then find an additional compensating control.

Or in pseudo code:

switch ( CompensatingControl_1.Necessity ) {
  case NO:
    break;
  case YES:
    switch ( CompensatingControl_1.Sufficiency ) {
      case YES:
        break;
      case NO:
        find_another ( CompensatingControl_2 )
      }
}

If you implement something that isn't necessary, it doesn't matter whether that thing has any redeemable sufficiency: you've just implemented security theater. If you implement something that's necessary but isn't sufficient, you've left open a vulnerability that then creates exposure for attack.