Network Security, or how do you protect your system?

[Chopstick]

Hi All,
I recently installed Trusty on my laptop and my workstation. When I was going through the Firewall options I noticed that Firestarter disappeard from the repos, and so did Bastille, but we now have a new firewall configuration item in System Settings.

My setup is such that I am running an SSH server on my workstation, because I need to log in from my laptop, and I am running ktorrent on my laptop. Both machines are in a large university network, but may be in different subnets. We had several major breaches in the past and other machines in my department have been hacked, so I want to be on the safe side and don't any chances.

For the SSH server I disabled password login (public key only) and put it on a non-standard port. I also disabled the ping response on both systems. I also activated the firewall in Systems Settings and set it do "deny" all incoming connections except on my non-standard SSH port (outbound connections are allowed). My goal is to basically "stealth" my system, as a first line of defense (since you can't rely on cryptographic software to be free of vulnerabilities or bugs...).

But unfortunately things are not working as I expected, and I have a few questions:

1. Eventhough I added a line /etc/sysctl.conf,

net.ipv4.conf.icmp_echo_ignore_all = 1

, the ping suppression is not permanent, and after every reboot, I have to do

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

again (as root) to disable the ping response. On that note, what does echo

1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

do?
If this is the corect method, is it possible that the KDE firewall utility is interfering? I also have to reset this each time I make changes to the firewall rules.

2. When I do

 nmap -PN my.host.name

from the host itself, it reports that either all standard ports are 'closed' or sometimes that some random ports (eg. for ipp) are open, but when I scan from another machine in the network (on which I have a user account), it reports that all standard ports are 'filtered'. Should I be concerned about the self-test result?

3. Is there a way to "stealth" my non-standard SSH port, so that any connection attempt without the appropriate credentials gets dropped, so that the port would appear 'closed' or 'filtered', so that the port would not be recognized as my SSH port by an attacker (who does not have the right credentials). If that's not possible, is it possible to drop all non-SSH connection attempts?

4. Is there a reason why Bastille was removed from the repos? Is it outdated now? Would it be advisable to install it from launchpad? (the 12.04 version for example - there is no 14.04 deb)

Finally, do you have any other recommendations for hardening my system without restricting common email and browsing activities too much?

Thanks,
Chopstick

[GreyGeek]

I use DD-WRT on my Cisco E2500, and use its Linux firewall, ping cancellation and such to guard my Trusty ports.

[Chopstick]

So this DD-WRT is a software for harware routers, right? I'm in a large corporate network, to which I am connecting directly, so I don't think I can use that... but for people who have a router at home, this is probably a good option.

[kubicle]

See /etc/ufw/sysctl.conf, it's settings will by default override /etc/sysctl.conf (if you have ufw enabled).

That being said, dropping all ICMP packets doesn't make much sense (and it does not "stealth" your machine on the internet), for example, dropping echo requests is not the same as not receiving them, and anyone scanning the IP will know the difference (in other words, even if you drop the requests, the sender will know whether the IP is alive...there is a difference between "host unreachable==dead" and "ping timeout==alive")

it reports that either all standard ports are 'closed' or sometimes that some random ports (eg. for ipp) are open, but when I scan from another machine in the network (on which I have a user account), it reports that all standard ports are 'filtered'. Should I be concerned about the self-test result?

Blocking connections to "localhost" (the machine itself) doesn't really improve security (and can cause issues with services that listen for localhost connections, such as cups), so no.

Is there a way to "stealth" my non-standard SSH port, so that any connection attempt without the appropriate credentials gets dropped, so that the port would appear 'closed' or 'filtered'

No, but you can limit the ip addresses (or range of addresses) that are allowed to connect (you can do this either on the server config or with a firewall...you can set, for example, your firewall to accept connections from a range of addresses and drop connections from other IPs).

[GreyGeek]

... dropping all ICMP packets doesn't make much sense (and it does not "stealth" your machine on the internet), for example, dropping echo requests is not the same as not receiving them, and anyone scanning the IP will know the difference (in other words, even if you drop the requests, the sender will know whether the IP is alive...there is a difference between "host unreachable==dead" and "ping timeout==alive")....

If there was no computer with given IP address tested, the hacker gets "ICMP Destination Unreachable" (ICMP Type 3) with one of the codes (such as 0 - net unreachable, 1 - host unreachable ... etc. Otherwise she gets a "request time out", which clearly indicates a computer is at that IP address.


I agree, stealthed ports or dropped pings do not increase your security in any way, period,nor "hide" your presence on the Internet. Stealth = packet dropped; closed = packet rejected.

But, most spammers/hackers use programs, similar to the old daemon dialers of phone modem days, to send out robotic pings to find new hosts, new sites to exploit. These programs aren't written to infer the presence of a machine due to dropped packets. If you don't "answer the ring" with an echo or by rejecting the packet, the program usually moves on to the next number in the IP range it is probing. A human using nmap may get curious about a dropped ping OR rejected packet and continue to probe the address. An echo response tells the program that a live machine is at the target IP address. The machine records that IP address in a file and moves on to the next one. Later, a more sophisticated program, or a live hacker, may probe IP addresses in that stored list.

Many websites refuse to ping and drop the packet, many times to reduce congestion on that portion of the network. The ping sender gets asterisks indicating that the message ends there. This still maps the boundaries, but the spammer/hacker must deduce the presence of a machine. One can infer the asterisks indicate a node, but it is a topography of assumptions rather than responses. Automated probes usually don't record failed IP addresse probes, only those that blab. A skilled hacker with a good tool like nmap and knowledge of unpatched security holes or applications can usually break into any target computer, even it if its ports reject (closed) or drop packets (stealth).

I mentioned the router echoing ping because while setting up my firewall nmap kept giving me ping echos on my IP address even though I had turned off ping echoes in ufw. I realized that the echo was coming from the router. I decided to move my firewall to my wireless router and used the DD-WRT firmware to adjust the Linux firewall in the router, including eliminating ping echoes. No pings and all unused ports dropped packets and used ones were closed. BTW, nmap is better than grc for seeing how porous your firewall is.

[Snowhog]

Bottom line: If you don't want anyone to know you are on the Internet, don't get on the Internet.

[kubicle]

@Greygeek
Sure, I didn't mean you should specifically allow all ICMP traffic either, just that summarily dropping *all* ICMP packets doesn't usually make sense:

1. Not ICMP packets trigger a response (dropping these is pointless).
2. Dropping ICMP packets that do trigger a response doesn't really hide you (it's ineffective if one's [impossible] goal is to hide on the internet).
3. Dropping some ICMP traffic will hurt you much more than a potential attacker (making network monitoring/troubleshooting harder for you while not really affecting security).

Like I said, that doesn't mean one should always allow *all* ICMP traffic, for example, dropping "ICMP redirect" packets is often not a bad idea (potential security issues, uncommon, but possible...ufw blocks these by default, btw)

Most automated attack scripts/software don't really bother with ping, they go for the services/ports directly (why waste time pinging to find a live hosts when you can try to directly connect to a particular service...like ssh or a php vulnerability on a web server...pinging first doesn't net you anything and is fairly unreliable).

---

I believe that "security by obscurity" is a broken concept with very little gains, it's much more important to configure your services securely and install all security updates (you can then optionally also use other tools to improve security, like firewalls...although the way people usually configure their firewall it is fairly redundant. With this I mean that they configure their firewall to drop connections to ports that have no services listening on them [redundant]...and then accept all traffic to services that they are actually running [effectively the same as having no firewall at all]).

[Chopstick]

This was very interesting, kubicle and GreyGeek - thanks!

I know that you can not completely hide yourself, and I am sure if people are really determined to break into my system, they can, if they know some vulnerability.

My primary goal is to make it *harder*, so as to discourage opportunistic hackers who are trying to build bot farms, send spam email, or host illegal bittorrents. And I know that these things have happened in our network. And I think these folks primarily go for easy targets.
Of course a strong password should already be sufficient, but I think some redundancy is advisable, because there can always be bugs in any software, so, completely relying on only one layer of protection is a bit risky (and unneccessary).

As for dropping packets and "hiding", I noticed that a port scan using nmap takes much longer if packets are dropped ("stealth") than if the ports are simply closed (hours compared to seconds), so that by default dropping packets would make it much more expensive for an attacker to find possible targets. That was my thinking.

In my view, the main reason for higher security standards is to discourage hacking for trivial reasons like spamming or bot farming (which is then used for more malicious purposes). I suspect even modest security measures can make these activities too expensive to be profitable.

What do you think?