An Internet-connected Linux machine is in a high-risk situation. This book details security steps that a home or small-to-mid-size, non-enterprise business might take to protect itself from potential remote attackers. As with the first edition, this book will provide a description of the need for security measures and solutions built upon the most up-to-date technology available. The content for the Second Edition has been updated to cover the 2.4 kernel, and additional chapters on VPNs, SSH, and Tripwires have been added.
(NOTE: All chapters conclude with a Summary.)
I. PACKET FILTERING AND BASIC SECURITY MEASURES.1. Preliminary Concepts Underlying Packet-Filtering Firewalls.
The TCP/IP Reference Networking Model. IP Addresses. Routing: Getting a Packet from Here to There. Service Ports: The Door to the Programs on Your System. Packets: IP Network Messages.2. Packet-Filtering Concepts.
A Packet-Filtering Firewall. Choosing a Default Packet-Filtering Policy. Rejecting Versus Denying a Packet. Filtering Incoming Packets. Filtering Outgoing Packets. Private versus Public Network Services.3. iptables: The Linux Firewall Administration Program.
Differences Between IPFW and Netfilter Firewall Mechanisms. iptables Features. iptables Syntax.4. Building and Installing a Standalone Firewall.
iptables: The Linux Firewall Administration Program. Initializing the Firewall. Protecting Services on Assigned Unprivileged Ports. Enabling Basic, Required Internet Services. Enabling Common TCP Services. Enabling Common UDP Services. Filtering ICMP Control and Status Messages. Logging Dropped Incoming Packets. Logging Dropped Outgoing Packets. Denying Access to Problem Sites Up Front. Installing the Firewall.
II. ADVANCED ISSUES, MULTIPLE FIREWALLS, AND PERIMETER NETWORKS.5. Firewall Optimization.
Rule Organization. User-Defined Chains. Optimized Example. What Did Optimization Buy?6. Packet Forwarding.
The Limitations of a Standalone Firewall. Basic Gateway Firewall Setups. LAN Security Issues. Configuration Options for a Trusted Home LAN. Configuration Options for a Larger or Less Trusted LAN. A Formal Screened-Subnet Firewall. Converting the Gateway from Local Services to Forwarding.7. NAT-Network Address Translation.
The Conceptual Background of NAT. iptables NAT Semantics. Examples of SNAT and Private LANs. Examples of DNAT, LANs, and Proxies.8. Debugging the Firewall Rules.
General Firewall-Development Tips. Listing the Firewall Rules. Checking the Input, Output, and Forwarding Rules. Checking for Open Ports. Debugging SSH: A Real-Life Example.
III. SYSTEM-LEVEL SECURITY AND MONITORING.9. Verifying That the System Is Running as You Expect.
Checking the Network Interfaces with ifconfig. Checking the Network Connection with ping. Checking Network Processes with netstat. Checking a Process Bound to a Particular Port with fuser. Checking All Processes with ps -ax. Interpreting the System Logs.10. Issues at the UNIX System Administration Level.
Authentication: Verifying Identity. Authorization: Defining Access Rights to Identities. Server-Specific Configuration. SOCKS: An Application-Level Proxy Firewall. Miscellaneous System Accounts in /etc/passwd, /etc/shadow, and /etc/group. Setting Your PATH Variable. /etc/issue.net. Remote Logging. Keeping Current with Software Upgrades.