As I come across network security issues in Linux, I can’t help but wish that Debian had decent default firewall rules (and kernel network protection in general) like many other distros.
This applies to both Debian 4.0 and Ubuntu 7.10.
By default, a Ubuntu or Debian install of Linux is vulnerable to a SYN flood. If behind a router, chances are there won’t be a problem. But if it’s a standalone Linux machine connected to the internet, the machine is vulnerable to a DoS attack.
It’s a simple fix.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
or
iptables -A INPUT -i eth0 -p tcp –tcp-flags ALL ACK,RST,SYN,FIN -j DROP
iptables -A INPUT -i eth0 -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -i eth0 -p tcp –tcp-flags SYN,RST SYN,RST -j DROP
The second should probably be used if it’s a server. The first way may still have quite a few open SYN connections.
You may just want to block the IP(s) that are conducting a SYN flood on you (keep an eye on netstat or iptables.log). A script that does this would be pretty useful; I wonder if there are any out there (or if I have to write one?).
iptables -I -s ip.to.ban -j DROP
Along with rules to help protect against flooding, it seems like it would be a good idea to block all ports by default.
iptables -A INPUT -m limit –limit 100/second –limit-burst 150 -j RETURN
One solution could be to have a folder called /etc/security/iptables that contains files that get passed to iptables at startup (in the same way /etc/rc2.d gets read in numeric order). So you could have files like 22ssh, 23ftp, etc. with iptable rules in each file. You could also have an ‘ENABLED’ variable like some files in /etc/default have (so that ports wouldn’t be opened by default; the user would have to manually enable them for the port to be opened).
Then they’d just run /etc/init.d/iptables restart and the port would be opened (flush the rules, reapply).
I’ve put together a proof-of-concept for this; feel free to check it out. Extract it somewhere, and check out the source. Then try the following
tar xvzf debian-iptables.tar.gz -C /
Which will create and fill /etc/security/iptables and put an init file in /etc/init.d and a link in /etc/rc2.d
It hasn’t been tested as much as I’d like, but it should work.
Please do this at the computer itself; if you do it over the network you might be locked out.
http://bbis.us/debian-iptables.tar.gz