DOCSLIB.ORG

The Bastion Host Firewall Script

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Bastion Host Firewall Script APPENDIX A ■ ■ ■ The Bastion Host Firewall Script This appendix contains a script to set up firewall rules for a bastion host. I discussed this script and the firewall rules in Chapter 2. Modify the rules and the variables I have specified to suit your firewalling requirements. You can then add these to a script file, make the file exe- cutable using the chmod command, and run the script to apply your firewall rules. You will need to modify the script to suit your host. I have included a variables section at the start of the script, and I recommend you configure these to suit your host. This also makes it easier to maintain your rules and settings, as you need to make any required changes in only one place, rather than repeatedly in your script. You can also find this script in the Downloads section of the Apress Web site (http:// www.apress.com). #!/bin/bash # Bastion Host IPTables Script # VARIABLES - Change these to match your environment. # Location of the binaries IPT="/sbin/iptables" SYSCTL="/sbin/sysctl" # Loopback Interface LOOPBACK="lo" # Define External Network EXT_INTER="eth0" EXT_ADDR="220.240.52.228" # Define External Servers EXT_NTP1="clock3.redhat.com" EXT_NTP2="ntp.public.otago.ac.nz" # Define Internal Network INT_INTER="eth1" INT_ADDR="192.168.0.100" INT_NET="192.168.0.0/24" 511 512 APPENDIX A ■ THE BASTION HOST FIREWALL SCRIPT # Define Internal Servers INT_SMTP="192.168.0.20" INT_DNS1="192.168.0.10" INT_DNS2="192.168.0.11" # Set Kernel Parameters $SYSCTL -w net/ipv4/conf/all/accept_redirects="0" $SYSCTL -w net/ipv4/conf/all/accept_source_route="0" $SYSCTL -w net/ipv4/conf/all/log_martians="1" $SYSCTL -w net/ipv4/conf/all/rp_filter="1" $SYSCTL -w net/ipv4/icmp_echo_ignore_all="0" $SYSCTL -w net/ipv4/icmp_echo_ignore_broadcasts="1" $SYSCTL -w net/ipv4/icmp_ignore_bogus_error_responses="0" $SYSCTL -w net/ipv4/ip_forward="0" $SYSCTL -w net/ipv4/tcp_syncookies="1" # Flush all Rules $IPT -F #Set Policies $IPT -P INPUT DROP $IPT -P OUTPUT DROP $IPT -P FORWARD DROP # Delete all User-created Chains $IPT -X # Allow access to the Loopback host $IPT -A INPUT -i $LOOPBACK -j ACCEPT $IPT -A OUTPUT -o $LOOPBACK -j ACCEPT # Create ICMP Incoming Chain $IPT -N ICMP_IN # Pass ICMP Incoming Traffic to the ICMP Incoming Chain $IPT -A INPUT -p icmp -j ICMP_IN # Rules for ICMP Incoming Traffic $IPT -A ICMP_IN -i $EXT_INTER -p icmp --icmp-type 0 -m state --state ➥ ESTABLISHED,RELATED -j ACCEPT $IPT -A ICMP_IN -i $EXT_INTER -p icmp --icmp-type 3 -m state --state ➥ ESTABLISHED,RELATED -j ACCEPT $IPT -A ICMP_IN -i $EXT_INTER -p icmp --icmp-type 11 -m state --state ➥ ESTABLISHED,RELATED -j ACCEPT $IPT -A ICMP_IN -i $EXT_INTER -p icmp -j LOG --log-prefix ➥ "IPT: ICMP_IN " $IPT -A ICMP_IN -i $EXT_INTER -p icmp -j DROP APPENDIX A ■ THE BASTION HOST FIREWALL SCRIPT 513 # Create ICMP Outgoing Chain $IPT -N ICMP_OUT # Pass ICMP Outgoing Traffic to the ICMP Outgoing Chain $IPT -A OUTPUT -p icmp -j ICMP_OUT # Rules for ICMP Outgoing Traffic $IPT -A ICMP_OUT -o $EXT_INTER -p icmp --icmp-type 8 -m state --state ➥ NEW -j ACCEPT $IPT -A ICMP_OUT -o $EXT_INTER -p icmp -j LOG --log-prefix "IPT: ICMP_OUT " $IPT -A ICMP_OUT -o $EXT_INTER -p icmp -j DROP # Create Bad Sources Chain $IPT -N BAD_SOURCES # Pass traffic with bad source addresses to the Bad Sources Chain $IPT -A INPUT -j BAD_SOURCES # Rules for traffic with bad source addresses # Drop incoming traffic allegedly from our own host $IPT -A BAD_SOURCES -i $INT_INTER -s $INT_ADDR -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s $EXT_ADDR -j DROP # Drop outgoing traffic not from our own host $IPT -A BAD_SOURCES -o $INT_INTER -s ! $INT_ADDR -j DROP $IPT -A BAD_SOURCES -o $EXT_INTER -s ! $EXT_ADDR -j DROP # Drop traffic from other bad sources $IPT -A BAD_SOURCES -s 168.254.0.0/16 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 10.0.0.0/8 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 172.16.0.0/12 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 192.168.0.0/16 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 192.0.2.0/24 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 224.0.0.0/4 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 240.0.0.0/5 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 248.0.0.0/5 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 127.0.0.0/8 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 255.255.255.255/32 -j DROP $IPT -A BAD_SOURCES -i $EXT_INTER -s 0.0.0.0/8 -j DROP # Create Bad Flags Chain $IPT -N BAD_FLAGS # Pass traffic with bad flags to the Bad Flags Chain $IPT -A INPUT -p tcp -j BAD_FLAGS 514 APPENDIX A ■ THE BASTION HOST FIREWALL SCRIPT # Rules for traffic with bad flags $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix ➥ "IPT: Bad SF Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix ➥ "IPT: Bad SR Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN,PSH SYN,FIN,PSH -j LOG ➥ --log-prefix "IPT: Bad SFP Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN,PSH SYN,FIN,PSH -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST -j LOG ➥ --log-prefix "IPT: Bad SFR Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN,RST,PSH SYN,FIN,RST,PSH ➥ -j LOG --log-prefix "IPT: Bad SFRP Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags SYN,FIN,RST,PSH SYN,FIN,RST,PSH -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags FIN FIN -j LOG --log-prefix ➥ "IPT: Bad F Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags FIN FIN -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL NONE -j LOG --log-prefix ➥ "IPT: Null Flag " $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL NONE -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL ALL -j LOG --log-prefix ➥ "IPT: All Flags " $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL ALL -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix ➥ "IPT: Nmap:Xmas Flags " $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG ➥ --log-prefix "IPT: Merry Xmas Flags " $IPT -A BAD_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP # Prevent SYN Flooding $IPT -A INPUT -i $EXT_INTER -p tcp --syn -m limit --limit 5/second -j ACCEPT # Log and Drop Traffic in the INVALID state $IPT -A INPUT -m state --state INVALID -j LOG --log-prefix "IPT: INV_STATE " $IPT -A INPUT -m state --state INVALID -j DROP # Log and Drop Fragmented Traffic $IPT -A INPUT -f -j LOG --log-prefix "IPT: Frag " $IPT -A INPUT -f -j DROP APPENDIX A ■ THE BASTION HOST FIREWALL SCRIPT 515 # Bastion Host Service Rules # Internet SMTP Rules $IPT -A INPUT -i $EXT_INTER -p tcp --dport smtp -m state --state ➥ NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $EXT_INTER -p tcp --sport smtp -m state --state ➥ NEW,ESTABLISHED -j ACCEPT # Internal Network SMTP Rules $IPT -A INPUT -i $INT_INTER -p tcp -s $INT_SMTP --sport smtp -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INT_INTER -p tcp -d $INT_SMTP --dport smtp -m state ➥ --state NEW,ESTABLISHED -j ACCEPT # Internet DNS Rules $IPT -A INPUT -i $EXT_INTER -p udp --dport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $EXT_INTER -p tcp --dport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $EXT_INTER -p udp --sport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $EXT_INTER -p tcp --sport domain -m state ➥ --state NEW,ESTABLISHED –j ACCEPT # Internal Network Incoming DNS Rules $IPT -A INPUT -i $INT_INTER -p udp -s $INT_DNS1 --dport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INT_INTER -p udp -s $INT_DNS2 --dport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INT_INTER -p tcp -s $INT_DNS1 --dport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i $INT_INTER -p tcp -s $INT_DNS2 --dport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT # Internal Network Outgoing DNS Rules $IPT -A OUTPUT -o $INT_INTER -p udp -d $INT_DNS1 --sport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INT_INTER -p udp -d $INT_DNS2 --sport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INT_INTER -p tcp -d $INT_DNS1 --sport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INT_INTER -p tcp -d $INT_DNS2 --sport domain -m state ➥ --state NEW,ESTABLISHED -j ACCEPT 516 APPENDIX A ■ THE BASTION HOST FIREWALL SCRIPT # Internet NTP Rules $IPT -A INPUT -i $EXT_INTER -p udp -s $EXT_NTP1 --dport ntp -m state ➥ --state ESTABLISHED -j ACCEPT $IPT -A INPUT -i $EXT_INTER -p udp -s $EXT_NTP2 --dport ntp -m state ➥ --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $EXT_INTER -p udp -d $EXT_NTP1 --sport ntp -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $EXT_INTER -p udp -d $EXT_NTP2 --sport ntp -m state ➥ --state NEW,ESTABLISHED -j ACCEPT # Internal Network NTP Rules $IPT -A INPUT -i $INT_INTER -p udp -s $INT_NET --dport ntp -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INT_INTER -p udp -d $INT_NET --sport ntp -m state ➥ --state ESTABLISHED -j ACCEPT # Internal Network SSH Rules $IPT -A INPUT -i $INT_INTER -p tcp -s $INT_NET --dport ssh -m state ➥ --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o $INT_INTER -p tcp -d $INT_NET --sport ssh -m state ➥ --state ESTABLISHED -j ACCEPT APPENDIX B ■ ■ ■ BIND Configuration Files This Appendix contains a series of secure BIND configuration files demonstrating the differ- ent types of BIND configuration files discussed in Chapter 11.
Load more

Recommended publications
  • Nist Sp 800-77 Rev. 1 Guide to Ipsec Vpns
    NIST Special Publication 800-77 Revision 1 Guide to IPsec VPNs Elaine Barker Quynh Dang Sheila Frankel Karen Scarfone Paul Wouters This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-77r1 C O M P U T E R S E C U R I T Y NIST Special Publication 800-77 Revision 1 Guide to IPsec VPNs Elaine Barker Quynh Dang Sheila Frankel* Computer Security Division Information Technology Laboratory Karen Scarfone Scarfone Cybersecurity Clifton, VA Paul Wouters Red Hat Toronto, ON, Canada *Former employee; all work for this publication was done while at NIST This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-77r1 June 2020 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
    [Show full text]
  • Bastion Hosts (1)
    Chair for Network Architectures and Services Department of Informatics TU München – Prof. Carle Network Security Chapter 7 Middleboxes Overview IntroductionIntroduction FirewallsFirewalls ApplicationApplication Proxies Proxies NetworksNetworks Address Address Translators Translators (NAT) (NAT) VirtualVirtual Private Private Networks Networks CaseCase study: study: Linux Linux Netfilter Netfilter Network Security, WS 2010/11, Chapter 7 2 Overview IntroductionIntroduction FirewallsFirewalls ApplicationApplication Proxies Proxies NetworksNetworks Address Address Translators Translators VirtualVirtual Private Private Networks Networks CaseCase study: study: Linux Linux Netfilter Netfilter Network Security, WS 2010/11, Chapter 7 3 Introduction Definition: “A middlebox is defined as any intermediary device performing functions other than the normal, standard functions of an IP router on the datagram path between a source host and destination host.” [RFC3234] The Internet was originally designed with the end-to-end connectivity principle However, in the meanwhile there are many devices on the datagram path that manipulate the IP packets [RFC3234] provides an overview of some commonly used middleboxes e.g. firewalls, NATs, proxies, transcoders, load balancers, anonymisers In this chapter, we will restrict the discussion to some types of middleboxes that perform security-related manipulation of packets: Firewalls, proxies, NATs, VPNs gateways Network Security, WS 2010/11, Chapter 7 4 Overview IntroductionIntroduction
    [Show full text]
  • Dod-Compliant Implementations in the AWS Cloud Reference Architectures
    DoD-Compliant Implementations in the AWS Cloud Reference Architectures Paul Bockelman Andrew McDermott April 2015 Amazon Web Services – DoD -Compliant Implementations in the AWS Cloud April 2015 Contents Contents 2 Abstract 3 Introduction 3 Getting Started 4 Shared Responsibilities and Governance 4 Shared Responsibility Environment 4 Compliance Governance 10 What Is FedRAMP? 11 What Is the Cloud Computing SRG? 11 FedRAMP + CC SRG Compliance = the Path to AWS 13 AWS Global Infrastructure 14 AWS Services 14 Compute 14 Networking 17 Storage 21 Management 25 Level 2 Sample Reference Architecture 26 Level 4-5 Sample Reference Architecture 31 Conclusion 32 Further Reading 32 Page 2 of 33 Amazon Web Services – DoD -Compliant Implementations in the AWS Cloud April 2015 Abstract This whitepaper is intended for existing and potential DoD mission owners who are designing the security infrastructure and configuration for applications running in Amazon Web Services (AWS). It provides security best practices that will help you properly design and deploy compliant DoD applications and protect your data and assets in the AWS Cloud. The paper is targeted at IT decision makers and security personnel and assumes that mission owners are familiar with basic security concepts in the areas of networking, operating systems, data encryption, and operational controls. AWS provides a secure hosting environment for mission owners to field their applications, but does not relieve the mission owners of their responsibility to securely deploy, manage and monitor their applications in accordance with DoD security and compliance policy. When operating an application on AWS, the mission owner is responsible for the guest operating system, management of users, and the configuration of the AWS-provided networking functionality.
    [Show full text]
  • NIST SP 800-123, Guide to General Server Security
    Special Publication 800-123 Guide to General Server Security Recommendations of the National Institute of Standards and Technology Karen Scarfone Wayne Jansen Miles Tracy NIST Special Publication 800-123 Guide to General Server Security Recommendations of the National Institute of Standards and Technology Karen Scarfone Wayne Jansen Miles Tracy C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 July 2008 U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology James M. Turner, Deputy Director GUIDE TO GENERAL SERVER SECURITY Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-123 Natl. Inst. Stand. Technol. Spec. Publ. 800-123, 53 pages (Jul. 2008) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.
    [Show full text]
  • An Effective Utilization of Bastion Host Services in Cloud Environment
    International Journal of Innovative Technology and Exploring Engineering (IJITEE) ISSN: 2278-3075, Volume-8 Issue-7, May, 2019 An Effective Utilization of Bastion Host Services in Cloud Environment G. Vijayababu, D. Haritha, R. Satya Prasad As it’s placed in a demilitarized zone, it should reduce the Abstract: Now a days the cloud computing offers huge benefits, chances of infiltration. For instance, when there are Linux security issues are major concerns that setback from enjoying the instances launched in a subnet of Amazon VPC, bastion host full range of advantages it offers. Bastion Host is specifically can be used in this environment to lessen the risk of letting in designed for network security that is placed on the network perimeter which provides protection in the form of patches, the SSH connections from an external network. authentication, encryption, and eliminates unnecessary software Basically, bastion hosts instances are placed in the public and services and is a well-known concept. This paper discusses subnet that are invoked using either RDP or SSH. It acts as a Bastion Host services, types and bastion host in a cloud jump box or jump server, after the establishment of the environment AWS. The Priority Queue method for effective remote connection to the bastion host, and then permits to use utilization of services is proposed and the results are promising in SSH or RDP to log in to other instances (of the private terms of improving throughput and resource utilization. subnets) in Virtual Private Cloud. Fundamentally Bastion host acts as a bridge between the private and public networks Index Terms: AWS, Bastion Host, DMZ, VPC via the internet once configuration is done well with the help of Network ACLs and the security groups.
    [Show full text]
  • Jump Servers
    Enterprise Architecture Technical Brief Jump Servers Robert Kowalke July 2018 Enterprise Architecture Jump Servers Contents Jump Server Recommendation ....................................................................................................... 3 General understanding of terms: ..................................................................................................... 4 Jump Point .............................................................................................................................. 4 Bastion Host .............................................................................................................................. 4 Secure Administrative Workstation (SAW) ............................................................................. 5 Background Information ................................................................................................................. 6 Jump Boxes Improve Security .................................................................................................. 6 Use Windows Server 2016 to Secure a Jump Server ................................................................ 8 Interactive and Automated Access Management by NIST ....................................................... 9 Amazon Web Services (AWS) Security by Solinor ................................................................. 9 Six Best Practices for Securing AWS Environments ............................................................... 9 CyberArk Privileged Account Security for AWS
    [Show full text]