From 839f2540ac29eceae790ddb21a1fb382859ffb27 Mon Sep 17 00:00:00 2001 From: Saeid Bostandoust <49065072+ssbostan@users.noreply.github.com> Date: Fri, 10 Jan 2020 17:23:29 +0330 Subject: [PATCH 1/3] add some kernel configuration --- README.md | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 67 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b41d2d0..ae39088 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,6 @@ ## :ballot_box_with_check: Todo - [ ] Add useful Iptables configuration examples -- [ ] Add useful Kernel Settings (sysctl) configuration examples - [ ] Add links to useful external resources - [ ] Add advanced configuration examples, commands, rules @@ -38,6 +37,7 @@ - [Tools to help you configure Iptables](#tools-to-help-you-configure-iptables) - [Manuals/Howtos/Tutorials](#manualshowtostutorials) +- [Useful Kernel Settings (sysctl) configuration](#useful-kernel-settings-sysctl-configuration) - [How it works?](#how-it-works) - [Iptables Rules](#iptables-rules) * [Saving Rules](#saving-rules) @@ -129,6 +129,72 @@   :small_orange_diamond: Per-IP rate limiting with iptables

+### Kernel Settings (sysctl) Configuration + +```bash +cat << EOF > /etc/sysctl.d/40-custom.conf + +#--------------------------------------------------------------- +# Disable routing triangulation. Respond to queries out +# the same interface, not another. Helps to maintain state +# Also protects against IP spoofing +#--------------------------------------------------------------- + +net/ipv4/conf/all/rp_filter = 1 + + +#--------------------------------------------------------------- +# Enable logging of packets with malformed IP addresses +#--------------------------------------------------------------- + +net/ipv4/conf/all/log_martians = 1 + + +#--------------------------------------------------------------- +# Disable redirects +#--------------------------------------------------------------- + +net/ipv4/conf/all/send_redirects = 0 + + +#--------------------------------------------------------------- +# Disable source routed packets +#--------------------------------------------------------------- + +net/ipv4/conf/all/accept_source_route = 0 + + +#--------------------------------------------------------------- +# Disable acceptance of ICMP redirects +#--------------------------------------------------------------- + +net/ipv4/conf/all/accept_redirects = 0 + + +#--------------------------------------------------------------- +# Turn on protection from Denial of Service (DOS) attacks +#--------------------------------------------------------------- + +net/ipv4/tcp_syncookies = 1 + + +#--------------------------------------------------------------- +# Disable responding to ping broadcasts +#--------------------------------------------------------------- + +net/ipv4/icmp_echo_ignore_broadcasts = 1 + + +#--------------------------------------------------------------- +# Enable IP routing. Required if your firewall is protecting a +# network, NAT included +#--------------------------------------------------------------- + +net/ipv4/ip_forward = 1 + +EOF +``` + ### How it works?

From 47f71aacd19f9a5b1243681bf31b16aea1fe8dc0 Mon Sep 17 00:00:00 2001 From: Saeid Bostandoust <49065072+ssbostan@users.noreply.github.com> Date: Fri, 10 Jan 2020 17:31:35 +0330 Subject: [PATCH 2/3] make some fixes --- README.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index ae39088..a900b9c 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@
-## :ballot_box_with_check: Todo +## :ballot_box_with_check: TODO - [ ] Add useful Iptables configuration examples - [ ] Add links to useful external resources @@ -52,7 +52,7 @@ * [To display INPUT or OUTPUT chain rules with numeric lines and verbose](#to-display-input-or-output-chain-rules-with-numeric-lines-and-verbose) * [Delete Rule by Chain and Number](#delete-rule-by-chain-and-number) * [Delete Rule by Specification](#delete-rule-by-specification) - * [Flush All Rules, Delete All Chains, and Accept All](#flush-all-rules--delete-all-chains--and-accept-all) + * [Flush All Rules, Delete All Chains, and Accept All](#flush-all-rules-delete-all-chains-and-accept-all) * [Flush All Chains](#flush-all-chains) * [Flush a Single Chain](#flush-a-single-chain) * [Insert Firewall Rules](#insert-firewall-rules) @@ -63,7 +63,7 @@ * [Drop Invalid Packets](#drop-invalid-packets) * [Block an IP Address](#block-an-ip-address) * [Block and IP Address and Reject](#block-and-ip-address-and-reject) - * [Block Connections to a Network Interface](#block-connections-to-a-network-interface-1) + * [Block Connections to a Network Interface](#block-connections-to-a-network-interface) * [Allow All Incoming SSH](#allow-all-incoming-ssh) * [Allow Incoming SSH from Specific IP address or subnet](#allow-incoming-ssh-from-specific-ip-address-or-subnet) * [Allow Outgoing SSH](#allow-outgoing-ssh) @@ -87,12 +87,12 @@ * [Log and Drop Packets with Limited Number of Log Entries](#log-and-drop-packets-with-limited-number-of-log-entries) * [Drop or Accept Traffic From Mac Address](#drop-or-accept-traffic-from-mac-address) * [Block or Allow ICMP Ping Request](#block-or-allow-icmp-ping-request) - * [Specifying Multiple Ports with `multiport`](#specifying-multiple-ports-with--multiport-) - * [Load Balancing with `random*` or `nth*`](#load-balancing-with--random---or--nth--) - * [Restricting the Number of Connections with `limit` and `iplimit*`](#restricting-the-number-of-connections-with--limit--and--iplimit--) + * [Specifying Multiple Ports with `multiport`](#specifying-multiple-ports-with-multiport) + * [Load Balancing with `random*` or `nth*`](#load-balancing-with-random-or-nth) + * [Restricting the Number of Connections with `limit` and `iplimit*`](#restricting-the-number-of-connections-with-limit-and-iplimit) * [Maintaining a List of recent Connections to Match Against](#maintaining-a-list-of-recent-connections-to-match-against) - * [Matching Against a `string*` in a Packet's Data Payload](#matching-against-a--string---in-a-packet-s-data-payload) - * [Time-based Rules with `time*`](#time-based-rules-with--time--) + * [Matching Against a `string*` in a Packet's Data Payload](#matching-against-a-string-in-a-packets-data-payload) + * [Time-based Rules with `time*`](#time-based-rules-with-time) * [Packet Matching Based on TTL Values](#packet-matching-based-on-ttl-values) * [Protection against port scanning](#protection-against-port-scanning) * [SSH brute-force protection](#ssh-brute-force-protection) @@ -104,7 +104,7 @@ * [Drop all NULL packets](#drop-all-null-packets) * [Block Uncommon MSS Values](#block-uncommon-mss-values) * [Block Packets With Bogus TCP Flags](#block-packets-with-bogus-tcp-flags) - * [Block Packets From Private Subnets (Spoofing)](#block-packets-from-private-subnets--spoofing-) + * [Block Packets From Private Subnets (Spoofing)](#block-packets-from-private-subnets-spoofing) **** @@ -129,7 +129,7 @@   :small_orange_diamond: Per-IP rate limiting with iptables

-### Kernel Settings (sysctl) Configuration +### Useful Kernel Settings (sysctl) Configuration ```bash cat << EOF > /etc/sysctl.d/40-custom.conf From dada57b96516b67028d784a44423cf9180b07486 Mon Sep 17 00:00:00 2001 From: Pilot Pirx Date: Sat, 11 Jan 2020 11:08:52 +0100 Subject: [PATCH 3/3] minor updates --- README.md | 111 +++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 81 insertions(+), 30 deletions(-) diff --git a/README.md b/README.md index a900b9c..decfb74 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,7 @@ ## :ballot_box_with_check: TODO - [ ] Add useful Iptables configuration examples +- [x] Add useful Kernel Settings (sysctl) configuration - [ ] Add links to useful external resources - [ ] Add advanced configuration examples, commands, rules @@ -38,6 +39,14 @@ - [Tools to help you configure Iptables](#tools-to-help-you-configure-iptables) - [Manuals/Howtos/Tutorials](#manualshowtostutorials) - [Useful Kernel Settings (sysctl) configuration](#useful-kernel-settings-sysctl-configuration) + * [rp_filter](#rp_filter) + * [log_martians](#log_martians) + * [send_redirects](#send_redirects) + * [accept_source_route](#accept_source_route) + * [accept_redirects](#accept_redirects) + * [tcp_syncookies](#tcp_syncookies) + * [icmp_echo_ignore_broadcasts](#icmp_echo_ignore_broadcasts) + * [ip_forward](#ip_forward) - [How it works?](#how-it-works) - [Iptables Rules](#iptables-rules) * [Saving Rules](#saving-rules) @@ -131,70 +140,112 @@ ### Useful Kernel Settings (sysctl) Configuration -```bash -cat << EOF > /etc/sysctl.d/40-custom.conf +##### rp_filter -#--------------------------------------------------------------- -# Disable routing triangulation. Respond to queries out -# the same interface, not another. Helps to maintain state -# Also protects against IP spoofing -#--------------------------------------------------------------- + > _Disable routing triangulation. Respond to queries out the same interface, not another. Also protects against IP spoofing._ +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/conf/all/rp_filter = 1 +EOF +``` +- [rp_filter and LPIC-3 Linux Security](https://www.theurbanpenguin.com/rp_filter-and-lpic-3-linux-security/) +- [Linux kernel rp_filter settings (Reverse path filtering)](https://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering) +- [Reverse Path Filtering](http://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.kernel.rpf.html) -#--------------------------------------------------------------- -# Enable logging of packets with malformed IP addresses -#--------------------------------------------------------------- +##### log_martians + > _Enable logging of packets with malformed IP addresses._ + +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/conf/all/log_martians = 1 +EOF +``` +- [What is the usefulness of logging of martians packet?](https://serverfault.com/questions/570980/what-is-the-usefulness-of-logging-of-martians-packet-e-g-net-ipv4-conf-all-lo) -#--------------------------------------------------------------- -# Disable redirects -#--------------------------------------------------------------- +##### send_redirects + > _Disables sending of all IPv4 ICMP redirected packets on all interfaces._ + +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/conf/all/send_redirects = 0 +EOF +``` +- [Disable source routing](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing) +- [What are ICMP redirects and should they be blocked?](https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked) -#--------------------------------------------------------------- -# Disable source routed packets -#--------------------------------------------------------------- +##### accept_source_route + > _Disable source routed packets (packets with the Strict Source Route (SSR) or Loose Source Routing (LSR) option set)._ + +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/conf/all/accept_source_route = 0 +EOF +``` +- [Disable source routing](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-server_security-disable-source-routing) +- [The system must not accept IPv4 source-routed packets by default.](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2017-12-08/finding/V-38529) -#--------------------------------------------------------------- -# Disable acceptance of ICMP redirects -#--------------------------------------------------------------- +##### accept_redirects + > _Disable acceptance of ICMP redirects._ + +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/conf/all/accept_redirects = 0 +EOF +``` +- [What are ICMP redirects and should they be blocked?](https://askubuntu.com/questions/118273/what-are-icmp-redirects-and-should-they-be-blocked) +- [The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.](https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2018-11-28/finding/V-73175) -#--------------------------------------------------------------- -# Turn on protection from Denial of Service (DOS) attacks -#--------------------------------------------------------------- +##### tcp_syncookies + > _Turn on SYN-flood protections (protection from Denial of Service (DOS) attacks)._ + +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/tcp_syncookies = 1 +EOF +``` +- [Hardening your TCP/IP Stack Against SYN Floods](https://www.ndchost.com/wiki/server-administration/hardening-tcpip-syn-flood) +- [Linux: Turn On TCP SYN Cookie Protection](https://www.cyberciti.biz/faq/enable-tcp-syn-cookie-protection/) +- [Better alternative for tcp_syncookies in Linux](https://serverfault.com/questions/705504/better-alternative-for-tcp-syncookies-in-linux) -#--------------------------------------------------------------- -# Disable responding to ping broadcasts -#--------------------------------------------------------------- +##### icmp_echo_ignore_broadcasts + > _Disable responding to ping broadcasts._ + +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf net/ipv4/icmp_echo_ignore_broadcasts = 1 +EOF +``` +- [What is ICMP broadcast good for?](https://superuser.com/questions/306065/what-is-icmp-broadcast-good-for) +- [The system must not respond to ICMPv4 sent to a broadcast address.](https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2018-11-28/finding/V-38535) -#--------------------------------------------------------------- -# Enable IP routing. Required if your firewall is protecting a -# network, NAT included -#--------------------------------------------------------------- +##### ip_forward -net/ipv4/ip_forward = 1 + > _Enable IP routing. Required if your firewall is protecting a network, NAT included._ +```bash +cat << EOF >> /etc/sysctl.d/40-custom.conf +net/ipv4/ip_forward = 1 EOF ``` +- [Introduction to routers](http://linux-training.be/security/ch10.html) +- [How to Enable IP Forwarding in Linux](http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/) +- [What is kernel ip forwarding?](https://unix.stackexchange.com/questions/14056/what-is-kernel-ip-forwarding) + ### How it works?