Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

90

|

Chapter 3: Hardening Linux and Using iptables

We’ve covered only a subset of netfilter’s features, but it’s an extremely useful sub-

set. While local packet filters aren’t a cure-all for system security, they’re one of the

thicker layers of our security onion and well worth the time and effort it takes to

learn iptables and fine-tune your filtering policies.

Checking Your Work with Scanners

You may have heard scare stories about how easy it is for evil system crackers to

probe potential victims’ systems for vulnerabilities using software tools readily avail-

able on the Internet. The bad news is that these stories are generally true. The good

stop)

echo -n "Portcullis rope CUT..."

# Unload all fw rules, leaving default-drop policies

$IPTABLES --flush

;;

status)

echo "Querying iptables status (via iptables --list)..."

$IPTABLES --line-numbers -v --list

;;

*)

echo "Usage: $0 {start|stop|wide_open|status}"

exit 1

;;

esac

iptables for the Lazy

SUSE has a utility for creating iptables policies, called SUSEfirewall2. If you install this

package, all you need to do is edit the file /etc/sysconfig/SUSEfirewall2 (in earlier ver-

sions of SUSE, /etc/rc.config.d/firewall2.rc.config), run SUSEconfig, and reboot. If you

know anything at all about TCP/IP, however, it’s probably not that much more trouble ...