Securing Ubuntu

ShaneH57

I ran Lynis auditing software and it gave me back some things I need to do to my computer. Some of these I just cannot figure out. Can someone please help? Here is the output of Lynis:

-[ Lynis 1.2.9 Results ]-

Tests performed: 160

Warnings:

----------------------------

- [10:46:25] Warning: Couldn't find 2 responsive nameservers [test:NETW-2705] [impact:L]

- [10:46:26] Warning: iptables module(s) loaded, but no rules active [test:FIRE-4512] [impact:L]

Suggestions:

----------------------------

- [10:45:56] Suggestion: Configure password aging limits to enforce password changing on a regular base [test:AUTH-9286]

- [10:45:57] Suggestion: To decrease the impact of a full /tmp file system, place /tmp on a separated partition [test:FILE-6310]

- [10:45:58] Suggestion: Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft [test:STRG-1840]

- [10:45:58] Suggestion: Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft [test:STRG-1846]

- [10:46:25] Suggestion: Install package apt-show-versions for patch management purposes [test:PKGS-7394]

- [10:46:25] Suggestion: Check your resolv.conf file and fill in a backup nameserver if possible [test:NETW-2705]

- [10:46:26] Suggestion: Disable iptables kernel module if not used or make sure rules are being used [test:FIRE-4512]

- [10:46:26] Suggestion: Configure a firewall/packet filter to filter incoming and outgoing traffic [test:FIRE-4590]

- [10:46:35] Suggestion: Enable logging to an external logging host for archiving purposes and additional protection [test:LOGG-2154]

- [10:46:38] Suggestion: Enable auditd to collect audit information [test:ACCT-9628]

- [10:46:44] Suggestion: Check ntpq peers output for time source candidates [test:TIME-3128]

- [10:46:48] Suggestion: Install a file integrity tool [test:FINT-4350]

- [10:46:52] Suggestion: Harden the system by removing unneeded compilers. This can decrease the chance of customized trojans, backdoors and rootkits to be compiled and installed [test:HRDN-7220]

mfillpot

Warnings:
1. This is referring to DNS servers, It is stating that 2 nameservers listed in /etc/resolve.conf are unresponsive. depending on your distro you may not have updated the necessary package to update the nameservers.
2. I'm not currently entirely sure how to see if a nf_ module is being used, but this brings up a good point and I am reviewing it now to find the answer.

Suggestions:
1. Password aging is a questionable practice, if you choose not to employ it then you can disable the associated test as outlined in http://www.rootkit.nl/files/lynis-documentation.html.
2. It is recommended your /tmp directory be placed on an external partition, this heps because /tmp is independent so if your root partition fills /tmp will still be open and the system won't crash from lack of /tmp space.
3. Disabling the USB drivers when not in use is good practice for servers and workstations, but not necessary on home systems, you can disable that test if you like.
4. refer to #3
5. The show versions package is not truly necessary because it is intended to prompt you when a new version of an app is available, the synaptic package manager already does that and downloads the package, you can turn off this test.
6. review your firewall rules "iptables -L", it is recommending to disable iptables to converse resources if it now not used or remove packet rules that are not being used. This can speed up network packets.
7. Tist, Tist... your firewall is not being used, it wants you to setup packet filtering using iptables. What is your IP, I can have fun with you?
8. Logging to an external host is advisable for workstations and servers for auditing purposes, but not necessary for a home system. IF you determine it is not necessary for your system then you can turn off this test.
9. The auditd process seems to write notifications when disk space is limited, if you routinely check your system with "df -h" then it is not needed and you can turn off the test.
10. This is stating that you don't have any network time protocol syncing servers setup, having your system sync the time is quite useful for security logging so I recommend that you read ntpdate to figure out how to setup the system to sync the time.
11. file integrity tools are useful for determine if system of config siles have been modified, you can find a short list of tools at http://www.hackinglinuxexposed.com/resources/ in the "file integrity tools" section. I highly recommend that you set this up, it will help you to identify if you have been hacked and will simplify recovery .
12. Unless you compile apps on your system (most buntu users don't) removing the compiler programs is beneficial because it can stop a script from running on your system and auto-compiling malicious programs.

I hope this helps.

ShaneH57

Thanks for helping me. Right after I posted that I installed a firewall but now it keeps giving me this: Found possible unused iptables rules (1 2 3 4 5 3 6 1 1 5 6 7 8 9 10 12 1 4 5 1 1 2 1).

mfillpot

Most likely the order of your firewall rules is what is rendering some of them unused.

All Linux based systems have iptables installed by default, it is up to the user to generate the rule sets, this can be done by hand (as I do) or by using a user interface, which you probably installed. Can you please tell us what user interface you installed?

Additionally if you feel safe enough you can post the output of "sudo iptable -L" so we can evaluate the listed rules and find which are not being used and also recommend improvements.

ShaneH57

Here is the output of iptables -L : Chain INPUT (policy DROP)
target prot opt source destination
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere

Chain ufw-after-forward (1 references)
target prot opt source destination

Chain ufw-after-input (1 references)
target prot opt source destination
RETURN udp -- anywhere anywhere udp dpt:netbios-ns
RETURN udp -- anywhere anywhere udp dpt:netbios-dgm
RETURN tcp -- anywhere anywhere tcp dpt:netbios-ssn
RETURN tcp -- anywhere anywhere tcp dpt:microsoft-ds
RETURN udp -- anywhere anywhere udp dpt:bootps
RETURN udp -- anywhere anywhere udp dpt:bootpc
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
target prot opt source destination

Chain ufw-after-logging-input (1 references)
target prot opt source destination

Chain ufw-after-logging-output (1 references)
target prot opt source destination

Chain ufw-after-output (1 references)
target prot opt source destination

Chain ufw-before-forward (1 references)
target prot opt source destination
ufw-user-forward all -- anywhere anywhere

Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ufw-logging-deny all -- anywhere anywhere state INVALID
DROP all -- anywhere anywhere state INVALID
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ufw-not-local all -- anywhere anywhere
ACCEPT all -- BASE-ADDRESS.MCAST.NET/4 anywhere
ACCEPT all -- anywhere BASE-ADDRESS.MCAST.NET/4
ufw-user-input all -- anywhere anywhere

Chain ufw-before-logging-forward (1 references)
target prot opt source destination

Chain ufw-before-logging-input (1 references)
target prot opt source destination

Chain ufw-before-logging-output (1 references)
target prot opt source destination

Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ufw-user-output all -- anywhere anywhere

Chain ufw-logging-allow (0 references)
target prot opt source destination

Chain ufw-logging-deny (2 references)
target prot opt source destination

Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10
DROP all -- anywhere anywhere

Chain ufw-reject-forward (1 references)
target prot opt source destination

Chain ufw-reject-input (1 references)
target prot opt source destination

Chain ufw-reject-output (1 references)
target prot opt source destination

Chain ufw-track-input (1 references)
target prot opt source destination

Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere state NEW

Chain ufw-user-forward (1 references)
target prot opt source destination

Chain ufw-user-input (1 references)
target prot opt source destination

Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix `[UFW LIMIT BLOCK] '
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain ufw-user-logging-forward (0 references)
target prot opt source destination

Chain ufw-user-logging-input (0 references)
target prot opt source destination

Chain ufw-user-logging-output (0 references)
target prot opt source destination

Chain ufw-user-output (1 references)
target prot opt source destination

mfillpot

This is a complexed chain, did you do this by hand or with a script/GUI tool?

mfillpot

I found that you are using the Ubuntu Uncomplicated Firewall (http://en.wikipedia.org/wiki/Uncomplicated_Firewall).

After putting the rules in order I am seeing a lot of unneeded steps that you probably can't cut out without risking breaking the UFW tools.

The following chains are not currently used or are empty and should be removed, in addition any references to these chains should be removed:

EMPTY
[ol][li]ufw-before-logging-input [/li][li]ufw-logging-deny[/li][li]ufw-user-input [/li][li]ufw-after-logging-input[/li][li]ufw-reject-input all[/li][li]ufw-track-input[/li][li]ufw-before-logging-forward[/li][li]ufw-before-forward [/li][li]ufw-user-forward[/li][li]ufw-after-forward[/li][li]ufw-after-logging-forward[/li][li]ufw-reject-forward[/li][li]ufw-before-logging-output[/li][li]ufw-user-output[/li][li]ufw-after-output[/li][li]ufw-after-logging-output[/li][li]ufw-reject-output[/li][/ol]

NOT USED
[ol][li]ufw-logging-allow[/li][li]ufw-user-logging-output [/li][li]ufw-user-limit-accept[/li][li]ufw-user-logging-forward[/li][li]ufw-user-logging-input[/li][li]ufw-user-limit[/li][/ol]

I am attaching a doc document showing your firewall with the operations broke down by order of operation, all items to remove are highlighted yellow, and all remaining rules that are never evaluated are grey.

I know this firewall was meant to be simple but immediately I see some issues in the order of operation that make it useless, listed below are the major issues.
[ol][li]The first real input filter tells it to accept everything, all other input rules are ignored.[/li][li]If #1 wasn't an issue the firewall would still allow all UDP traffic inbound.[/li][li]The forward policies are effectively blank[/li][li]The first effective output policy allows all traffic out, all rules below that are ignored.[/li][/ol]

By what I am seeing it is giving you a false impression of security and doing nothing.

So the warning you are receiving is because of all of the blank chains and the fact that the chains that should be securing the system are never reached.

mfillpot

Ok, the attachment is here, [file name=ufw.doc size=23040]http://www.linux.com/media/kunena/attachments/legacy/files/ufw.doc[/file]