Welcome to the Linux Foundation Forum!
Securing Ubuntu
Options
I ran Lynis auditing software and it gave me back some things I need to do to my computer. Some of these I just cannot figure out. Can someone please help? Here is the output of Lynis:
-[ Lynis 1.2.9 Results ]-
Tests performed: 160
Warnings:
----------------------------
- [10:46:25] Warning: Couldn't find 2 responsive nameservers [test:NETW-2705] [impact:L]
- [10:46:26] Warning: iptables module(s) loaded, but no rules active [test:FIRE-4512] [impact:L]
Suggestions:
----------------------------
- [10:45:56] Suggestion: Configure password aging limits to enforce password changing on a regular base [test:AUTH-9286]
- [10:45:57] Suggestion: To decrease the impact of a full /tmp file system, place /tmp on a separated partition [test:FILE-6310]
- [10:45:58] Suggestion: Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft [test:STRG-1840]
- [10:45:58] Suggestion: Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft [test:STRG-1846]
- [10:46:25] Suggestion: Install package apt-show-versions for patch management purposes [test:PKGS-7394]
- [10:46:25] Suggestion: Check your resolv.conf file and fill in a backup nameserver if possible [test:NETW-2705]
- [10:46:26] Suggestion: Disable iptables kernel module if not used or make sure rules are being used [test:FIRE-4512]
- [10:46:26] Suggestion: Configure a firewall/packet filter to filter incoming and outgoing traffic [test:FIRE-4590]
- [10:46:35] Suggestion: Enable logging to an external logging host for archiving purposes and additional protection [test:LOGG-2154]
- [10:46:38] Suggestion: Enable auditd to collect audit information [test:ACCT-9628]
- [10:46:44] Suggestion: Check ntpq peers output for time source candidates [test:TIME-3128]
- [10:46:48] Suggestion: Install a file integrity tool [test:FINT-4350]
- [10:46:52] Suggestion: Harden the system by removing unneeded compilers. This can decrease the chance of customized trojans, backdoors and rootkits to be compiled and installed [test:HRDN-7220]
0
Comments
-
Warnings:
1. This is referring to DNS servers, It is stating that 2 nameservers listed in /etc/resolve.conf are unresponsive. depending on your distro you may not have updated the necessary package to update the nameservers.
2. I'm not currently entirely sure how to see if a nf_ module is being used, but this brings up a good point and I am reviewing it now to find the answer.
Suggestions:
1. Password aging is a questionable practice, if you choose not to employ it then you can disable the associated test as outlined in http://www.rootkit.nl/files/lynis-documentation.html.
2. It is recommended your /tmp directory be placed on an external partition, this heps because /tmp is independent so if your root partition fills /tmp will still be open and the system won't crash from lack of /tmp space.
3. Disabling the USB drivers when not in use is good practice for servers and workstations, but not necessary on home systems, you can disable that test if you like.
4. refer to #3
5. The show versions package is not truly necessary because it is intended to prompt you when a new version of an app is available, the synaptic package manager already does that and downloads the package, you can turn off this test.
6. review your firewall rules "iptables -L", it is recommending to disable iptables to converse resources if it now not used or remove packet rules that are not being used. This can speed up network packets.
7. Tist, Tist... your firewall is not being used, it wants you to setup packet filtering using iptables. What is your IP, I can have fun with you?
8. Logging to an external host is advisable for workstations and servers for auditing purposes, but not necessary for a home system. IF you determine it is not necessary for your system then you can turn off this test.
9. The auditd process seems to write notifications when disk space is limited, if you routinely check your system with "df -h" then it is not needed and you can turn off the test.
10. This is stating that you don't have any network time protocol syncing servers setup, having your system sync the time is quite useful for security logging so I recommend that you read ntpdate to figure out how to setup the system to sync the time.
11. file integrity tools are useful for determine if system of config siles have been modified, you can find a short list of tools at http://www.hackinglinuxexposed.com/resources/ in the "file integrity tools" section. I highly recommend that you set this up, it will help you to identify if you have been hacked and will simplify recovery .
12. Unless you compile apps on your system (most buntu users don't) removing the compiler programs is beneficial because it can stop a script from running on your system and auto-compiling malicious programs.
I hope this helps.0 -
Thanks for helping me. Right after I posted that I installed a firewall but now it keeps giving me this: Found possible unused iptables rules (1 2 3 4 5 3 6 1 1 5 6 7 8 9 10 12 1 4 5 1 1 2 1).0
-
Most likely the order of your firewall rules is what is rendering some of them unused.
All Linux based systems have iptables installed by default, it is up to the user to generate the rule sets, this can be done by hand (as I do) or by using a user interface, which you probably installed. Can you please tell us what user interface you installed?
Additionally if you feel safe enough you can post the output of "sudo iptable -L" so we can evaluate the listed rules and find which are not being used and also recommend improvements.0 -
Here is the output of iptables -L : Chain INPUT (policy DROP)
target prot opt source destination
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
RETURN udp -- anywhere anywhere udp dpt:netbios-ns
RETURN udp -- anywhere anywhere udp dpt:netbios-dgm
RETURN tcp -- anywhere anywhere tcp dpt:netbios-ssn
RETURN tcp -- anywhere anywhere tcp dpt:microsoft-ds
RETURN udp -- anywhere anywhere udp dpt:bootps
RETURN udp -- anywhere anywhere udp dpt:bootpc
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
Chain ufw-after-logging-input (1 references)
target prot opt source destination
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ufw-user-forward all -- anywhere anywhere
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ufw-logging-deny all -- anywhere anywhere state INVALID
DROP all -- anywhere anywhere state INVALID
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ufw-not-local all -- anywhere anywhere
ACCEPT all -- BASE-ADDRESS.MCAST.NET/4 anywhere
ACCEPT all -- anywhere BASE-ADDRESS.MCAST.NET/4
ufw-user-input all -- anywhere anywhere
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ufw-user-output all -- anywhere anywhere
Chain ufw-logging-allow (0 references)
target prot opt source destination
Chain ufw-logging-deny (2 references)
target prot opt source destination
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10
DROP all -- anywhere anywhere
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere state NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix `[UFW LIMIT BLOCK] '
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination0 -
This is a complexed chain, did you do this by hand or with a script/GUI tool?0
-
I found that you are using the Ubuntu Uncomplicated Firewall (http://en.wikipedia.org/wiki/Uncomplicated_Firewall).
After putting the rules in order I am seeing a lot of unneeded steps that you probably can't cut out without risking breaking the UFW tools.
The following chains are not currently used or are empty and should be removed, in addition any references to these chains should be removed:
EMPTY
[ol][li]ufw-before-logging-input [/li][li]ufw-logging-deny[/li][li]ufw-user-input [/li][li]ufw-after-logging-input[/li][li]ufw-reject-input all[/li][li]ufw-track-input[/li][li]ufw-before-logging-forward[/li][li]ufw-before-forward [/li][li]ufw-user-forward[/li][li]ufw-after-forward[/li][li]ufw-after-logging-forward[/li][li]ufw-reject-forward[/li][li]ufw-before-logging-output[/li][li]ufw-user-output[/li][li]ufw-after-output[/li][li]ufw-after-logging-output[/li][li]ufw-reject-output[/li][/ol]
NOT USED
[ol][li]ufw-logging-allow[/li][li]ufw-user-logging-output [/li][li]ufw-user-limit-accept[/li][li]ufw-user-logging-forward[/li][li]ufw-user-logging-input[/li][li]ufw-user-limit[/li][/ol]
I am attaching a doc document showing your firewall with the operations broke down by order of operation, all items to remove are highlighted yellow, and all remaining rules that are never evaluated are grey.
I know this firewall was meant to be simple but immediately I see some issues in the order of operation that make it useless, listed below are the major issues.
[ol][li]The first real input filter tells it to accept everything, all other input rules are ignored.[/li][li]If #1 wasn't an issue the firewall would still allow all UDP traffic inbound.[/li][li]The forward policies are effectively blank[/li][li]The first effective output policy allows all traffic out, all rules below that are ignored.[/li][/ol]
By what I am seeing it is giving you a false impression of security and doing nothing.
So the warning you are receiving is because of all of the blank chains and the fact that the chains that should be securing the system are never reached.0 -
Ok, the attachment is here, [file name=ufw.doc size=23040]http://www.linux.com/media/kunena/attachments/legacy/files/ufw.doc[/file]0
Categories
- All Categories
- 61 LFX Mentorship
- 114 LFX Mentorship: Linux Kernel
- 618 Linux Foundation IT Professional Programs
- 322 Cloud Engineer IT Professional Program
- 141 Advanced Cloud Engineer IT Professional Program
- 56 DevOps Engineer IT Professional Program
- 67 Cloud Native Developer IT Professional Program
- 6 Express Training Courses
- 6 Express Courses - Discussion Forum
- 2.3K Training Courses
- 19 LFC110 Class Forum - Discontinued
- 9 LFC131 Class Forum
- 31 LFD102 Class Forum
- 178 LFD103 Class Forum
- LFD110 Class Forum
- 24 LFD121 Class Forum
- LFD133 Class Forum
- 2 LFD137 Class Forum
- 62 LFD201 Class Forum
- 2 LFD210 Class Forum
- 1 LFD210-CN Class Forum
- 1 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum - Discontinued
- LFD233 Class Forum
- LFD237 Class Forum
- 23 LFD254 Class Forum
- 659 LFD259 Class Forum
- 108 LFD272 Class Forum
- 1 LFD272-JP クラス フォーラム
- 4 LFD273 Class Forum
- LFS101 Class Forum
- LFS116 Class Forum
- 2 LFS145 Class Forum
- 28 LFS200 Class Forum
- 740 LFS201 Class Forum - Discontinued
- 1 LFS201-JP クラス フォーラム
- 13 LFS203 Class Forum
- 98 LFS207 Class Forum
- 301 LFS211 Class Forum
- 54 LFS216 Class Forum
- 47 LFS241 Class Forum
- 41 LFS242 Class Forum
- 38 LFS243 Class Forum
- 12 LFS244 Class Forum
- LFS245 Class Forum
- 41 LFS250 Class Forum
- 1 LFS250-JP クラス フォーラム
- LFS251 Class Forum
- 143 LFS253 Class Forum
- LFS254 Class Forum
- LFS255 Class Forum
- 2 LFS256 Class Forum
- LFS257 Class Forum
- 1.2K LFS258 Class Forum
- 10 LFS258-JP クラス フォーラム
- 108 LFS260 Class Forum
- 147 LFS261 Class Forum
- 39 LFS262 Class Forum
- 83 LFS263 Class Forum - Discontinued
- 15 LFS264 Class Forum - Discontinued
- 11 LFS266 Class Forum - Discontinued
- 21 LFS267 Class Forum
- 18 LFS268 Class Forum
- 26 LFS269 Class Forum
- 204 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- LFS274 Class Forum
- 3 LFS281 Class Forum
- 258 LFW211 Class Forum
- 179 LFW212 Class Forum
- 9 SKF100 Class Forum
- SKF200 Class Forum
- 908 Hardware
- 221 Drivers
- 74 I/O Devices
- 44 Monitors
- 116 Multimedia
- 210 Networking
- 102 Printers & Scanners
- 86 Storage
- 765 Linux Distributions
- 88 Debian
- 66 Fedora
- 15 Linux Mint
- 13 Mageia
- 24 openSUSE
- 144 Red Hat Enterprise
- 33 Slackware
- 13 SUSE Enterprise
- 357 Ubuntu
- 483 Linux System Administration
- 40 Cloud Computing
- 70 Command Line/Scripting
- Github systems admin projects
- 95 Linux Security
- 80 Network Management
- 108 System Management
- 52 Web Management
- 74 Mobile Computing
- 25 Android
- 34 Development
- 1.2K New to Linux
- 1.1K Getting Started with Linux
- 544 Off Topic
- 131 Introductions
- 223 Small Talk
- 22 Study Material
- 835 Programming and Development
- 284 Kernel Development
- 517 Software Development
- 975 Software
- 261 Applications
- 185 Command Line
- 3 Compiling/Installing
- 119 Games
- 318 Installation
- 65 All In Program
- 65 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)