4.18.1. Configurando características de rede do kernel
Many features of the kernel can be modified while running by echoing something into the
/proc file system or by using
sysctl. By entering
/sbin/sysctl -A you can see what you can configure and what the options are, and it can be modified running
/sbin/sysctl -w variable=value
(see
sysctl(8)). Only in rare cases do you need to edit something here, but you can increase security that way as well. For example:
net/ipv4/icmp_echo_ignore_broadcasts = 1
This is a Windows emulator because it acts like Windows on broadcast ping if this option is set to 1. That is, ICMP echo requests sent to the broadcast address will be ignored. Otherwise, it does nothing.
Se quer evitar que o seu sistema responda requisições ICMP, apenas ative esta opção de configuração:
net/ipv4/icmp_echo_ignore_all = 1
Para registrar pacotes com endereços impossíveis (devido a roteamento incorreto) em seu sistema, use:
/proc/sys/net/ipv4/conf/all/log_martians = 1
For more information on what things can be done with
/proc/sys/net/ipv4/* read
/usr/src/linux/Documentation/filesystems/proc.txt. All the options are described thoroughly under
/usr/src/linux/Documentation/networking/ip-sysctl.txt.
4.18.2. Configuring syncookies
Esta opção é uma faca de dois gumes. De um lado ela protege o seu sistema contra flood de pacotes syn; por outro lado ela viola os padrões definidos (RFCs).
net/ipv4/tcp_syncookies = 1
If you want to change this option each time the kernel is working you need to change it in
/etc/network/options by setting
syncookies=yes. This will take effect when ever
/etc/init.d/networking is run (which is typically done at boot time) while the following will have a one-time effect until the reboot:
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
This option will only be available if the kernel is compiled with the
CONFIG_SYNCOOKIES. All Debian kernels are compiled with this option builtin but you can verify it running:
$ sysctl -A |grep syncookies
net/ipv4/tcp_syncookies = 1
4.18.3. Tornando a rede segura em tempo de inicialização
Quando definir opções de configuração do kernel para a rede, você precisará configurá-la de forma que seja carregada sempre que o sistema for iniciado. O seguinte exemplo ativa muitas das opções anteriores assim como outras opções úteis.
There are actually two ways to configure your network at boot time. You can configure /etc/sysctl.conf (see: sysctl.conf(5)) or introduce a script that is called when the interface is enabled. The first option will be applied to all interfaces, whileas the second option allows you to configure this on a per-interface basis.
An example of a
/etc/sysctl.conf configuration that will secure some network options at the kernel level is shown below. Notice the comment in it,
/etc/network/options might override some values if they contradict those in this file when the
/etc/init.d/networking is run (which is later than
procps on the startup sequence).
#
# /etc/sysctl.conf - Configuration file for setting system variables
# See sysctl.conf (5) for information. Also see the files under
# Documentation/sysctl/, Documentation/filesystems/proc.txt, and
# Documentation/networking/ip-sysctl.txt in the kernel sources
# (/usr/src/kernel-$version if you have a kernel-package installed)
# for more information of the values that can be defined here.
#
# Be warned that /etc/init.d/procps is executed to set the following
# variables. However, after that, /etc/init.d/networking sets some
# network options with builtin values. These values may be overridden
# using /etc/network/options.
#
#kernel.domainname = example.com
# Additional settings - adapted from the script contributed
# by Dariusz Puchala (see below)
# Ignore ICMP broadcasts
net/ipv4/icmp_echo_ignore_broadcasts = 1
#
# Ignore bogus ICMP errors
net/ipv4/icmp_ignore_bogus_error_responses = 1
#
# Do not accept ICMP redirects (prevent MITM attacks)
net/ipv4/conf/all/accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net/ipv4/conf/all/secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
net/ipv4/conf/all/send_redirects = 0
#
# Do not forward IP packets (we are not a router)
# Note: Make sure that /etc/network/options has 'ip_forward=no'
net/ipv4/conf/all/forwarding = 0
#
# Enable TCP Syn Cookies
# Note: Make sure that /etc/network/options has 'syncookies=yes'
net/ipv4/tcp_syncookies = 1
#
# Log Martian Packets
net/ipv4/conf/all/log_martians = 1
#
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
# Note: Make sure that /etc/network/options has 'spoofprotect=yes'
net/ipv4/conf/all/rp_filter = 1
#
# Do not accept IP source route packets (we are not a router)
net/ipv4/conf/all/accept_source_route = 0
To use the script you need to first create the script, for example, in
/etc/network/interface-secure (the name is given as an example) and call it from
/etc/network/interfaces like this:
auto eth0
iface eth0 inet static
address xxx.xxx.xxx.xxx
netmask 255.255.255.xxx
broadcast xxx.xxx.xxx.xxx
gateway xxx.xxx.xxx.xxx
pre-up /etc/network/interface-secure
In this example, before the interface eth0 is enabled the script will be called to secure all network interfaces as shown below.
#!/bin/sh -e
# Script-name: /etc/network/interface-secure
#
# Modifies some default behavior in order to secure against
# some TCP/IP spoofing & attacks for all interfaces.
#
# Contributed by Dariusz Puchalak.
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Broadcast echo protection enabled.
echo 0 > /proc/sys/net/ipv4/conf/all/forwarding
# IP forwarding disabled.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies # TCP syn cookies protection enabled.
echo 1 >/proc/sys/net/ipv4/conf/all/log_martians # Log strange packets.
# (this includes spoofed packets, source routed packets, redirect packets)
# but be careful with this on heavy loaded web servers.
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Bad error message protection enabled.
# IP spoofing protection.
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
# Disable ICMP redirect acceptance.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
# Disable source routed packets.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
exit 0
Notice that you can actually have per-interface scripts that will enable different network options for different interfaces (if you have more than one), just change the pre-up line to:
pre-up /etc/network/interface-secure $IFACE
And use a script which will only apply changes to a specific interface, not to all of the interfaces available. Notice that some networking options can only be enabled globally, however. A sample script is this one:
#!/bin/sh -e
# Script-name: /etc/network/interface-secure
#
# Modifies some default behavior in order to secure against
# some TCP/IP spoofing & attacks for a given interface.
#
# Contributed by Dariusz Puchalak.
#
IFACE=$1
if [ -z "$IFACE" ] ; then
echo "$0: Must give an interface name as argument!"
echo "Usage: $0 <interface>"
exit 1
fi
if [ ! -e /proc/sys/net/ipv4/conf/$IFACE/ ]; then
echo "$0: Interface $IFACE does not exit (cannot find /proc/sys/net/ipv4/conf/)"
exit 1
fi
echo 0 > /proc/sys/net/ipv4/conf/$IFACE/forwarding # IP forwarding disabled.
echo 1 >/proc/sys/net/ipv4/conf/$IFACE/log_martians # Log strange packets.
# (this includes spoofed packets, source routed packets, redirect packets)
# but be careful with this on heavy loaded web servers.
# IP spoofing protection.
echo 1 > /proc/sys/net/ipv4/conf/$IFACE/rp_filter
# Disable ICMP redirect acceptance.
echo 0 > /proc/sys/net/ipv4/conf/$IFACE/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/$IFACE/send_redirects
# Disable source routed packets.
echo 0 > /proc/sys/net/ipv4/conf/$IFACE/accept_source_route
exit 0
An alternative solution is to create an init.d script and have it run on bootup (using update-rc.d to create the appropriate rc.d links).
4.18.4. Configurando características do firewall
In order to have firewall capabilities, either to protect the local system or others behind it, the kernel needs to be compiled with firewall capabilities. The standard Debian 2.2 kernel (Linux 2.2) provides the packet filter ipchains firewall, Debian 3.0 standard kernel (Linux 2.4) provides the stateful packet filter iptables (netfilter) firewall.
In any case, it is pretty easy to use a kernel different from the one provided by Debian. You can find pre-compiled kernels as packages you can easily install in the Debian system. You can also download the kernel sources using the kernel-source-X and build custom kernel packages using make-kpkg from the kernel-package package.
4.18.5. Desativando assuntos relacionados a weak-end de máquinas
Systems with more than one interface on different networks can have services configured so that they will bind only to a given IP address. This usually prevents access to services when requested through any other address. However, this does not mean (although it is a common misconception) that the service is bound to a given
hardware address (interface card).
It seems, however, not to work with services bound to 127.0.0.1, you might need to write the tests using raw sockets.
This is not an ARP issue and it's not an RFC violation (it's called
weak end host in
RFC1122, (in the section 3.3.4.2). Remember, IP addresses have nothing to do with physical interfaces.
Nos kernels da série 2.2 (e anteriores) isto pode ser corrigido com:
# echo 1 > /proc/sys/net/ipv4/conf/all/hidden
# echo 1 > /proc/sys/net/ipv4/conf/eth0/hidden
# echo 1 > /proc/sys/net/ipv4/conf/eth1/hidden
.....
Em outros kernels, isto pode ser corrigido com uma das alternativas:
regras do iptables.
properly configured routing.
Along this text there will be many occasions in which it is shown how to configure some services (sshd server, apache, printer service...) in order to have them listening on any given address, the reader should take into account that, without the fixes given here, the fix would not prevent accesses from within the same (local) network.
FIXME: Comments on Bugtraq indicate there is a Linux specific method to bind to a given interface.
FIXME: Enviar um bug contra o netbase, assim a correção de roteamento será o comportamento padrão no Debian?
4.18.6. Protegendo-se contra ataques ARP
Quando não confia em outras máquinas na sua rede (que deve sempre ser o caso, por ser uma atitude mais segura) você deverá proteger a si mesmo de vários ataques ARP existentes.
As you know the ARP protocol is used to link IP addresses to MAC addresses (see
ftp://ftp.isi.edu/in-notes/rfc826.txt for all the details). Every time you send a packet to an IP address an ARP resolution is done (first by looking into the local ARP cache then if the IP isn't present in the cache by broadcasting an ARP query) to find the target's hardware address. All the ARP attacks aim to fool your box into thinking that box B's IP address is associated to the intruder's box's MAC address; Then every packet that you want to send to the IP associated to box B will be send to the intruder's box...
Those attacks (ARP cache poisoning, ARP spoofing...) allow the attacker to sniff the traffic even on switched networks, to easily hijack connections, to disconnect any host from the network... ARP attacks are powerful and simple to implement, and several tools exists, such as
arpspoof from the
dsniff package or
http://arpoison.sourceforge.net/.
No entanto, sempre existe uma solução:
