From owner-freebsd-chat@FreeBSD.ORG Sun Jan 22 02:10:26 2006 Return-Path: X-Original-To: freebsd-chat@freebsd.org Delivered-To: freebsd-chat@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DC3C616A41F for ; Sun, 22 Jan 2006 02:10:26 +0000 (GMT) (envelope-from freebsdworld@gmail.com) Received: from xproxy.gmail.com (xproxy.gmail.com [66.249.82.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6EDF043D45 for ; Sun, 22 Jan 2006 02:10:26 +0000 (GMT) (envelope-from freebsdworld@gmail.com) Received: by xproxy.gmail.com with SMTP id t12so503745wxc for ; Sat, 21 Jan 2006 18:10:25 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:subject:to:content-type:date:message-id:mime-version:x-mailer:content-transfer-encoding:from; b=gkz+Oa8ys6piKMFS9yywUrmz+5ZgnuJLWtnzxRTuZXkFOIVE3R/QGurvvfwWE+0kjapTTquHJ+M0jb6jRwFutVhcux9mWl1buj9/SRgED7lu398tLtf6qyOeB2wjxa9rxSxc9zJXrKp/INI+mYJ7JkBIem6mo4G8a+YViEAfhfg= Received: by 10.70.11.4 with SMTP id 4mr4316540wxk; Sat, 21 Jan 2006 18:10:25 -0800 (PST) Received: from ?192.168.0.3? ( [72.226.224.84]) by mx.gmail.com with ESMTP id h15sm5216493wxd.2006.01.21.18.10.24; Sat, 21 Jan 2006 18:10:24 -0800 (PST) To: freebsd-chat@freebsd.org Content-Type: text/plain Date: Sat, 21 Jan 2006 21:11:08 -0500 Message-Id: <1137895868.789.4.camel@7Current.FreeBSDWorld.NET> Mime-Version: 1.0 X-Mailer: Evolution 2.4.2.1 FreeBSD GNOME Team Port Content-Transfer-Encoding: 7bit From: Benjamin D Adams Subject: FreeBSD 5.4 with no Firewall? X-BeenThere: freebsd-chat@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Non technical items related to the community List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Jan 2006 02:10:27 -0000 I'm moving my server to a colocation. Its a web-server (Apache 2.0) on FreeBSD 5.4. Should I get a gigabyte firewall first?(I plan on getting one soon) How important? What can I do to help secure the OS its self? Any built in programs I should install first? Thanks for any Help Ben From owner-freebsd-chat@FreeBSD.ORG Sun Jan 22 11:04:56 2006 Return-Path: X-Original-To: freebsd-chat@freebsd.org Delivered-To: freebsd-chat@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B05DB16A420 for ; Sun, 22 Jan 2006 11:04:56 +0000 (GMT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from smtp.infracaninophile.co.uk (ns0.infracaninophile.co.uk [81.187.76.162]) by mx1.FreeBSD.org (Postfix) with ESMTP id E92AA43D45 for ; Sun, 22 Jan 2006 11:04:55 +0000 (GMT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from [IPv6:::1] (localhost [IPv6:::1]) by smtp.infracaninophile.co.uk (8.13.4/8.13.4) with ESMTP id k0MB4hlp021100; Sun, 22 Jan 2006 11:04:43 GMT (envelope-from m.seaman@infracaninophile.co.uk) Message-ID: <43D366C4.7020904@infracaninophile.co.uk> Date: Sun, 22 Jan 2006 11:04:36 +0000 From: Matthew Seaman Organization: Infracaninophile User-Agent: Thunderbird 1.5 (X11/20060113) MIME-Version: 1.0 To: Benjamin D Adams References: <1137895868.789.4.camel@7Current.FreeBSDWorld.NET> In-Reply-To: <1137895868.789.4.camel@7Current.FreeBSDWorld.NET> X-Enigmail-Version: 0.94.0.0 Content-Type: multipart/signed; micalg=pgp-ripemd160; protocol="application/pgp-signature"; boundary="------------enig3E9FECB54ABBD8311697846D" X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2 (smtp.infracaninophile.co.uk [IPv6:::1]); Sun, 22 Jan 2006 11:04:43 +0000 (GMT) X-Virus-Scanned: ClamAV 0.88/1247/Sat Jan 21 10:24:51 2006 on happy-idiot-talk.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,NO_RELAYS autolearn=ham version=3.1.0 X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on happy-idiot-talk.infracaninophile.co.uk Cc: freebsd-chat@freebsd.org Subject: Re: FreeBSD 5.4 with no Firewall? X-BeenThere: freebsd-chat@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Non technical items related to the community List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Jan 2006 11:04:56 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig3E9FECB54ABBD8311697846D Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable Benjamin D Adams wrote: > I'm moving my server to a colocation. Its a web-server (Apache 2.0) on= > FreeBSD 5.4. Should I get a gigabyte firewall first?(I plan on getting= > one soon) How important? What can I do to help secure the OS its self? > Any built in programs I should install first? Sure, you can run a stand-alone FreeBSD box on the Internet without a separate firewall, if you configure it carefully. Mind you, you still ne= ed the same degree of care /with/ a firewall -- it just gives you another la= yer behind which you can get away with a few things. What you need to look out for when securing a machine against attack from= the network: a) processes with network listeners: if there's nothing listening at a particular network port, you can't be attacked through it. Use sockstat(1) to see what programs are listening on your network= interfaces -- including the loopback interface. Do you really need to run that program? Can you reconfigure something that list= ens on all interfaces to bind to just the loopback interface? b) When considering processes that you have to run to provide the intended service -- are they configured to run as securely as possible? Long-lived daemon processes, such as Apache should not be run as the root user[*]. Always run them under an unprivileged= UID that does not have a real shell (/sbin/nologin exists for that= purpose). Make sure that UID cannot write to its home directory (setting daemon users homes to / is fine) or to any other signific= ant locations -- a common mistake is to change the ownership of the webserver's document tree to the UID the web server runs under. =20 Make full use of chroot(8) and jail(8) to further isolate exposed processes from the rest of the system. c) Do your homework, and keep alert to various channels where securit= y information is available. Sites like Secunia (http://secunia.com/= ), the VuXML project (http://www.vuxml.org/freebsd/) and not least an= y mailing lists or newsgroups or fora dedicated to software you're running -- you should keep abreast of all such. Understand the distinction between 'local' and 'remote' compromises or DoSes: it'= s the remote ones you should spend energy worrying about unless you are providing logins on your server to untrusted users. Keep installed software up to date. The ports tree is actually really good at getting security related updates committed promptly. Similarly you should regularly update the OS itself. Track one of= the -SECURITY branches, and upgrade when advisories come out. =20 d) Abhor the use of any program which transmits sensitive information= across networks in plain text. Use ssh(1) exclusively for remote = login access -- preferably with key based auth rather than using passwords. Avoid ftp(1) for copying web content onto servers: any= of scp(1), rsync(1) [over SSH] or WebDAV over HTTPS will serve you be= tter. If you have to display X programs on a remote desktop, always tunn= el the X traffic through ssh(1). e) Configure a local packet filter -- one of pf(4), ipfw(8),ipf(8). Y= our aim should be to be secure even without the firewall in place: it = should be insurance rather than anything more. Sometimes however it is t= he only answer to protecting processes you have to run, but that expose th= emselves=20 on the net. Although there is one class of attack you can eliminate easily usi= ng a packet filter which is hard to do otherwise: spoofing the loopba= ck address. If the machine you're protecting conforms to the 'weak r= outing model' (as FreeBSD does) then it will accept a packet destined for= any of its network interfaces on any other interface irrespective of netw= ork routing. pf(4) makes preventing this really easy. This three lin= e pf.conf(5) will prevent a lot of potential attacks against daemon= s listening on the loopback address, although you'll probably want s= omething a bit more comprehensive in actual use: scrub in pass all antispoof log quick for lo0 Keeping a server properly secured is not rocket science -- mostly it's ju= st common sense. But you cannot just 'secure your server' and then forget a= bout it: lasting security means active maintenance. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW --------------enig3E9FECB54ABBD8311697846D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFD02bL8Mjk52CukIwRA1+wAJ90wWMr0wXkiQ6KNTEMd0D8+FRifgCaA1Fz pUgYo6w3WENFfijgN/iNDeI= =Q1im -----END PGP SIGNATURE----- --------------enig3E9FECB54ABBD8311697846D--