Chapter 4.4 Linux Host Security

Which command would you use to list all of the currently defined iptables rules? sudo iptables -F sudo /sbin/iptables-save sudo iptables -L sudo iptables -A INPUT -j DROP

sudo iptables -L

You want to make sure no unneeded software packages are running on your Linux server. Select the command from the drop-down list that you can use to see all installed RPM packages. yum list packages yum list rpm packages yum list installed yum list rpm installed

yum list installed

Question 7 In which of the iptables default chains would you configure a rule to allow an external device to access the HTTPS port on the Linux server? Forward Accept Output Input

Input

Question 1 Which command should you use to display both listening and non-listening sockets on your Linux system? (Tip: enter the command as if in Command Prompt.)

netstat -a

Question 3 You need to increase the security of your Linux system by finding and closing open ports. Which of the following commands should you use to locate open ports? nslookup netstat nmap traceroute

nmap

Question 2 Which command should you use to scan for open TCP ports on your Linux system? (Tip: enter the command as if in Command Prompt.)

nmap -sT

Action: Clear current rules

Command: sudo iptables -F

Action: List current rules

Command: sudo iptables -L

Question 4 What does the netstat -a command show? All listening and non-listening sockets All network users All connected hosts All listening sockets

All listening and non-listening sockets

You have configured the following rules. What is the effect? sudo iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT Allow SSH traffic Block SMTP traffic Allow SMTP traffic Block SSH traffic

Allow SMTP traffic

Accept

Allows the connection.

Action:Allow HTTP traffic on portAllow HTTPS traffic on port 443

Command: sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Action: Block connections from 192.168.0.254

Command: sudo iptables -A INPUT -s 192.168.0.254 -j DROP

Action: Save iptables changes (Ubuntu)

Command: sudo /sbin/iptables-save The command may be different on other Linux systems.

Action: Drop all incoming traffic

Command: sudo iptables -A INPUT -j DROP

Action: Allow SMTP mail on port 25

Command: sudo iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Action: Allow HTTP traffic on port 80

Command: sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT (To allow HTTPS, you would use port 443.)

Action: Block SMTP mail on port 25

Command: sudo iptables -A OUTPUT -p tcp --dport 25 -j REJECT

Question 6 Which action would you use in a rule to disallow a connection silently? Forward Drop Reject Accept

Drop

Drop

Drops the connection. For example, an IP address in a rule with a drop action pings your system; the request is dropped. No response is sent to the user.

Check network connections

Open network connections (open sockets) on a computer create a security risk. A socket is an endpoint of a bi-directional communication flow across a computer network. Use the following netstat (network statistics) options to identify the open network connections on Linux systems: -a lists both listening and non-listening sockets. -l (lowercase 'L') lists listening sockets. -s displays statistics for each protocol. -i displays a table of all network interfaces.

Locate open ports

Open ports can provide information about which operating system a computer uses. Also, they can provide entry points or information about ways to formulate an attack. To locate open ports: 1.Install the nmap utility if it is not already installed. *yum install nmap *apt -i nmap 2.Use both of the following commands to scan for open ports: *nmap -sT ipaddress|fqdn scans for TCP ports *nmap -sU ipaddress|fqdn scans for UDP ports 3.Determine which services use the open ports. 4.Disable any unused service using the open ports information. (Make sure the service used is not a dependency for another service). *systemctl disable servicename *systemctl stop servicename

Which type of packet would the sender receive if they sent a connection request to TCP port 25 on a server with the following command applied? sudo iptables -A OUTPUT -p tcp --dport 25 -j REJECT RST ACK SYN ICMP Unreachable Port

RST

Reject

Rejects the connection, but will send a response back. This lets the sender know that the traffic reached a system, but was rejected.

Chains

The Linux iptables firewall utility uses policy chains (sets of rules) to allow or block network traffic. When a connection is initiated to your system, iptables looks for a matching rule. If it doesn't find one, it uses the default action in the tables. Be aware that iptables almost always comes pre-installed on any Linux distribution.

Input

This chain controls the behavior for incoming connections. For example, if a user attempts to ping the system, iptables attempts to match the IP address and port to a rule in the input chain

Output

This chain is used for outgoing connections. For example, if you ping testout.com, iptables checks its output chain to see what the rules are regarding ping and testout.com before allowing or denying the ping request.

Forward

This chain is used for packets leaving the system. These are incoming connections that aren't delivered locally. In other words, the traffic is not destined for the router; the router forwards the traffic to the destination device.

Check for unnecessary network services

Unnecessary network services waste computer resources and increase the system's attack service. To remove unnecessary network services: 1.Find all installed services and determine which are not needed: DNS, SNMP, DHCP and others. *systemctl --type=service --state=active 2.Use the man command and the Internet to research services you don't recognize. *If the service is not needed, determine if it is a dependency for another service. 3.Disable the service by using the following command: *systemctl disable servicename 4.Use one of the following commands to immediately stop the script: *systemctl stop servicename 5.Use one of the following commands to remove the script package entirely. yum erase packagename apt remove packagename rpm -e packagename dpkg -r packagename

Remove unnecessary software

Unnecessary software occupies disk space and could introduce security flaws. To remove unnecessary software: 1.Enter one of the following commands: yum list installed to see installed RPM packages on the computer. apt *apt autoremove automatically removes unused packages *apt list list all installed packages dpkg get-selections to see installed Debian packages on the computer. 2.Research the function of any unrecognized package to determine if it is necessary. 3.Use one of the following commands to uninstall unnecessary packages. yum erase packagename apt remove packagename rpm -e packagename dpkg -r packagename

Actions Performed

You can accept, drop, or reject the connections. After you define your accept rules, you should create a rule to drop all other traffic to prevent unauthorized access to the system.

iptables

iptables is a firewall command line utility for Linux operation systems that uses three policy chains to allow or block network traffic.