Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 22)

5. Step 3: Firewalls and Setting Access Policies

So what is a "firewall"? It's a vague term that can mean anything that acts as a protective barrier between us

and the outside world. This can be a dedicated system, or a specific application that provides this

functionality. Or it can be a combination of components, including various combinations of hardware and

software. Firewalls are built from "rules" that are used to define what is allowed to enter and exit a given

system or network. Let's look at some of the possible components that are readily available for Linux, and

how we might implement a reasonably safe firewalling strategy.

In Step 1 above, we have turned off all services we don't need. In our example, there were a few we still

needed to have running. In this section, we will take the next step here and decide which we need to leave

open to the world. And which we might be able to restrict in some way. If we can block them all, so much the

better, but this is not always practical.

5.1. Strategy

What we want to do now is restrict connections and traffic so that we only allow the minimum necessary for

whatever our particular situation is. In some cases we may want to block all incoming "new" connection

attempts. Example: we want to run X, but don't want anyone from outside to access it, so we'll block it

completely from outside connections. In other situations, we may want to limit, or restrict, incoming

connections to trusted sources only. The more restrictive, the better. Example: we want to ssh into our system

from outside, but we only ever do this from our workplace. So we'll limit sshd connections to our workplace

address range. There are various ways to do this, and we'll look at the most common ones.

We also will not want to limit our firewall to any one application. There is nothing wrong with a

"layered" defense−in−depth approach. Our front line protection will be a packet filter −− either ipchains or

iptables (see below). Then we can use additional tools and mechanisms to reinforce our firewall.

We will include some brief examples. Our rule of thumb will be to deny everything as the default policy, then

open up just what we need. We'll try to keep this as simple as possible since it can be an involved and

complex topic, and just stick to some of the most basic concepts. See the Links section for further reading on

this topic.

5.2. Packet Filters −− Ipchains and Iptables

"Packet filters" (like ipchains) have the ability to look at individual packets, and make decisions based on

what they find. These can be used for many purposes. One common purpose is to implement a firewall.

Common packet filters on Linux are ipchains which is standard with 2.2 kernels, and iptables which is

available with the more recent 2.4 kernels. iptables has more advanced packet filtering capabilities and is

recommended for anyone running a 2.4 kernel. But either can be effective for our purposes. ipfwadm is a

similar utility for 2.0 kernels (not discussed here).

If constructing your own ipchains or iptables firewall rules seems a bit daunting, there are various sites that

can automate the process. See the Links section. Also the included examples may be used as a starting point.

As of Red Hat 7.1, Red Hat is providing init scripts for ipchains and iptables, and gnome−lokkit for

5. Step 3: Firewalls and Setting Access Policies 19

1 2 ... 17 18 19 20 21 22 23 24 25 26 27 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 22