Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have few generic questions about firewalls and I thought the community up here could help me out.

1) So I recently installed Ubuntu server barebones. I checked for open ports, none were open which was great. Is that because there was a firewall installed or was it because there were no applications installed?

2) I installed some applications, (Apache, postgres,ssh, Java app and some few). Between these, I ended up opening a few ports (~10). Now I have a list of all the ports I would need open. So, how do I go about protecting them? [Is this the right question to ask? does the process go like this, Install Firewall -> Allow Said needed ports -> deny rest using IPtables rules]

This is going to be open to the internet. Hosting low traffic ecommerce sites.

3) What do you think is the easiest way for me to quasi-secure the server, [low maintenance overhead/simplicity. Any open source "software" which can make my life easier?]

4) Finally, of the said open ports [2], I have 2 ports I need to close because they are telnet ports. Can I close these ports without installing a "firewall"

Thanks all for the help and Merry Christmas!!!!!!!

share|improve this question

3 Answers 3

  1. You had no listening ports because you had no listening processes. Ubuntu does a good job in this respect on a default installation. Those processes which do require a listening port usually use localhost (127.0.0.1) by default. This prevents direct access from remote systems.
  2. Applications such as Apache and SSH server are expected to listen connections from remote servers. Apache has its own ACL lists to secure access. SSH server can be secured using the hosts.allow and hosts.deny files in addition to its configuration. Applications my MySQL and PostressSQL should listen on localhost by default. If you need access from other system you will need to change their listener configuration. They will usually have one or more mechanisms for securing access.
  3. Use hosts.allow/hosts.deny for application which support this mechanism. Using a firewall builder like Shorewall to build a secure firewall helps. Understanding each application's own security mechanisms helps build depth in your mechanisms. A tool like logcheck can monitor your logs and notify you of some of the events you may need to check. I use Munin to monitor my systems and in some cases alert me of issues. This is replacing previous use of Nagion and MRTG for monitoring and graphing system usage.
  4. If you have telnet running, you can close the ports by stopping the service. Unless you really need it, remove the telnet package and replace it with ssh-server. Most telnet servers support use of hosts.allow/hosts.deny to restrict access. This also applies to applications which run under inetd or xinetd. MySQL and PostgreSQL should listen only on 127.0.0.1 which is secure from direct access from outside your server.

My usual Shorewall firewall configuration starts with the example configuration for the number of interfaces on the server (or access zones: NET, LAN, DMZ). Note that if the zones share interfaces and or routers the may be less secure than they could be. Then I adjust rules as required.

I often to disable any default outbound access policies. These are replaced with rules allowing outbound access on the required ports (DNS, NTP, SMTP, etc.).

share|improve this answer
    
+1. Good recommendations. –  Steven Monday Dec 26 '10 at 6:34

1.) you can always check it with iptables -L this output stand for no firewall:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

2.) yes, just allow the ports in the input chain on your interface (i.e. eth0) and drop everything else.

you should also do some other things like:

  • NULL
  • xmas (SYN+FIN+ACK)
  • SYN-FIN

and don't forget to set the important sysctl options

3.) easy ways:

  • firewall: http://easyfwgen.morizot.net/gen/
  • log analysis tool, that informs you about threats
  • other tools, that do proactive checks (i.e. fail2ban)
  • monitoring tools, that informs you about your machines state (i.e. zabbix, nagios)

4.) type the following command

root@host:~# netstat -npl | grep LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1417/telnet

the interesting number is the 1417 (processnumber) after the telnet. kill it with kill -9 1417

but be careful with what you kill!

if you don't want to kill it, you can just use the firewall to deny this port from being used...

share|improve this answer

1) You could (check yourself by) install ssh and try to see if in another computer with an nmap show the port 22 as open. 2) This is a big answer. You have to know exactly what kind of protection do you want to give to your services... 3) ? 4) close the inetd service

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.