Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A few years ago when I was reading something about linux server security (maybe it was a book) I encountered a command or an application that prevented the netfilter (iptables) rules from being changed, even by the root. Problem is, I don't remember the name or how to find it. But I want it again as I need it now.

Does anyone have any ideas?

Edit: on *BSD is 'kern.securelevel=x'

Thank you, Matic

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I think what you are looking for is LIDS.

More specifically: set root's capabilities to near-nothing, "seal the kernel", and then you would have to modify anything from then on with lidsadm and the like. You can always give yourself capabilities as root, however, with lidsadm -S (LIDS password required.)

A short example would be: lidsadm -S -- +CAP_NET_ADMIN to allow you administer the firewall, and then followed with lidsadm -S -- -CAP_NET_ADMIN.

Further discussion of LIDS is out of the scope of this reply, but suffice it to say it can cause you as much grief as grsecurity/SELinux/libcap2/etc if you are not a careful admin. There is plenty of documentation and it is working with the latest kernels.

HTH.

share|improve this answer

iptables-restore in crontab ?

share|improve this answer
    
No, if you tried to change the rules with iptables it said something like permission denied. The iptables binary was fine and permissions for the file were fine as well. It did something on the kernel level. –  Matic Oct 24 '09 at 18:52
    
grsec - en.wikipedia.org/wiki/Grsecurity - or something similar ? –  petre Oct 24 '09 at 22:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.