Security Checklist

UNDER CONSTRUCTION: The document is currently being modified!

 Back to Category:Arch Linux

Introduction

This is geared at providing a checklists one can walk through after setting up a new Arch Linux installation that has an open connection to the internet. Whether it is a server or just a machine at home that you have ports open on; some if not all of this information might be useful to you.

WARNING: While I have administered BSD and Linux machines for many years now, I am not a security expert!

Crontab

Restricting access to crontab is as simple as creating a /etc/cron.allow and inserting only the names of users you want to allow access to crontab. Every other user on the system will be denied crontab access.

# sudo vim /etc/cron.allow

root kyau

Firewall

Uncomplicated Firewall or ufw is a great choice and it's simple to setup.

Install the package.

# pacaur -S ufw

Setup some basic rules that will allow SSH but deny everything else.

# sudo ufw default deny # sudo ufw allow SSH

WARNING: It is highly recommended to open a new SSH window at this point (without closing the current) and verify SSH access still works.

Enable ufw on boot and then start the service.

# sudo systemctl enable ufw # sudo ufw enable

To query the rules being applied use the status command argument.

# sudo ufw status

To see a list of all applications in the ufw database use the app argument.

# sudo ufw app list

If the creation of a custom application is needed, make one in the /etc/ufw/applications.d directory.

# sudo vim /etc/ufw/applications.d/mycustomapp

[mycustomapp] title=My Custom App description=Custom App for Blah ports=11000:11005/tcp|11010/udp

This would create a custom application filter on ports 11000-11005 using tcp and port 11010 using udp. It would then merely need to be enabled.

# sudo ufw allow mycustomapp

Blacklisting IPs

It might be desirable to blacklist an IP address, maybe you have seen brute force attempts from it or maybe you just want to block it. This can be done by editing /etc/ufw/before.rules. Add the blacklisting to the end of the file before COMMIT.

# sudo vim /etc/ufw/before.rules

## blacklist section # block just 8.8.8.8 -A ufw-before-input -s 8.8.8.8 -j DROP # block 8.8.*.* -A ufw-before-input -s 8.8.0.0/16 -j DROP # don't delete the 'COMMIT' line or these rules won't be processed COMMIT

Disable Remote Ping

Change ACCEPT to DROP in the following lines of /etc/ufw/before.rules.

# ok icmp codes -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT -A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

If IPv6 is being used the same can be done inside of /etc/ufw/before6.rules as well.

Legacy Services

If at all possible disable all legacy services, there are just too many vulnerabilities in these services. They include but are not limited to: NIS, RSH client/server, talk client/server, telnet, TFTP, XINETD, CHARGEN, Daytime, echo, discard and time.

There are also a few non-legacy services it is recommended to stay away from: X Window system, Avahi Print Server, DHCP server, LDAP, NFS/RPC, DNS server, FTP server, Samba and SNMP.

While some of these services might be required such as DNS, it is highly recommended if at all possible to run these on a private secluded VPS all by itself. This way if that host were to get compromised there would not be any sensitive data aside from the DNS records which are already publicly accessible.

Sysctl

Being honest, Arch Linux comes fairly secure out of the box. Things like source routed packets, packet forwarding, multicast packet forwarding and ICMP redirection all default to disabled. Alas, improvements can still be made.

Sysctl can be used to change kernel parameters at runtime by adding to the file /etc/sysctl.d/50-security.conf. There are several improvements that can be made here security wise. Not all of these will be optimal in every use case scenario, but none of them will have harmful effects on your system.

Log Martian Packets

Setup logging on martian packets so as an administrator one can diagnose the system when an attacker is sending spoofed packets.

net.ipv4.conf.default.log_martians=1 net.ipv4.conf.all.log_martian=1

Secure ICMP Routing Redirects

If the source gateway is compromised then an user can update the routing table using Secure ICMP redirects. This can potentially lead to remote packet capture.
This can be disabled.

net.ipv4.conf.all.secure_redirects=0 net.ipv4.conf.default.secure_redirects=0

Send Redirects

An unauthorized user can use a compromised host to send ICMP redirects packets to another routing device to corrupt its routing. This functionality can be disabled.

net.ipv4.conf.default.send_redirects=0 net.ipv4.conf.all.send_redirects=0

TCP SYN

An attacker can start a DDoS attack at the server by flooding it with SYN packets without initializing three way handshake. Setting this will helps protect against SYN flood attacks, however it only kicks in when net.ipv4.tcp_max_syn_backlog is reached.

net.ipv4.tcp_syncookies=1

TCP Time-wait

To protect against TCP time-wait assassination hazards drop all RST packets for sockets in the time-wait state (not widely supported outside of Linux, but conforms to RFC).

net.ipv4.tcp_rfc1337=1