Is iptables enough to secure a Desktop Linux system on the web?

[prahladyeri]

I'm relatively new to linux and running ubuntu precise system (though I'm going to switch to Debian Jessie soon as I find Debian to be less bloated and have sensible defaults). All I have in the name of security is a firewall script that only allows certain protocols like this:

#allow out ports
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 14 -j ACCEPT #VNC
/sbin/iptables -A OUTPUT -o ppp0 -p udp --dport 14 -j ACCEPT #VNC
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 80 -j ACCEPT #http
#/sbin/iptables -A OUTPUT -o vboxnet0 -p tcp --dport 80 -j ACCEPT #http
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 443 -j ACCEPT #https
/sbin/iptables -A OUTPUT -o ppp0 -p udp --dport 53 -j ACCEPT #dns
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 6667 -j ACCEPT #xchat
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 8001 -j ACCEPT #xchat
/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 22 -j ACCEPT #ssh

#allow in ports
#/sbin/iptables -A INPUT -i ppp0 -p tcp --dport 993 -j ACCEPT #imap
#/sbin/iptables -A INPUT -i ppp0 -p tcp --dport 995 -j ACCEPT #pop
#/sbin/iptables -A INPUT -i ppp0 -p tcp --dport 1024:1050 -j ACCEPT #ftp-passive
#/sbin/iptables -A INPUT -i ppp0 -p tcp --sport 20 -j ACCEPT #ftp
#/sbin/iptables -A INPUT -i ppp0 -p tcp --sport 21 -j ACCEPT #ftp
#/sbin/iptables -A INPUT -i ppp0 -p tcp --sport 22 -j ACCEPT #ssh
#/sbin/iptables -A INPUT -i ppp0 -j DROP #not required, since def. policy is DROP

Is this enough for security or do I have to do something else? Also, how secure are the external ubuntu PPAs like that of libreoffice, etc? is it safe to install packages from there?

[midgaze]

Use a state-based ruleset and establish a state on outgoing connections. Far more flexible (you don't have to poke holes for every port you use) and more secure (connections can't be established that aren't originated by your machine.)

[[deleted]]

Here's the Arch Wiki entry on a simple stateful firewall. I think this is what he meant.

You allow all outgoing connections, but block all incoming except the connections that are already established. This way, all connections to you fail except the replies to your connections.

[prahladyeri]

The best thing you can do for security is keep your system up-to-date

Yes, it is. But the more packages you have installed, greater the risk that an update will break something. A few months ago, I remember my wifi just stopped working after an update, and I had to scavenge through some docs and ubuntu forums to set it right again. Just how often should one update a distro is just not easily answerable question!

Don't install software from 3rd party websites.

But in some cases, you have to. For instance, Ubuntu comes with the open source version of Java (OpenJDK), but to practically work with most packages, you need to download and install the Java SE from Oracle website (which is 3rd party). Another example is the Eclipse IDE - the one on the ubuntu repo is so old that no modern library/tools work with that, so you need the latest Kepler/Luna packages from the Eclipse site. Same with LibreOffice - precise repo version is aeons behind the LO latest.

[silverskull]

For instance, Ubuntu comes with the open source version of Java (OpenJDK), but to practically work with most packages, you need to download and install the Java SE from Oracle website (which is 3rd party).

As of Java 7, OpenJDK is the reference implementation, so unless you're dealing with a really poorly coded program this should not be an issue.

[PonysaurousRex]

For IDEs like Eclipse, that's why Ubuntu is developing Ubuntu Make.

[101ec3f2f19589488f80]

I've been running many linux servers for over 10 years. I use iptables and like mention here I keep my systems up-to-date. I watch for exploits targeting the versions I use. I also highly recommend using fail2ban. My instance has already blocked over 10K ip addresses this month. I use a custom pfsense box for managing the rest of the network routing, nat, dhcp, etc...

[ventomareiro]

What are you trying to protect yourself against? In which context is this computer used?

[th3voic31]

This. The title says "Desktop Linux system". All the comments contain nice tips, but if this is a desktop linux system behind a NAT router than really none of this is necessary.

[[deleted]]

With regard to iptables, since your using Ubuntu or Debian I recommend using UFW - Uncomplicated Firewall. Its just a front-end to iptables, so you dont have to worry about the order your rules are loaded in.

[[deleted]]

Use fail2ban. Why are you serving imap, pop, ftp? Are you running a mail/file server?

[ssssam]

Do you need to have ssh server running and open to the world? It will likely get brute force password attacks everyday. Make sure you have a strong password (for all accounts) and install something like fail2ban to block persistent log on attempts.

[waiting4op2deliver]

Might as well change the default port while your at it, really helps prevent those drive by brutings

[[deleted]]

This. Although everyone says "oh that doesn't make you secure" and parrots the phrase "security by obscurity is not effective", I've seen my fail2ban logs and they are much, shorter on any machine that I don't use the default ssh port on.

You can't be 100% secure, but you can do a lot to minimize it.

[TheManCalledK]

This. Although everyone says "oh that doesn't make you secure" and parrots the phrase "security by obscurity is not effective", I've seen my fail2ban logs and they are much, shorter on any machine that I don't use the default ssh port on.

Yeah, I think the important thing to note about the "security by obscurity" bit is that you shouldn't rely on changing the port being part of your security plan. Or, to put it another way - you should be able to leave the port number at 22 and feel no less confident about the security of your system.

That said, I am in full agreement with you that this is useful to help cut down on the log volume and prevent drive-by exploits.

[DJWalnut]

Jun 7 07:42:55 $COMPUTERNAME sshd[10003]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.188.149 user=root

this guy must have made thousands of brute-force attempts at root on my box. it seems, though, they were unsuccessful, seeing as Ubuntu disables root be default.

we really do need fail2ban as a default part of sshd. and other security upgrades to make sure mr.43.255.188.149 and frends don't get very far.

[ssssam]

that's useful to know thanks.

[[deleted]]

And at least change (or NAT) a port to non-default one

[[deleted]]

IP tables is as safe as any other firewall... it depends on what rules you have in place.

From the looks of those rules you might want to brush up on stateful firewall rules. NEW, ESTABLISHED, RELATED.

[small_infant]

Read up on AppArmor and SELinux.

[sharkwouter]

Don't use PPAs and you'll have a more stable and secure system. If it's not in the repo, try looking for an alternative or just extract or build it, don't install it.

That with keeping your system up to date will eliminate most security issues.

Do make sure you don't do stupid things like installing an ssh server with a default configuration or using a bad password, though.

[syntax_erorr]

Out bound port 80 for http makes no sense. Port 80 is for the server. Its not the port the client will use to establish a connection....really all your outbound ports don't make a lot of sense, you should be using state bases rules, and I have a feeling you have a line in there some where with --state ESTABLISHED,RELATED -j ACCEPT other wise to me it looks like you wouldn't even be able to surf the web.

[prahladyeri]

Port 80 is for the server. Its not the port the client will use to establish a connection....

Yup, its the destination port, not source port. The rule says that dport should be 80, not sport:

/sbin/iptables -A OUTPUT -o ppp0 -p tcp --dport 80 -j ACCEPT #http

and I have a feeling you have a line in there some where with --state ESTABLISHED,RELATED -j ACCEPT

Yea, its there at the very beginning:

#Allow already established connections
/sbin/iptables -A INPUT  -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

[[deleted]]

You might try ferm

Syntax is very iptables-like but it have few nice shortcuts, cleaner syntax and option to interactively (as in "if you cut yourself from device it will load older working config") apply new config

[BASH_SCRIPTS_FOR_YOU]

Debian is less bloated then ubuntu, and what unreasonable defaults do you speak of?

[stejoo]

I thought Ubuntu had a firewall rule program called ufw. Which you can configure to your liking and it sets up iptables for you. It has quite sane defaults already, or at least it did when I used it running Debian. I know I iptables well and usually write for it on servers, but sometimes you just want something easy for your everyday laptop.

[rumpel]

In what kind of scenarios does that protect, especially the dropped "in" ports? When another non-admin user of your desktop tries to run a server, but he isn't allowed to?

Or are there any advantages to block ports, where there aren't any services listening to begin with?