On Tue, 2004-06-08 at 05:14, Sagara Wijetunga wrote: > > 1. Does this effectively offer connections ONLY to the > services I offer and nothing more than that? Others have commented on your rules specifically, so I'll skip that commentary. One thing I would like to point out however is that you are exposing 11 services to Internet connectivity. That's 11 opportunities for someone to find a way into the box. > 2. Does the rule 2 create any security loophole? #2 just lets in replies to outbound traffic. Its not so much a problem as this: 17. /sbin/iptables -P OUTPUT ACCEPT This rule reads "If you can find a way to exploit any one of the 11 exposed services, you can use any outbound transport to pull over your rootkit". > 3. This firewall allows passive as well as non-passive > FTP connections. Is passive FTP connections a > security threat? Nope, because it will be handled via inspection in your RELATED rule. > 4. Is this firewall good enough to protect the server? > If no, could you kindly comment how could I improve > further? IMHO you have two problems: 1) Too many exposed services 2) You have configured the box to act like a client and a server resulting in even more open conduits Also keep in mind that iptables is a packet filter, not a proxy. This means you are not seeing any protection to payload based attacks. So in an ideal world you would want to break up these services across multiple boxes. You would also want to limit them to server activity only, and not permit them to generate random outbound sessions. Now with all that said, it could be that you don't have the resources to setup multiple boxes and you are stuck with this setup. If that's the case, you are going to have to live with an elevated level of risk to getting whacked. Some other things you could do to mitigate this risk: Setup an automatic patching system Setup Tripwire or Aide to check system integrity Setup another system to collect the logs off of this system Setup Swatch or a similar tool to check these logs Setup an IDS HTH, Chris
