Hello, I need the experts advice about the best Firewalld configuration for a web server. In Firewalld, I just opened port 80,443 and 22, but I'm sure with Firewalld I can protect my server with other useful rules. Can anyone share some good rules? For example, limitation or...
Thank you.
--On Sunday, September 27, 2020 8:57 PM +0000 Jason Long hack3rcon@yahoo.com wrote:
I need the experts advice about the best Firewalld configuration for a web server. In Firewalld, I just opened port 80,443 and 22, but I'm sure with Firewalld I can protect my server with other useful rules. Can anyone share some good rules? For example, limitation or...
"Good" rules keep everything out. Any rule you add to the default configuration increases the attack surface. It's a tradeoff between exposing services and securing the server. Now that you've opened those ports, you have to rely on those services to defend themselves.
BTW, you shouldn't open ports. You should enable services. Enable the http, https, and ssh services.
Your next step is to research how to harden those services against attack. Check with your webserver vendor (Apache, Nginx, etc.) and your sshd supplier (probably openssh) for optimal settings.
My current configuration is:
public (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: http https ssh ports: 990/tcp 40000-50000/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
ports: 990/tcp 40000-50000/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
Thank you. Then, I must remove "SSH" from services section and open port 22?
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
ports: 990/tcp 40000-50000/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
On Sat, Oct 10, 2020 at 09:43:01AM +0000, Jason Long wrote:
Thank you. Then, I must remove "SSH" from services section
Yes.
and open port 22?
No. That's already done with the rich rule.
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active)  target: default  icmp-block-inversion: no  interfaces: ens192  sources:  services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
 ports: 990/tcp 40000-50000/tcp  protocols:  masquerade: no  forward-ports:  source-ports:  icmp-blocks:  rich rules:    rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
Thank you.If I remove "SSH" from services section then no security problem? The rich rule protecting my service? On Monday, October 12, 2020, 04:51:55 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sat, Oct 10, 2020 at 09:43:01AM +0000, Jason Long wrote:
Thank you. Then, I must remove "SSH" from services section
Yes.
and open port 22?
No. That's already done with the rich rule.
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active)  target: default  icmp-block-inversion: no  interfaces: ens192  sources:  services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
 ports: 990/tcp 40000-50000/tcp  protocols:  masquerade: no  forward-ports:  source-ports:  icmp-blocks:  rich rules:    rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
On Tue, Oct 13, 2020 at 10:49:52AM +0000, Jason Long wrote:
Thank you.If IÂ remove "SSH" from services section then no security problem? The rich rule protecting my service?
The rich rule is _allowing_ the service. "protecting" is the wrong word.
On Monday, October 12, 2020, 04:51:55 PM GMT+3:30, Eric Garver <egarver@redhat.com> wrote:On Sat, Oct 10, 2020 at 09:43:01AM +0000, Jason Long wrote:
Thank you. Then, I must remove "SSH" from services section
Yes.
and open port 22?
No. That's already done with the rich rule.
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active) ÃÂ target: default ÃÂ icmp-block-inversion: no ÃÂ interfaces: ens192 ÃÂ sources: ÃÂ services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
ÃÂ ports: 990/tcp 40000-50000/tcp ÃÂ protocols: ÃÂ masquerade: no ÃÂ forward-ports: ÃÂ source-ports: ÃÂ icmp-blocks: ÃÂ rich rules: ÃÂ ÃÂ ÃÂ rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
But, "rule service name="ssh" accept limit value="1/m"" doesn't protecting my SSH? its limited attempts!!!
On Tuesday, October 13, 2020, 05:27:51 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Tue, Oct 13, 2020 at 10:49:52AM +0000, Jason Long wrote:
Thank you.If IÂ remove "SSH" from services section then no security problem? The rich rule protecting my service?
The rich rule is _allowing_ the service. "protecting" is the wrong word.
On Monday, October 12, 2020, 04:51:55 PM GMT+3:30, Eric Garver egarver@redhat.com wrote: On Sat, Oct 10, 2020 at 09:43:01AM +0000, Jason Long wrote:
Thank you. Then, I must remove "SSH" from services section
Yes.
and open port 22?
No. That's already done with the rich rule.
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active)  target: default  icmp-block-inversion: no  interfaces: ens192  sources:  services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
 ports: 990/tcp 40000-50000/tcp  protocols:  masquerade: no  forward-ports:  source-ports:  icmp-blocks:  rich rules:    rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
On Tue, Oct 13, 2020 at 03:24:06PM +0000, Jason Long wrote:
But, "rule service name="ssh" accept limit value="1/m"" doesn't protecting my SSH? its limited attempts!!!
I think you have a basic misunderstanding of how firewalls work. In most implementations firewalls block traffic by default. The user the _selectively_ allows services, e.g. "ssh". This limits the attack surface to the host running firewalld.
For protecting the SSH service itself.. maybe you're looking for something like fail2ban. Or maybe you'd be better served googling "ssh hardening".
On Tuesday, October 13, 2020, 05:27:51 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Tue, Oct 13, 2020 at 10:49:52AM +0000, Jason Long wrote:
Thank you.If IÂ remove "SSH" from services section then no security problem? The rich rule protecting my service?
The rich rule is _allowing_ the service. "protecting" is the wrong word.
On Monday, October 12, 2020, 04:51:55 PM GMT+3:30, Eric Garver egarver@redhat.com wrote: On Sat, Oct 10, 2020 at 09:43:01AM +0000, Jason Long wrote:
Thank you. Then, I must remove "SSH" from services section
Yes.
and open port 22?
No. That's already done with the rich rule.
On Monday, October 5, 2020, 04:37:52 PM GMT+3:30, Eric Garver egarver@redhat.com wrote:
On Sun, Oct 04, 2020 at 11:23:37AM -0000, Jason Long wrote:
My current configuration is:
public (active)  target: default  icmp-block-inversion: no  interfaces: ens192  sources:  services: http https ssh
"ssh" here conflicts with your rich rule below. Here "ssh" is _always_ accepted. The rich rule will limit as intended, but that's not useful if you have "ssh" in service as well, because it always accepts (i.e. no limit).
 ports: 990/tcp 40000-50000/tcp  protocols:  masquerade: no  forward-ports:  source-ports:  icmp-blocks:  rich rules:    rule service name="ssh" accept limit value="1/m"
Any rich rules that improve protection?
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos...
firewalld-users@lists.fedorahosted.org
-
Eric Garver -
Jason Long -
Kenneth Porter