Script per Personal Firewall

[Aodh]

Che ne pensate di questo script? L'ho trovato su Beyond Linux From Scratch . Ho fatto il test su PC Flank ottenendo eccellenti risultati.
Certo e' solo un personal firewall pero' sembra funzionare molto bene.
Per favore qualche esperto dia un'occhiata, grazie mille!

#!/bin/sh

# Begin $rc_base/init.d/firewall

# Insert connection-tracking modules (not needed if built into the kernel).
modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_state
modprobe ipt_LOG

# allow local-only connections
iptables -A INPUT  -i lo -j ACCEPT
# free output on any interface to any ip for any service (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# permit answers on already established connections
# and permit new connections related to established ones (eg active-ftp)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log everything else:  What's Windows' latest exploitable vulnerability?
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# set a sane policy:    everything not accepted > /dev/null
iptables -P INPUT    DROP
iptables -P FORWARD  DROP
iptables -P OUTPUT   DROP

# be verbose on dynamic ip-addresses     (not needed in case of static IP)
echo 2 > /proc/sys/net/ipv4/ip_dynaddr

# disable ExplicitCongestionNotification - too many routers are still ignorant
echo 0 > /proc/sys/net/ipv4/tcp_ecn

# End $rc_base/init.d/firewall

[Kamui]

Ma hai fatto il quicktest? A me quel sito da sempre informazioni "preoccupanti"... ossia (nel quicktest) warnig/warning/danger

Mi si lamenta di trovare millemila porte aperte (alcune le ho chiuse con iptables, con altre (3) non ha funzionato...) mentre netstat non è d'accordo

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:37              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:9               0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:13              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     
tcp        0      0 151.x.x.x:33037    216.239.59.104:80       ESTABLISHED
tcp        0      0 151.x.x.x:33009    216.239.59.99:80        ESTABLISHED
udp        0      0 0.0.0.0:9               0.0.0.0:*                          
Active UNIX domain sockets (servers and established)
[...]

E lui dice che 135,139 e 12345 sono visibili...

Ho provato anche lo script che hai postato e il risultato è sempre warning/warning/danger

[Aodh]

Io in questo momento (Red Hat 9) ho tolto da init5 iptables ip6tables ed ipchains che la RedHat mi aveva configurato in automatico ed ho inserito lo script prima che venga aperta la eth0.
I risultati sembrano essere buoni: mi dice che ho tutte le porte stealthed.
Io non mi intendo molto di sicurezza, vorrei sentire il parere di qualche esperto!

[Kamui]

Beh lo script è simile ai "soliti" che si trovano in rete... policy su DROP, consente connessioni in uscita, in ingresso solo connessioni locali o relative a connessioni già esistenti.
Per un PC solo è buono

Prova a fare il Quick Test per favore e dimmi cosa ti esce (nel full report)

[Aodh]

Nella fretta mi ero dimenticato di postare i risultati nel post precedente...
Ecco qui:

Check for vulnerabilities of your computer system to remote attacks
We have scanned your system for open ports and for ports visible to others on the Internet.
As a rule an open port means your computer is vulnerable to attacks by crackers.
They gain access to your computer and its files through these open ports.
Safe!

Trojan horse check
The test scanned your system to find signs of a Trojan.
If a Trojan horse is on your computer a cracker can access your system's files and your personal data.
Safe!
There is no evidence of a Trojan horse on your system.
Recommendation:
The absence of a Trojan horse on your system does not mean this problem cannot happen, of course.
Anti-virus and/or anti-Trojan software should be installed and used on your system.
Anti-trojans to consider are: The Cleaner, PestPatrol or Tauscan.

If you already use this type of software on your system,
its virus definitions (virus database) should regularly be updated.

Browser privacy check
The test checked if your web browser reveals any private information while you visit Web sites.
Usually such information is: the last site visited, your locale and who your Internet Service Provider is
Attention!
Your computer may save special cookies on your hard drive that have the purpose of directing advertising
or finding out your habits while web surfing.
Recommendation:
We advise you to get personal firewall software.
If you already have a firewall program adjust it to block cookies.

[RockSteady]

secondo me si drogano quelli di quel test

# nmap -sS localhost

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-06-05 09:59 UTC
All 1659 scanned ports on localhost (127.0.0.1) are: closed

Nmap run completed -- 1 IP address (1 host up) scanned in 1.086 seconds


e nel sito dice...



Warning!
The test found visible port(s) on your system: 21, 23, 80, 135, 137, 138, 139, 1080, 3128



Recommendation:
Install personal firewall software. PC Flank recommends Outpost Firewall Pro.

If you have already installed and are using a firewall, check if it is set to make all the ports of your computer invisible (hidden). If it is, then get new firewall software and redo this test.

Warning!
The test found visible ports on your system: 27374, 12345, 1243, 31337, 12348.
The following Trojans use these ports: SubSeven, NetBus, SubSeven, Back Orifice, BioNet
Although these ports are visible, they are not open, so your system is not infected. However, having visible ports on your system means your computer can be "seen" over the Internet. This makes it very easy for skillful intruders to explore your system.

Attention! Your browser is not private. Privacy is 50%
While visiting web sites your browser sends information about previous sites you have visited.



Recommendation:
Install a personal firewall program. If you already have a firewall, adjust it to block this information.


To compare your results to results of other users click on "Overall Stats".


:quipy: :quipy: :quipy: