In this chapter, we will cover the following topics:
Setting up a Linux firewall
Allowing access to a service through the firewall
Verifying your firewall by port scanning
Turning off unnecessary services
Verifying the strength of passwords
Disabling root login over SSH
Restricting Webmin access to a specific IP
Connecting to Webmin securely over an SSH tunnel
Closing inactive Webmin sessions automatically
Some people say that the only secure machine is one that is switched off. This may be true, but that machine is not very useful. If you want to make your server more functional, you'll have to turn it on and most likely expose it to the curious eyes of the Internet.
Online computer security is a topic large enough to deserve its own book. In fact, a whole shelf of such books is readily available. In this chapter, we will learn basic techniques, which will allow you to secure your server before putting it up online. If your server is exposed to the Internet, it will be a good idea to follow up by doing more in-depth security research and monitor what's happening to your machine on a day-to-day basis. Because this is a book on Webmin, we will only address topics in which Webmin can assist you.
This chapter is divided into three parts:
We'll begin by running through a basic checklist of security issues that every system administrator should keep in mind. We'll point to the recipes...
Linux systems have a firewall software built right into the kernel. This packet-filtering framework is called netfilter
(since Linux 2.4). It is controlled by a tool called iptables, which instructs the kernel what to do with incoming and outgoing network packets.
In this recipe, we will begin with an empty iptables configuration (firewall disabled) and configure it to drop any incoming packets except those we specifically allow. Before we set up a firewall, we should review some basic concepts related to network communication and the organization of iptables.
The following are some basic packet-filtering concepts:
Packets: The Internet is a packet-switched network. This means that all communication is facilitated by breaking up the content into small blocks called packets, which are routed from one computer on the network to another.
IP address: The adresses of machines on the Internet are specified by numerical IP addresses, such as 93.184.216.119 (IPv4) or 2606...
Once your firewall is set up, all unauthorized traffic coming into your server will be dropped. If you decide to add a service to your server, you'll need to add another firewall rule to allow the incoming traffic to reach the service. Otherwise, external users will not be able to access the new service. In fact, they will not even be able to see that the service is running and their connections will simply time out.
Make sure that your firewall is set up. Refer to the Setting up a Linux firewall recipe for more information. Make sure you know which port numbers and protocols are used by the service to which you want to allow access. Common port numbers such as 80 and 443 for a web server and 20 and 21 for FTP are listed in the file /etc/services. Usermin uses the port 20000 by default.
After your firewall is configured, you may wish to check that you haven't unintentionally left any unnecessary open doors. A good way to do this is to initiate a scan from another machine that will tell you what open ports it discovered on your server. Only ports associated with services that you want to make publicly accessible should be found.
We will be using two machines in this recipe. One will be the scanner machine and the other will be the server we want to scan.
Nmap is a great and widely available port scanner. Let's start by installing it on the scanner machine. You can install it from the repositories of most Linux distributions, from ports on BSD and from Homebrew on OS X. You can also download an installer for Windows from http://nmap.org/download.html.
The best way to avoid potential security issues with services you're not actively using is to disable them. This recipe will list the steps to identify the running system services that have open network ports and disable them.
Let's start by identifying the processes that open network ports on your systems. This can be done with the help of the following steps:
Navigate to Others | Command Shell.
Type in the command netstat -tulpen and click Execute command.
You will see a list of server processes with active network connections.
In the Local Address column, you will see entries such as 0.0.0.0:22. This means that a process is listening on port 22. The PID/Program name column will tell you which process is responsible for opening this port.
If you identify a process that you are not using and you know that it isn't essential to your system, you can disable it with the help of the following steps:
Navigate to System | Bootup and Shutdown.
Find the startup...
If you allow administrative users to log into your system using their username and password, your system is only as secure as the passwords used by those users. It's a good idea to periodically attempt to crack all the passwords on your system. If you find passwords that are easy to guess or crack through brute force, you should ask users to change them.
For this recipe, we will be using the password-cracking program called John the Ripper. Start by installing the package named john. Refer to the Installing software packages recipe from Chapter 1, Setting Up Your System, for more details.
John the Ripper tries to crack passwords by brute force, which means it will try every word and combination of characters. If any user on your system has a strong password (long and complex), John will not be able to crack it in a reasonable amount of time. You should let the cracking run for a couple of days and then decide that the remaining...
Allowing the root user to log in over SSH is a potential security vulnerability. An attacker may try to break into your system by trying every password for the root user. It's recommended to disallow the root user's access over SSH and to log in as another user with the sudo privileges to perform administrative tasks.
Perform the following steps to disable root login:
Navigate to Servers | SSH Server | Authentication.
Answer No to the Allow login by root? question.
Click Save.
Back on the SSH Server module screen, click Apply Changes.
The firewall is your first line of defense, but you should take additional precautions while running Webmin on an Internet-connected server. Webmin allows you to restrict access to a list of specific IP addresses and networks. It's a good idea to protect Webmin this way; otherwise, an attacker can try to guess your password and take over your system.
In this recipe, we will configure Webmin to accept connections only from your IP address.
Before you start, you should determine the IP address you are currently using to connect to Webmin. In order to do this, log into Webmin and navigate to Webmin | Webmin Users | View Login Sessions. Your active login session will be marked in bold and your address will be listed in the IP address column.
If your server is connected to the Internet and you use SSH to connect to it, you can secure it by disallowing Webmin from accepting any remote connections. You can then use an SSH tunnel to connect to Webmin. This lowers the potential attack surface of your machine and protects you against possible security vulnerabilities in Webmin itself. Any attacker would have to break into your SSH account or otherwise gain local access to your system to connect to Webmin.
Before you begin, you should follow the Restricting Webmin access to a specific IP recipe of this chapter and add the IP address 127.0.0.1 to the list of hosts allowed to connect to Webmin.
In this recipe, we'll be using the command line version of SSH that is available on most systems, but it is not available on Windows. Look in the There's more... section of this recipe for instructions specific to Windows.
Webmin's login sessions are not set to expire by default. This causes a potential security risk. If a user leaves his or her computer unattended while logged into Webmin, an attacker could potentially use the situation to harm your system or disable its security. Fortunately, this situation is easily remedied by changing a Webmin setting.
Perform the following steps to close inactive Webmin sessions automatically:
Navigate to Webmin | Webmin Configuration | Authentication.
Tick the checkbox marked as Auto-logout and set the automatic logout to happen after 10 minutes of inactivity.
Click Save.
Webmin stores authentication options in its server configuration file (/etc/webmin/miniserv.conf by default). The line defining inactivity time after which users will be automatically logged out starts with the keyword logouttime and specifies the time in minutes. For instance, it may look like this:
logouttime=10
Whenever a client...
© 2014 Packt Publishing Limited All Rights Reserved
