Firewalls and Security
External (Internet) and Internal (LAN) IP addresses
Our internet connection has an IP address. I'm calling that
an 'external' IP address, for the purposes of this page. That's the IP
address my modem/router has as far as the outside world is concerned.
Inside
my house, on my side of the modem/router, my ADSL modem has a different
IP address, that is 10.0.0.138 if you have a Thompson Speedtouch 530
like I do.
My computers have a different IP
addresses each too, allocated by the DHCP server in my ADSL modem/router.
If I put another
router in between, that will have its own IP address too, and will also
assign different IP addresses to each computer.
Normally
those are invisible unless you use a Linux command like ifconfig to
find out. I'm calling those 'inside'
IP addresses for the purposes of this page.
IP address (External)
An
'IP address' is like a phone number but it's for a computer. Well,
maybe it would be more accurate in this case to say it's for the
connection between your broadband modem and the internet.
If
you click on any of the following links you'll be able to see your
current IP address and a few other things that a web site with the right software can see
about you when you visit that site.
What Is My IP Address? - Dedicated to IP address discussion
What is my IP Address? Show my IP Address and IP Address tracer
IP Chicken - What is my IP? Find Your IP Address!
My IP Information
What can people tell from my IP address? - Ask Leo!
Dynamic IP address
One of the features of our Bigpond service is that we have a
dynamic or 'roving' IP address for our internet connection.
Basically
that means every time we reboot the ADSL broadband modem and connect
back up again we will be given a different IP address.
That's a security feature to help protect us
and make us more anonymous on the internet. That way it's more difficult for an internet attacker to single out a specific user.
If
we wanted,
we can apply for a 'fixed IP address', which means we can keep the
same IP address more or less permanently. That would probably be
important if we wanted to
make one of our computers into a server to be made available
from anywhere on the internet.
For
example you might want to host and maintain your own website in one of your own
computers at home for advertising your hobby or business. You would might want a fixed IP number
so people will always be able to find your site.
You
can use SSH networking between computers over the internet too.
That would also be easier if you have a fixed IP address. You could be
traveling somewhere and be able to connect to your home computer by
SSH to look something up or do work in your home computer. Static IP For Bigpond Broadband ADSL
Some
ISPs give people 'fixed' IP addresses whether they like it or not.
If you have a static IP address it still can be perfectly secure, but
you may want to be a little extra careful.
MAC Addresses
If you want to see your network card's MAC address, use the ifconfig command.
MAC
addresses are like serial numbers that are hard coded into each piece
of networking hardware. They are used to identify your computer's
network card, your router, ethernet switching hub, broadband
modem-router, and any other piece of networking hardware you can think
of.
They can be used to identify your equipment on the LAN or
internet too. The MAC address might be compared with a license (number)
plate on a car.
More: MAC address - Wikipedia, the free encyclopedia
===========================================================
IPtables are our Linux equivalent to what is called a 'firewall' in Windows.
IPtables
are built right into the Linux kernel. We don't need to go and
download some external software that someone has for sale or for hire.
There is often a firewall debate going on in Ubuntu forums about whether or not an added firewall is
needed for Ubuntu. I don't think I need a firewall for my purposes.
Firestarter, is something we can install in Ubuntu.
It might be a good idea to install Firestarter if you install any server software.
Firestarter is not a stand-alone firewall that you need to add, but it is a very good GUI frontend for helping new users to
configure their IP tables more easily. It's really IPtables that does the work behind the scenes.
Firestarted
can be installed through apt or Synaptic Package Manager or
'Applications, Add/Remove Programs'. There are some other similar
programs available too.
Howto: Setup a Software Firewall in Linux using Firestarter - Techthrob.com
In Ubuntu, our IPtables are left unconfigured by default.
When
we first install the operating system they aren't needed, because
Ubuntu doesn't come with any services installed, no ports are open
to the internet. As long as we don't open any services, Ubuntu is as
sealed as a nut.
Most people probably don't even realize Ubuntu has a network filter (or 'firewall' if you prefer).
If you want to take a look at yours, just do this,
Code:
| herman@red:~$ sudo iptables -L |
And here's what our unconfigured IPtables normally look like,
Chain INPUT (policy ACCEPT)
target
prot opt
source
destination
Chain FORWARD (policy ACCEPT)
target
prot opt
source
destination
Chain OUTPUT (policy ACCEPT)
target
prot opt
source
destination |
man iptables To learn more about iptables open a terminal and type: man iptables
The output from that command is about eight pages long and it's very
interesting if you have the time to read and inwardly digest it. There is a lot to learn about IP tables.
I have links to some of the best web pages with how-tos and user guides for IPtabels further down this page.
I haven't configured my IP Tables at
all, and
I have installed SSH server. I want to check to see how safe I am on the internet. You can do this too. So let's go test our firewall.
'Shields Up!' is a well known internet firewall testing site, your Ubuntu system should pass
all tests as 100% stealth with or without any added firewall. I don't
use any added software firewall and mine is 100% stealth, and has
always been. It will tell you your external IP also.
AuditMyPc.com is another firewall tesing site you can visit.
HackerWatch.org is good too.
Did your Ubuntu operating system pass all those tests? Mine did,
...but I was connecting through my router, and then through my broadband modem.
Both my router and my broadband modem have 'hardware firewalls' built into them.
(I highly recommend the hardware firewalls in most routers), so it
could be that these firewall testing sites are only really testing my
'hardware firewall' in my router.
If you are connecting through a router too you can unplug your router and plug Ubuntu
into the broadband modem directly if you want and have another try!
(Some of you may need to revert back to DHCP first, to make a direct internet connection).
Stealth?
Try doing the specific port probe at 'Shields Up! on port 22, (the SSH port) now, still 100% Stealth?
CanYouSeeMe.org - Open Port Check Tool - Check just one port at a time - any port.
Given the results from the above tests, it would seem as if at least my
computers are already quite secure from the outside world, I'm not sure
about everyone else's. That depends on your equipment.
Port Scanning with Ubuntu (your other computers in your LAN)
If
we have more than one Ubuntu computer in our network we can use each
one to scan the others for open ports. Ubuntu comes with some very good
networking software of its own.
I went 'System'-->'Administration'-->'Network Tools', and clicked on the 'Port Scan' tab.
You need to know the IP number for each of your other computers that you want to scan.
The easiest way to get that is just to go to the other computer and run 'ifconfig'.
The scan only takes a few seconds.
It is possible to detect an open port 22 that way when a system has SSH server installed.
If you find any other open ports you can look them up in either of these links to see what service they're probably for:
If you don't remember installing that service or if it's a service you
don't use then you should probably uninstall the service and that will probably close the
port.
| herman@bookpc:~$ less /etc/services |
NMap
NMap
is a port scanner you can use for checking all the computers in your LAN for open ports.
http://insecure.org/nmap/docs.html
Nmap is installable in Ubuntu through apt-get, Add/Remove Programs or Synaptic Package Manager.
A nice GUI front end is available for NMap too, it's called 'NmapFE', and is available through Add/Remove Applications, and probably apt-get and Synaptic too.
WireShark. - http://www.wireshark.org/
Wireshark
is installable in Ubuntu through apt-get, Add/Remove Programs or
Synaptic Package Manager. Wireshark is a packet sniffer, you can use
that to keep a watchful eye on the comings and goings of all the
packets in your LAN.
Connecting from another computer on the internet to a computer inside a home LAN
If
your setup is anything like mine, you would need to open a port in the
broadband modem's firewall, and also a port in the router's firewall
before the incoming connection could be made.
That
will expose your LAN to the internet. That's where
you might start needing to be more security conscious about computers in the LAN with open ports.
What if a remote attacker can get into my LAN
from the internet ever did (theoretically) manage to get inside my LAN
through my Broadband Modem-Router's built-in firewall and my LAN
router's firewall too? (You're joking right?)
Well, according to this link, Getting Started with SSH, they would still have a hard time cracking my SSH password.
Quote:
Essentially invulnerable means that it's commonly believed that if
they were really, really motivated, the National Security Agency could crack a
SSH session key within a year, if they didn't do any other cryptographic
cracking during that time, devoting all resources to you. This would
give them access to up to an hour of one of your sessions, provided all packets
were recorded. The exact number of CPUs, hours and dollars required is hard
to estimate, but is outrageously in excess of any credible threat to you. |
How to tell if someone is trying to crack into your computer
HOWTO: Automatically block SSHD/PROFTPD Attacker. - pinoyskull
Seahorse -Encryption Made Easy - http://www.gnome.org/projects/seahorse/
See this website's Install Seahorse.
Seahorse is a nice GUI application that makes and manages both PGP and RSA keys.
We can install Seahorse in Ubuntu easily through 'Applications'-->'Add/Remove Programs' or Synaptic or apt-get.
| herman@silver:~$ sudo apt-get install seahorse |
With PGP keys we can securely encrypt our sensitive data and emails, and sign documents.
WIth RSA keys we can log in to our SSH accounts even more securely without even having to bother typing the password each time.
Seahorse generates for us a pair of keys, a private and a public RSA key.
These are saved is in the .ssh
directory in a file called rd_rsa and a file called id_rsa.pub.
The file called rd_rsa contains our private key which we need to keep secret.
The file called id_rsa.pub contians our public key which is to be copied to our friend's computer, which we want to connect to.
To set up passwordless logins for SSH, we open Seahorse and right-click
on our Private RSA key. Select 'Set up Computer for Secure Shell...'
A window opens titled 'Set up Computer for SSH Connection', and below
that, there's a note: 'To use your Secure Shell key with another
computer, you must already have a login account in that computer.
There's a field under that called 'Computer Name', (domain name). I just type the IP number: port number (if other than 22),
of the friend's computer there, that works for me.
There's also a field for your login name in the other computer, which is autocompleted.
When you are ready, click 'Setup'.
You'll be asked for the password to your account in your friend's computer, type it and click 'Okay'.
That's it! Your public RSA key is copied into your friend's computer, it's appended to a file called .ssh/authorized_keys.
Now when you open an SSH connection to your friend's computer, you may
be asked for a keyring password for the first time connection, but
after that the login should be automatic.
The way it works is something like this, the computer you are
connecting to uses your public key to generate a number and encrypts
the number and sets the encrypted number to your computer.
Your computer uses your private RSA key to decrypt the number and sends
the unencrypted number back to your freind's computer. When your
freind's computer receives the number back decrypted, that proves the
identity of the computer you are using is genuine, since only your
private key could have decrypted that number. The remote computer
allows the connection and opens.
After the first time connection it's automatic, you don't need to type a password anymore.
Then
once we have passwordless logins established we can edit
/etc/ssh/sshd_config files to disable password based logins, for even
more security.
What is a Digital Signature? An introduction to Digital Signatures, by David Youd
How PGP Works | Dr. Small's Blog | Public Key Cryptography - Wikipedia
The International PGP Home Page
Connect to your SSH servers from anywhere
You
can travel the globe and still be able to access all the files in your
home or office computer or computers if you use SSH Networking.
Before
you leave home, you just need to make sure a port is open in your
internet modem that leads to your ssh port in your home computer.
That's called 'port forwarding', and the way you should be able to do
that depends on what kind of hardware you have.
I use Port Forwarding for the Dlink DI-524 and Port Forwarding for the Thomson/Alcatel SpeedTouch 530. You should be able to find out how to set up port forwarding for your equipment somehow too.
CanYouSeeMe.org - Open Port Check Tool, is a useful site to check whether your port forwarding efforts have worked or not, that site also shows you your IP number.
If
you leave your home computer set up like that and go anywhere with
your Ubuntu laptop or your Ubuntu-in-a-flash-memory-stick and you should be able to make an SSH
connection easily in just the same manner as has been illustrated near the top of
this page, but using the internet connection's IP number.
Access to any or all of the computers in my LAN is easy to set up.
The file /etc/ssh/sshd_config is the one to edit
for changing your settings for SSH.
| herman@silver:~$ gksudo gedit /etc/ssh/sshd_config |
You can set a different port number
than 22 here.
You can use the command 'less /etc/services'
to see what port numbers not to use, but pick some random port number
for each computer in your LAN instead of the default 22.
| herman@silver:~$ less /etc/services |
Each computer
in your LAN can have a different port number.
After you have your /etc/ssh/sshd_config
file, run,
| herman@silver:~$ sudo /etc/init.d/ssh restart |
or reboot your computer for the changes to take effect and
run a port scan from another computer in your LAN to check.
Then forward the port numbers you chose through your router and through your broadband modem.
Here is a link to a website that shows you how to set up port forwarding with all kinds of different equipment. PORT Forward.com
CanYouSeeMe.org - Open Port Check Tool,
is a useful site to check whether your port forwarding efforts have
worked, that site also shows you your internet IP number too.
It is best to test SSH between computers inside your LAN to make sure it's working before progressing to the internet.
Then go somewhere to a remote location and connect to a PC in your home or office. It should work. You can connect to each computer by your internet
IP number and the individual port number you allocated each of your
computers earlier.
Now I can travel with my Ubuntu-in-a-flash-memory-stick
and access all the files in any of my home computers from anywhere in
the world. It's almost as good as if I was carrying all the information
in my home computers around in my pocket. I just need to remember what
my home IP address is and what port numbers to make the connections to.
Dynamic DNS
If
I'm worried about the possibility of my IP address changing somehow
while I'm away, I can have my home computer send me emails at regular intervals addressed to
myself and then receive them in my memory stick.
All emails have the senders IP address in them and you can see that if you open the
email and click 'View'-->'Message Source'.
It's
important to set Evolution in the home PC so it will not check for
mail automatically, or it might re-download the message it sent itself.
Set the home PC's Evolution to not check for new mail automatically,
and/or even if it does check for new
mail, make sure the home PC's Evolution will leave a copy of it on the
server.
These
settings are in 'Edit'-->'Preferences', in Evolution. Click on your
account, and click 'Edit', and go to the receiving options tab.
There are a few
different programs that can be used to send email from the command
line, and that means they can be set up in a crontab to cause them to
be send out at regular intervals, or any times we decide to set.
The email program I use is 'sendEmail'.
SendEmail can be installed with apt-get or Synaptic in Ubuntu and it is quite simple to use.
| herman@silver:~$ sudo apt-get install sendemail |
Here's how to send an email to yourself with sendEmail, from the command line,
example,
| $ sendEmail -f user@bigpond.net.au -t user@bigpond.net.au -o message-file=hello.txt -v -s mail-hub.bigpond.net.au |
Where: -f user@bigpond.net.au is the email address it's being sent from
Where: -t user@bigpond.net.au is the email address it's being sent to
Where:
after the -o option, hello.txt is a plain text file containing a
message.
Just make your own text file with any message in it. It doesn't matter what the message contains.
Maybe send your self a reminder of what port numbers your home router is using for each PC's SSH port to make it useful.
Where: -s is your mail server, that depends on your ISP.
Now
that you know how to send yourself an email from the command line, you
can probably figure out how to use crontab to do the same thing. If you
don't know how to set up crontab, look here: Configure 'crontab'
How to send an email to yourself with sendEmail, from crontab,
example,
| 0 6 * * * /usr/bin/sendEmail -f user@bigpond.net.au
-t user@bigpond.net.au -o message-file=hello.txt -s
mail-hub.bigpond.net.au |
Where: you will send your self an email at 06:00 every day. You might
want to make more of these. One every four hours or very six hours or eight hours or
whatever.
Why do we need to send ourselves an email?
So
we can receive our own email from a remote location and discover
our home LAN's current IP address when we have a dynamic IP.
How?
Open the email and click 'View'-->'Message Source', and the IP address will be there.
I like the sendEmail method because
I enjoy the anonymity of having a dynamic IP address and I don't want
to risk comprimizing that. I'm not sure if a fake DNS would really
matter, but I'm playing it safe.
Here are more good ways to keep track of a changing IP addresses, DynamicDNS -Ubuntu Community Documentation, and, Dynamic DNS No-IP.
|
ADSL is short
for 'Asymetrical Digital Subscriber Line'.
'A' stands for
'Asymetrical', because it's set up so that downloading is faster than uploading.
'D' is for 'Digital',
(instead of analog or ISDN).
'SL' is short for 'Subscriber Line',
which just means a phone wire.
Using Digital means we can have the phone
plugged in and
use it while the computer is on-line since it's a different frequency. Our phone wires can
carry about 200 times the amount of information using digital signals compared to analog too.
The speed of internet connections are stated in KiloBits per
second is written like: 256/64 kbps, or 512/128 kbps. One kilobit is roughly about 1/10 of a Kilobyte.
The Data Transfer Rate Conversion Table.
|
