Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, telnet, etc. The only software that should use the Internet, that I know of, is iceweasel and apt.

  • Is there a way to ensure that only these two pieces of software can access the Internet?
  • Are any of the harden packages suitable for these needs?
share|improve this question
1  
See also Hardening Linux Server and Secure Linux Desktop on Information Security –  Gilles Feb 23 '12 at 2:33
add comment

5 Answers 5

up vote 6 down vote accepted

In a default user installation, there is only ssh as server application installed which you can simply uninstall via aptitude remove openssh-server or via any other package manager you use.

Restricting network access for applications is difficult. {{ EDIT: However, there is now Leopard Flower developed which seems to provides the features you need (per-process firewall, interactive user interface). }} See Per process firewall? for more information about the topic. Without using complicate solutions, you can only restrict network access to special users via the iptables owner module.

As normal user you do not need any harden-* packages. They either conflict on unsafe packages, which you probably have not installed anyway, or install security packages which are for normal systems too complicated to configure and maintain - like network intrusion systems.

share|improve this answer
    
I think this answer is very good, maybe it deserves to be accepted. –  Patkos Csaba Mar 2 '12 at 21:00
    
I disagree. It does not address the issue asked, which is how to restrict network access on a program basis. It reduces risk, but does not prevent it. –  jmtd Mar 5 '12 at 14:50
    
@jmtd IMHO, the question was answered: "It is difficult, look at the linked question." BTW, I have added now a reference to Leopard Flower which seems to provide a good solution, but is not yet complete (beta phase). –  jofel Mar 5 '12 at 16:32
add comment

I would agree with the strict use of iptables. It is a very simple commandline based firewall that utilizes the kernel (in most distros).

Another suggestion I would make is selinux. I'm not sure if debian now comes with it by default. Selinux in short is mandatory access control meaning on a kernel level it governs the communication between the application and external resources (i.e files and system properties). As a sidenote, it was also developed with help from the NSA. With selinux profiles you can prevent applications from reading files beyond its scope.

Combined with the best practices such as disabling unneeded daemons, good firewall rules selinux might be the option you are looking for to harden this box.

share|improve this answer
    
This answer could be improved by providing an example selinux policy which demonstrated doing what the OP was asking for. –  jmtd Mar 5 '12 at 14:54
    
As requested here is a good Cent OS example of how to harden an apache access using selinux command line. wiki.centos.org/HowTos/… –  Andrew Munro Mar 5 '12 at 22:55
add comment

Unfortunately, there don't seem to be any Linux alternatives to littlesnitch or zonealarm, and most of the GUI'd firewalls will leave you wanting. You can of course do quite a few useful things with iptables and connection tracking so.

One often overlooked utility is tcpwrappers. I would add a rule to /etc/hosts.deny:

ALL: PARANOID

Also, disable ping and other ICMP responses by adding the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_all = 1

EDIT: I'm inclined to agree with jmtd, on second thought there are better ways to filter pings.

share|improve this answer
    
The trouble with tcpwrappers is it's opt-in: The program needs to be linked to the wrappers library for it to actually take effect. iceweasel is not. You could force it to be via an LD_PRELOAD trick if you wanted to. –  jmtd Mar 5 '12 at 14:52
    
disabling ICMP responses is of questionable benefit security wise, and is not without cost: it can make network interactions a lot slower if a response waits to time-out, rather than getting an explicit deny. Rate limiting responses to protect against DDoS is a much better approach. ICMP-DDoS is almost a non-existent problem for desktop users in the modern age. –  jmtd Mar 5 '12 at 14:53
    
@jmtd tcpwrapper is not LD_PRELOAD-capable. Programs need to support it. For static linked programs, LD_PRELOAD would not work anyway. –  jofel Mar 5 '12 at 16:41
    
@jmtd I agree, I've edited my answer. I do however still believe that ignoring pings is beneficial not for protection from ICMP-DDoS just to avoid host discovery. –  kwarrick Mar 16 '12 at 1:07
add comment

Stop all the services you do not wish to start: ssh, smtp, http, whatever else you do not wish to be started. Set up your iptables to block everything accessing your machine or leaving your machine apart from the software that you want.

Note that I am not giving a whole list of commands to type as it is vital that one learns and understands the implications of services and iptables before messing with them.

share|improve this answer
add comment

The most popular basis of network filtering/firewalls on Linux is iptables, which does not work on an application basis. What you need is a security policy program that can restrict programs from being able to access network resources. Two approaches would be SELinux and AppArmor.

Here are some example AppArmor recipes, one of which opens up network access for Firefox/Iceweasel.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.