Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Debian comes with several harden packages, designed to make a computer more secure. My needs are very simple: word processing and Web browsing. I do not run any special servers, do not use SSH, telnet, etc. The only software that should use the Internet, that I know of, is iceweasel and apt.
harden packages suitable for these needs?In a default user installation, there is only ssh as server application installed which you can simply uninstall via aptitude remove openssh-server or via any other package manager you use.
Restricting network access for applications is difficult.
{{ EDIT: However, there is now Leopard Flower developed which seems to provides the features you need (per-process firewall, interactive user interface). }} See Per process firewall? for more information about the topic.
Without using complicate solutions, you can only restrict network access to special users via the iptables owner module.
As normal user you do not need any harden-* packages. They either conflict on unsafe packages, which you probably have not installed anyway, or install security packages which are for normal systems too complicated to configure and maintain - like network intrusion systems.
I would agree with the strict use of iptables. It is a very simple commandline based firewall that utilizes the kernel (in most distros).
Another suggestion I would make is selinux. I'm not sure if debian now comes with it by default. Selinux in short is mandatory access control meaning on a kernel level it governs the communication between the application and external resources (i.e files and system properties). As a sidenote, it was also developed with help from the NSA. With selinux profiles you can prevent applications from reading files beyond its scope.
Combined with the best practices such as disabling unneeded daemons, good firewall rules selinux might be the option you are looking for to harden this box.
Unfortunately, there don't seem to be any Linux alternatives to littlesnitch or zonealarm, and most of the GUI'd firewalls will leave you wanting. You can of course do quite a few useful things with iptables and connection tracking so.
One often overlooked utility is tcpwrappers. I would add a rule to /etc/hosts.deny:
ALL: PARANOID
Also, disable ping and other ICMP responses by adding the following line to /etc/sysctl.conf:
net.ipv4.icmp_echo_ignore_all = 1
EDIT: I'm inclined to agree with jmtd, on second thought there are better ways to filter pings.
tcpwrappers is it's opt-in: The program needs to be linked to the wrappers library for it to actually take effect. iceweasel is not. You could force it to be via an LD_PRELOAD trick if you wanted to.
LD_PRELOAD-capable. Programs need to support it. For static linked programs, LD_PRELOAD would not work anyway.
Stop all the services you do not wish to start: ssh, smtp, http, whatever else you do not wish to be started. Set up your iptables to block everything accessing your machine or leaving your machine apart from the software that you want.
Note that I am not giving a whole list of commands to type as it is vital that one learns and understands the implications of services and iptables before messing with them.
The most popular basis of network filtering/firewalls on Linux is iptables, which does not work on an application basis. What you need is a security policy program that can restrict programs from being able to access network resources. Two approaches would be SELinux and AppArmor.
Here are some example AppArmor recipes, one of which opens up network access for Firefox/Iceweasel.
