Chapter 8: Advanced Security Features

FreeBSD includes a variety of tools for securing network traffic and users. For example, you can implement traffic controls that refuse to allow connections to or from certain parts of the Internet in a few different ways. Also, you can cage off users in a virtual machine, called a jail, where they have access to everything but the main server. We'll discuss these techniques in this chapter, as well as how to monitor your system's security and what to do if you are the victim of an intruder. We'll start with the basics, network traffic control.

Traffic Control

As a sysadmin, you must be able to control traffic to and from your systems so that you can block unwanted visitors. FreeBSD provides a variety of tools that allows you to control outside access to your systems. We'll focus on TCP wrappers and packet filtering, two access−control tools with enough overlap in functionality that they make a perfect pair.

The TCP Wrappers program controls access to particular server programs (also known as daemons). Connection requests are handed to the TCP Wrappers software, which evaluates them according to its configuration. TCP Wrappers is fairly simple to configure, and doesn't require much knowledge of networking, but server programs must be built to work with TCP Wrappers.

Packet filtering controls which packets the system will accept. A rejected connection request never makes it to a userland program; it is rejected in the network stack at a low layer. Packet filtering can control traffic to any program, service, or network port, but it does require more knowledge of networking.

In either case, before you can implement traffic control, you'll need to decide whether you want a default accept or a default deny traffic−control policy.

Default Accept vs. Default Deny

One of the essential ideas in any security system is the idea of default accept versus default deny. A default accept stance means that you allow any type of connection except what you specifically disallow. A default deny stance means that you only allow connections from specified parts of the Internet, and all other connection attempts are refused. Once you have chosen your default, you can adjust your stance to protect or reveal those services you wish.

When choosing between default accept and default deny, your choice is really between whether you are offering services to the world or only to a select few, and whether anyone can access your system.

If your system acts as a corporate Web server, you may decide to make it visible only to users on your corporate network. If so, you've adopted a default deny stance, and you'll explicitly list who can talk to you. (This is my preferred approach whenever possible.) Alternatively, if you choose to keep your system open to everyone except someone you don't like, you're adopting a default accept stance.

Also, just because you choose a default does not mean that all services on your computer must obey the default. I configure Web servers on the open Internet to have a default deny stance, and specifically open the world's access to the Web server. Attempts to connect to other programs running on those machines are rejected, unless they come from one of a few IP addresses that I

157