Introduction.
When it comes to any server or network connected to the internet,
security from malicious files and hack attempts is a matter of concern
for any administrator. Linux provides its own firewall from the early
releases itself. The current iptables firewall maintained by the
netfilter team is advancing to more powerful security and network
management tool with the recent releases.It will be a topic of interest
for any linux based server/network administrator.
This article covers effective configuration and optimization of the
iptables firewall system in 2.6.x kernels in order to more effectively
defend against TCP attacks and to drop unwanted packets without messing
them up with your business critical services!!
Kernels from 2.6 include support for matching strings present in IP
packets, inspecting the entire packet data. Earlier kernels supported
matching at the IP header level only, which was a limitation as the
rules can be formed only based on header values like IP addresses,
ports, packet state etc. The netfilter iptables firewall system has
undergone great advancements in the latest kernels, with the modified
string matching option being more interesting among them for server
administrators. The rules, based on string matching functions, are very
easy to implement. This guide intends to introduce the method to users
with a basic understanding of networking and iptables.
System Requirements.
- Preferred kernel version : 2.6.18 or later.
- The iptables program(1.3.5 or later) installed on your machine.
- The kernel should be compiled with string matching support. To do
this, the following line should be added to the .config file prior to
compiling the kernel:
CONFIG_NETFILTER_XT_MATCH_STRING=m
If you use a pre-complied kernel, check for this option in the
config file
with the appropriate version of the kernel in your
/boot directory. If
present, it means that netfilter string matching is compiled as a
module.
Make sure that the module is loaded (using the
lsmod command or by
looking for the appropriate entry in the
/proc/modules file).
The minimum requirement is a 2.6.14 kernel, however it is a bit
difficult to get it working on kernels before 2.6.18. Customising the
kernel and iptables is required in that case. Suggested configuration
options for older kernels can be detailed in another article, if
there is demand.
Formating the Rules.
If iptables is installed with string matching support, its man page
can be found with the following command:
iptables -m string -help
Here is the relevant section from the iptables(8)
man page:
string
This modules matches a given string by using some
pattern matching strategy. It requires a linux kernel >= 2.6.14.
--algo bm|kmp
Select the pattern matching strategy. (bm = Boyer-
Moore, kmp = Knuth-Pratt-Morris)
--from offset
Set the offset from which it starts looking for any
matching. If not passed, default is 0.
--to offset
Set the offset to which it starts looking for any
matching. If not passed, default is the
packet size.
--string pattern
Matches the given pattern. --hex-string pattern
Matches the given pattern in hex notation.
In iptables 1.3.5, you need to specify the algorithm to use for
string matching using the --algo option. We may limit the search by
specifying the offset values as well. Two algorithms can be used,
Boyer-Moore and Knuth-Morris-Pratt. More information regarding these
algorithms can be found at Wikipedia -
for Boyer-Moore the URL is:
http://en.wikipedia.org/wiki/Boyer%E2%80%93Moore_string_search_algorithm
and for Knuth-Morris-Pratt the URL is:
http://en.wikipedia.org/wiki/Knuth%E2%80%93Morris%E2%80%93Pratt_algorithm
Boyer-Moore is efficient and fast and is preferable in most cases.
Common Applications and Useful Example Rules:
1) To prevent an intrusion attempt.
In case, a suspecious URL upload using the webserver was detected, You could frame similar rules as follows.
iptables -I INPUT 1 -p tcp --dport 80 -m string --string "cmd.exe" --algo bm -j DROP
The rule blocks all packets to port 80 containing the string cmd.exe.
Mod_security is an option for the same, but it can be an overload to
your busy webservers.
2) To defend DDOS to a service.
It is a common case where we need to drop requests to a domain when
it is under DDOS. mod_dosevasive is an option, but it really overloads
the webserver. String matching option can be utilized here without
overloading the webserver.
iptables -I INPUT 1 -p tcp --dport 80 -m string --string "domain.com" --algo kmp -j DROP
The rule, blocks all web requests to domain.com. These rules can
also be used in conjunction with other iptables matches and options
depending on what is required.
3) To Defend against E-mail Spoofing.
We can make use of the string matching option in numerous cases
to drop intruder and spam packets before they enter the server. Another
instance for example is, if the mail server is receiving many spoofed
e-mails with a
common 'Subject'.If the spammer is using a unique IP address, it is
very easy to block him using RBLs, conventional
iptables rules
etc. But when the spammer is using different IP addresses, it makes
things difficult for the administrator.In such a case, the following
string based rule can be added to the firewall so that the mail server
will not get overloaded by the spoofed mails.
iptables -I INPUT -p tcp --dport 25 -m string --string "Subject" --algo bm -j DROP
**Do it now with an optimised rule!
The same rule might be modified to one with less overhead (that
is, it uses less resources) by limiting the search specifying offset
values, and by assuming that the SMTP subject header will be within an
offset limit of 15000 in the packet.
iptables -I INPUT -p tcp --dport 25 -m string --string "Subject" --algo bm --to 15000 -j DROP
4) Other general cases.
Apart from the instances discussed above, you can make use of the string
matching options, wherever you need to manage the packets entering a
server or network,based on strings like URLs, file names, file contents
etc.
Conclusion.
The string matching option can be effectively utilized when a
network needs to be filtered using strings. We can block the packets
right at the kernel level itself without overloading your server
applications. However, there is a higher overhead
involved for the kernel with string matching, compared to other ordinary
iptables matchings. Offset limits
should be specified for searching wherever possible in order to reduce
this overhead.
