1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<META NAME="GENERATOR" CONTENT="SGML-Tools 1.0.9">
<TITLE>The Mason HOWTO: Introduction</TITLE>
<LINK HREF="mason-3.html" REL=next>
<LINK HREF="mason-1.html" REL=previous>
<LINK HREF="mason.html#toc2" REL=contents>
</HEAD>
<BODY>
<A HREF="mason-3.html"><IMG SRC="next.gif" ALT="Next"></A>
<A HREF="mason-1.html"><IMG SRC="prev.gif" ALT="Previous"></A>
<A HREF="mason.html#toc2"><IMG SRC="toc.gif" ALT="Contents"></A>
<HR>
<H2><A NAME="s2">2. Introduction</A></H2>
<P>
<BLOCKQUOTE>
"If you have not checked out Mason, I highly recommend it. Mason is a
Linux based firewall, but none like you've ever used.
In short, you put Mason into learning mode and run the services to the
Internet you wish to support. Mason will then take these log entries and
turn them into a set of packet filtering rules. Pretty cool eh? No ACK
compliment rules to worry about, no "what was that service port again?"
decisions to worry about, simply plug it in, let it learn and off you
go. :)"
</BLOCKQUOTE>
- - Chris Brenton,
<A HREF="mailto:cbrenton@sover.net">cbrenton@sover.net</A><P>
<P> The Mason script interactively builds a (fire)wall on a Linux
machine. For more details about how this is done, please read on for
background, theory of operation, a quick start, and additional
documentation on firewalls and firewall gotcha's.
<P>mason.txt and related documentation should have been installed to
/usr/doc/mason-{version}/ . If they are missing or you would like to make
sure you have the latest version, please go to
<A HREF="http://www.stearns.org/mason/">http://www.stearns.org/mason/</A> .
<P>The impatient should go right to the
<A HREF="mason-3.html#quickstart">Quickstart</A>.
<P>
<H2><A NAME="ss2.1">2.1 Background and motivation</A>
</H2>
<P> The built-in firewall features of the Linux kernel offer a
powerful set of packet filtering features that can be used to build a
firewall. The various pieces of available documentation provide an
introduction on how to configure the firewall for simple setups, but can't
possibly explain how to configure a firewall for more complex setups,
including fine-grained allow and deny lists. This is especially obvious
when trying to create a firewall with a default policy of deny.
<P>Someone looking to configure a linux firewall is simultaneously
hit with the complexity of trying to understand the ipfwadm syntax, trying
to understand the structure of TCP/IP connections, and trying to create
and implement a security policy. No wonder firewalls are daunting!
<P>The Mason application attempts to handle the first two problems by
dynamically creating the firewall based on the traffic flowing through it.
For example, if you start up a telnet session through your firewall from a
machine on your LAN to a machine out on the WAN while mason is running,
mason will create all the rules necessary to allow this traffic.
<P>Conversely, if you're looking to block incoming NFS requests,
simply launch mason, select a "deny" or "reject" policy, and make the NFS
connection. When the firewall is restarted, voila! No more incoming NFS.
<P>Creating a firewall no longer requires understanding the
ipfwadm, ipchains or iptables syntax. Even novices can create a
firewall under Linux. _HOWEVER_, creating a _good_ firewall _still_
requires some understanding of TCP/IP protocols and packet filtering.
Many good books cover this. Check out O'Reilly and Associates (
<A HREF="http://www.ora.com">http://www.ora.com</A> or
<A HREF="http://www.oreilly.com">http://www.oreilly.com</A> )
for some excellent general coverage of firewall designs.
<P>One last novice's mistake I'd like to see Mason users avoid is the
false sense of security that a firewall can provide. _Truly_ securing a
system or network requires _much_ more than simply filtering packets.
The aforementioned books provide a great background in general security.
<P>
<H2><A NAME="ss2.2">2.2 Basic theory of operation</A>
</H2>
<P> Before starting, if the user has some rules that he or she
knows should be used in this machine, these can be added to
/var/lib/mason/baserules. As part of the process of running Mason,
we'll add rules that log all other packets to /var/log/messages. The
"tail" command is used to feed these log messages into Mason, which
converts each log entry into the corresponding command necessary to
allow that kind of traffic. In the previous telnet example, 6 different
firewall rules would be created on the firewall, three for the original
request packet, 3 for the response back from the server (just 1 or 2 in
iptables firewalls):
<P>
<PRE>
pkt 1: Allow telnet request in from LAN
pkt 1: Forward request through firewall
pkt 1: Allow request to exit to WAN
pkt 2: Allow telnet response back into firewall from WAN
pkt 2: Forward response through system
pkt 2: Allow response to exit back to the original machine on the LAN.
</PRE>
<P>All packets from 3 on are handled by these rules. There may be a
short delay in the initial connection as the rules are created.
<P>The script creates the actual ipfwadm/ipchains/iptables commands
to accomodate the packet flow. When the command is executed the new
rule is inserted at the head of the existing rules so that future
packets of this type no longer reach the logging rule at the bottom.
<P>The rules are also echoed to the console so that you can see the
rules as they are executed or redirect them to a file. This process is
handled automatically by mason-gui-text.
<P>If any of this is unclear, take a look at the
<A HREF="mason-3.html#quickstart">Quickstart</A> which walks you through actually
running it. It'll make more sense when you see it in action.
<P>
<H2><A NAME="ss2.3">2.3 Compatibility and requirements</A>
</H2>
<P>
<UL>
<LI>Distributions
<UL>
<LI>Heavily tested on RedHat 5.x, 6.x, and 7.x</LI>
<LI>Compatible with Debian 2.x</LI>
<LI>Probably works with Slackware</LI>
<LI>Probably works with Suse, but you need to choose between the default /etc/rc.d/init.d/firewall and the one included with Mason</LI>
</UL>
</LI>
<LI>Requirements
<UL>
<LI>Bash 1.x or 2.x</LI>
<LI>Standard system utilities: awk, cat, chmod, cut, grep, head, ifconfig, mkdir, ps, route, sed, sleep, sort, tail, touch, tr, true, uniq and wc</LI>
<LI>A kernel that supports packet filtering and packet logging (kernel 2.0's ipfwadm, kernel 2.2's ipchains, or 2.4's iptables)</LI>
<LI>The ipchains, ipfwadm or iptables binaries.</LI>
</UL>
</LI>
<LI>Things Mason doesn't care about
<UL>
<LI>Hardware architecture (i386, Axp, Sparc...)</LI>
<LI>Number or type of interfaces</LI>
<LI>Whether the machine is a router or end-node (a normal server or workstation).</LI>
</UL>
</LI>
</UL>
<P>
<P>
<H2><A NAME="ss2.4">2.4 Features</A>
</H2>
<P>Mason supports the following: (see the release notes for additional features)
<UL>
<LI>It accepts any mix of ipchains, ipfwadm or iptables log entries as
input.</LI>
<LI>It can run on an ipfwadm, ipchains or iptables kernel.</LI>
<LI>It can spit out ipfwadm, ipchains or iptables output.</LI>
<LI>In theory, the above 3 are independent from each other. Mason
can, for example, accept ipchains and ipfwadm log entries, run on an
ipfwadm host, and output ipchains rules. Unfortunately, the structure
and design of an iptables firewall is sufficiently different from
ipfwadm and ipchains firewalls that you can't automatically convert back
and forth.</LI>
<LI>It will run on the firewall machine or on another machine, using
the firewall's packet logs as input.</LI>
<LI>It can run as the traffic is flowing through the machine or be fed
the firewall logs later.</LI>
<LI>While there are some advantages to running as root, it can be run
as a non-root user.</LI>
<LI>Mason will put in a macro for dynamic IP addresses, usually for
your ppp link.</LI>
<LI>It supports any kind of interface that can carry TCP/IP traffic.</LI>
<LI>It recognizes any protocol listed in /etc/services and commonly
used icmp protocols.</LI>
<LI>It automatically handles setups such as cable modem or satellite
where the packets go out on one interface and come back on another.</LI>
<LI>It automatically handles masquerading on the firewall and the
strange rules that can require.</LI>
<LI>It allows you to put in any rules you may know you need and fills
in the rest, or just builds the entire thing for you if you prefer. It
can also be used after a firewall has been created to fill in some new
rules or new protocols.
</LI>
<LI>It automatically generalizes the firewall rules in the following ways:
<UL>
<LI>Any local IP addresses are converted to the corresponding
local network. Special IP's (0.0.0.0, 127.0.0.1,
255.255.255.255) are handled appropriately. Mason can also be
configured to leave addresses alone or convert them to
hostnames. This gives you the ability to either treat all
machines in a subnet as having equal access rights or create
fine-grained access rules for individual servers, as you choose.</LI>
<LI>Non-local IP's are converted to 0/0 (anywhere).</LI>
<LI>Port numbers in /etc/services are converted to the
corresponding service name.</LI>
<LI>High port numbers are generalized to 1024:65535. The
special port needs of ssh, traceroute, nfs, ip masquerading,
irc, x, openwindows, and vnc are handled automatically.</LI>
</UL>
</LI>
<LI>The ack flag is set for all tcp connections except for ftp.</LI>
<LI>The TOS (type Of Service) flag is set for ftp, ftp-data, imap,
irc, nntp, pop, ssh, snmp, and telnet to improve interactive performance
by queuing interactive packets ahead of bulk transfer packets.</LI>
<LI>Each output line is commented to give you an idea of what it's for
and allow for easy grouping via sort.</LI>
<LI>The rule policy can be changed on the fly without having to stop
Mason.</LI>
<LI>Because Mason is a shell script, it can run on any system with
bash and basic GNU tools (sed, awk, grep, etc.). Actually creating the
firewall log entries, interactively building the firewall, or
implementing the finished firewall needs requires a Linux system with
appropriate kernel (generally 2.0.0 and up, including 2.1.x and 2.2.x)
with firewalling and firewall packet logging built in.</LI>
<LI>Thanks to Don Howard
<A HREF="mailto:howarddj@bigvax.alfred.edu">howarddj@bigvax.alfred.edu</A>, Mason 0.12.0 and above have initial
support for creating Cisco ACL's. The support is not truly complete,
and hence untested. It needs someone that's interested in working with
me on the project before it's complete.</LI>
<LI>A rather extensive manual/howto/notes file covers operating Mason
and some issued associated with packet filtering firewalls. Good
reading for anyone trying to understand some of the more advanced topics
in packet filtering firewalls.</LI>
<LI>automatically makes masq rules for reserved addresses</LI>
<LI>icmp subcodes</LI>
<LI>support for ip tunneling, cipe and a number of other protocols</LI>
<LI>removal of the namecache (no longer needed)</LI>
<LI>mason now stops logging packets quickly while it does the main
processing</LI>
<LI>stop using ipcalc to calculate broadcast</LI>
<LI>don't touch /etc/hosts or /etc/services</LI>
<LI>more Debian integration and two man pages (Thanks, Jeff!)</LI>
<LI>support for ipchains-save output format</LI>
<LI>support for --sport and --dport (Thanks, Rusty!)</LI>
<LI>major documentation updates</LI>
<LI>the ability to add packet counts to each rule, sorting the most
commonly used rules to the top (ipfwadm and ipchains only; iptables no
longer requires this).</LI>
<LI>misc. bug fixes and performance improvements</LI>
<LI>fixes to the Cisco output format</LI>
<LI>the ability to generalize the ack rules for tcp connections,
cutting 25%-35% of the rules</LI>
<LI>an internal checkpointing ability to help in debugging</LI>
<LI>Mason can find the smallest subnet that encompasses the ips found
on a dynamic interface </LI>
<LI>and no_outgoing_ protocols</LI>
</UL>
<P>
<HR>
<A HREF="mason-3.html"><IMG SRC="next.gif" ALT="Next"></A>
<A HREF="mason-1.html"><IMG SRC="prev.gif" ALT="Previous"></A>
<A HREF="mason.html#toc2"><IMG SRC="toc.gif" ALT="Contents"></A>
</BODY>
</HTML>
|
