SELinux and iptables

While working on servers recently, I ran into a few concepts I wasn’t clear about, so I looked up some references and organized them as follows.

1. The BLP Security Model

The model divides the entities in an information system into two parts:

Subject: the entity performing the operations, such as users and processes
Object: the entity being operated on, such as files and databases.

For subjects and objects, there are two most important security control methods:

DAC (Discretionary Access Control). The DAC mechanism means the owner of an object can freely modify or grant permissions on that object. From the perspective of subjects and objects, the subject that owns an object has the authority to decide what access rights it and other subjects should have on that object.
MAC (Mandatory Access Control). The MAC mechanism means the system no longer allows an object’s owner to freely modify or grant permissions on that object; instead, permissions are granted to each object one by one in a mandatory way. SELinux adopts this mechanism. It is mainly implemented through security levels.

2. SELinux

The NSA (National Security Agency) found that most operating systems base their security authentication on the DAC mechanism. Because the design of the DAC mechanism is unfavorable to system security, the NSA has long been committed to developing a more secure MAC operating-system security authentication mechanism.

SELinux was designed precisely to solve this class of problem. Under SELinux, the root account uses a mandatory access control mechanism. At the same time, it restricts users and programs (subjects) to the minimum privileges needed to complete their tasks, greatly improving the security of Linux systems.

In a Linux operating system with SELinux enabled, when an object needs to perform an operation, it first passes the DAC check, and then is checked by the security policy customized by SELinux.

For example, suppose a vulnerability is discovered in Apache on the system that lets a remote user access sensitive files on the system (such as /etc/passwd). The DAC check can be bypassed in that case, but access to /etc/passwd will be blocked by SELinux. SELinux can significantly reduce the impact of 0-day security vulnerabilities.

2.1 Checking SELinux Status

1
getenforce

There are three possible return values:

Disabled means SELinux is disabled
Permissive means it only logs security warnings but does not block suspicious behavior
Enforcing means it logs warnings and blocks suspicious behavior

2.2 Changing SELinux Status

1
setenforce [1 | 0 ]

0 means Permissive,
1 means Enforcing

This command only takes effect for the current boot; it is lost after a reboot.

3. Netfilter

Netfilter is a subsystem introduced in Linux 2.4.x. As a general, abstract security framework, it provides a complete management mechanism for hook functions. It has the following capabilities:

Network address translation (Network Address Translate)
Packet content modification
A packet-filtering firewall

4. iptables

iptables is the tool for configuring Netfilter; through iptables, users apply their security settings to the corresponding firewall, Netfilter.

It has five hooks to control the flow of packets:

INPUT: incoming to the local machine
OUTPUT: outgoing from the local machine
FORWARD: forwarding
PREROUTING: input control
POSTROUTING: output control

4.1 Usage

The general syntax for commands that add/remove/edit rules is as follows:

1
iptables [-t table] command [match] [target]

An iptables rule contains the following 4 basic elements:

Table. There are three available table options: filter, nat, and mangle.
- The filter table is used for general packet filtering
- The nat table is used for packets to be forwarded
- The mangle table is used to make changes to packets and their headers
Command
- -A or –append: this command appends a rule to the end of a chain
- -D or –delete: by specifying the rule to match with -D, or by specifying the rule’s position number in the chain, this command deletes that rule from the chain
- -P or –policy: this command sets the default target of a chain, i.e. the policy. All packets that match no rule in the chain are forced to use this chain’s policy
- -N or –new-chain: creates a new chain with the name specified in the command
- -F or –flush: if a chain name is specified, this command deletes all rules in that chain; if no chain name is specified, it deletes all rules in all chains. This parameter is used for a quick cleanup
- -L or –list: lists all rules in the specified chain
- -R or –replace: replaces a matching rule in the specified chain
- -X or –delete-chain: deletes the user-defined chain specified, or all user-defined chains if none is specified
- -C or –check: checks whether a packet matches the rules of the specified chain
- -Z or –zero: zeros the byte counters of all rules in the specified chain
Matches - -p or –protocol: this general protocol match is used to check for certain specific protocols. Protocol examples include TCP, UDP, ICMP, a comma-separated combination list of any of these three protocols, and ALL (for all protocols). ALL is the default match. You can use the ! symbol to indicate “does not match this item”. - -s or –source: this source match is used to match packets by their source IP address. This match also allows matching against a range of IP addresses; you can use the ! symbol to mean “does not match this item”. The default source match matches all IP addresses. - -d or –destination: this destination match is used to match packets by their destination IP address. This match also allows matching against a range of IP addresses; you can use the ! symbol to mean “does not match this item”. - –sport: specifies the source port or port range for the matching rule. - –dport: specifies the destination port or port range for the matching rule.
-i sets filtering rules for a single network interface or a type of interface
Target
- ACCEPT: when a packet fully matches a rule with the ACCEPT target, it is accepted (allowed to proceed to its destination)
- DROP: when a packet fully matches a rule with the DROP target, the packet is blocked and no further processing is done to it. This target is specified as -j DROP
- REJECT: this target works the same way as the DROP target, but it is better than DROP. Unlike DROP, REJECT does not leave dead sockets on the server and client. In addition, REJECT sends an error message back to the packet’s sender. This target is specified as -j REJECT
- RETURN: the RETURN target set in a rule stops packets matching that rule from traversing the chain containing the rule. If the chain is a main chain such as INPUT, the packet is handled using that chain’s default policy. It is specified as -jump RETURN
- LOG: means recording information about the packet into the log
- TOS: means rewriting the packet’s TOS value

4.2 Common Commands

1
2
3
4
5
6
7
8
#先检查是否安装了iptables
service iptables status
#安装iptables
yum install -y iptables
#升级iptables
yum update iptables
#安装iptables-services
yum install iptables-services

CentOS 7 uses firewalld by default to manage the Netfilter subsystem, but the commands it calls underneath are still iptables and the like.

1
2
3
4
#停止firewalld服务
systemctl stop firewalld
#禁用firewalld服务
systemctl mask firewalld

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#查看iptables现有规则
iptables -L -n
#先允许所有,不然有可能会杯具
iptables -P INPUT ACCEPT
#清空所有默认规则
iptables -F
#清空所有自定义规则
iptables -X
#所有计数器归0
iptables -Z
#允许来自于lo接口的数据包(本地访问)
iptables -A INPUT -i lo -j ACCEPT
#开放22端口
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#开放21端口(FTP)
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#开放80端口(HTTP)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#开放443端口(HTTPS)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#允许ping
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
#允许接受本机请求之后的返回数据 RELATED,是为FTP设置的
iptables -A INPUT -m state --state  RELATED,ESTABLISHED -j ACCEPT
#其他入站一律丢弃
iptables -P INPUT DROP
#所有出站一律绿灯
iptables -P OUTPUT ACCEPT
#所有转发一律丢弃
iptables -P FORWARD DROP

1
2
3
4
# 保存配置
service iptables save
# 重启服务
systemctl restart iptables.service

4.3 Deleting Rules

Syntax:

1
iptables -D chain rulenum [options]

chain refers to things like INPUT and FORWARD
rulenum refers to the rule number

For example, first use iptables -L INPUT to view the rule list, then run iptables -D INPUT 3 to delete the third rule.