Re: Locking Down a Linux Box

From: Jeff Schaller (schaller@freeshell.org)
Date: 01/03/02 

Date: Wed, 2 Jan 2002 23:36:44 +0000 (UTC)
From: Jeff Schaller <schaller@freeshell.org>
To: <focus-linux@securityfocus.com>

I have a half-baked idea that I'm working on that involves a
secure linux box. Mine will be a firewall, but the idea could be
extended to an IDS or basic web server or etc.

The idea is that the linux box is a write-once box; all setup and
configuration is done on another system. For example, I currently
create a kernel/filesystem image on a 3.5" floppy that boots and
runs the system. It currently doesn't use (mount) any hard drive
or CD-ROM, but it could.

The kernel on the filesystem doesn't include floppy support; you
could extend this idea to making the floppy's filesystem minix and
then include only minix fs support.

The permissions on the filesystem are stripped to bare minimums,
and then chattr -i'd.

The startup sequence runs a one-time init script which sets up the
firewall rules and services, and then removes most of the
remaining programs ("rm", "ipchains", "mount", etc).

There would be no network access/login to the box -- console,
only, if you want to log in and attempt to do something. If you
want to make changes, you make them on the host system and
re-create the boot floppy.

I like the idea of using a boot floppy because I can remove files
I don't need when I'm done with them; on a CDROM, I can't do that.

So, I like imagining this setup against various attack scenarios,
such as the interesting example put forward by Kurt a few posts
ago where the attack mounts another filesystem over the top of one
of yours. In Jeff's half-baked plan, that wouldn't be possible
because the mount program is gone. There'd be no compiler, or even
room to upload a compiled binary. (A /tmp directory is created
with the minimum amount of space needed for temporary stuff durnig
bootup).

I'm calling it half-baked because I haven't finished it or the
article describing it (and I haven't done those because I haven't
finished working out how I want all the details to work).

-jeff 

-- 
"You're dead", he said.  Keli waited. She couldn't think of any suitable
reply.  "I'm not" lacked a certain style, while "Is it serious?" seemed
somehow too frivolous.  -- Princess Keli in trouble (Terry Pratchett, Mort)

Relevant Pages

  • [RFC][0/21]extend file size and filesystem size
    ... I have tried to extend the filesystem size and file size in ext2/3 ... A summary of my reform to extend the specs in ext2/3 is as below. ... type of variables in relation to block and inode, ... Change the type of 4byte variables manipulating a block or ...
    (Linux-Kernel)
  • Re: root drive size
    ... So a VG is a logical entity of physical disks and any later task is ... Filesystem or give you even raw access to a disk. ... The nice thing in AIX is: You can extend a Filesystem thus its ... you can not extend the rootvg to use the rest of the harddrive ...
    (comp.unix.aix)
  • Re: lvextend and extendfs problems
    ... Alain wrote: ... Display disk information on the logical volume ... Make sure this is enough Free PE's to increase this filesystem. ... Extend the logical volume that holds the filesystem. ...
    (comp.sys.hp.hpux)
  • Re: reduce logical partitions
    ... >> then readd it with correct number of LPs. ... the OP has a filesystem ... and added LPs to the logical volume but did not yet extend the ...
    (comp.unix.aix)
  • Re: Houston, I May Have a Problem (chkrootkit Results)
    ... > few little experiments and forgot to turn the firewall back on. ... is that you can resize partitions on the fly, ... the filesystem. ... on which I was recording a movie off of cable, ...
    (Debian-User)