Re: are IPTABLES good enough security for a webserver

From: Alan Frame (alan.frame@acm.org)
Date: 04/09/03

  • Next message: Pifu: "I want to install a Linux Firewall into my Lan. What's the best?" 
    From: alan.frame@acm.org (Alan Frame)
Date: Wed, 9 Apr 2003 09:17:12 +0100

    Kasper Dupont <kasperd@daimi.au.dk> wrote:

    > Grant Holman wrote:
    > >
    > > Will IPTABLES act as a secure enough firewall for a web server or should I
    > > be looking at a dedicated 3rd party firewall packge?
    >
    []
    > But whatever you choose to do, you should still configure the
    > webserver in a way that would be secure even without any firewall. No
    > firewall however good it may be, will secure you if you don't keep
    > your webserver software updated.

    Indeed.

    A reasonable set of iptables rules for a webserver would be to only
    allow new incoming connections from world+dog to 80 & 443 on a public
    (possibly port-forwarded- IP addreess and ssh (with key) from specified
    trusted hosts on 1918 addresses on another NIC.

    After those three lines setting up iptables, my job is done, and it's up
    to the application-support guys to secure the box against in-band
    attacks.

    Would the webserver in question be running, say, PHP, perl[0], or an old
    Apache, or an old ssl?.....

    rgds, Alan
    [0] i.e. untrusted cgi 

    -- 
99 Ducati 748BP, 95 Ducati 600SS, 81 Guzzi Monza, 74 MV Agusta 350
"Ride to Work, Work to Ride" SI# 7.067 DoD#1930 PGP Key 0xBDED56C5
  • Next message: Pifu: "I want to install a Linux Firewall into my Lan. What's the best?"

    Relevant Pages

    • Re: Wrt54G is a FW appliance?
      ... >can be considered as fully secure. ... >> calls it a firewall, that is not what makes it a firewall. ... an IPtables implementation on one device... ...
      (comp.security.firewalls)
    • Re: Free Firewall for W2K Server
      ... don't they use some iptables stuff and use the IP stack or something =) ... > Download the iso for Smoothwall or ipcop and run it up in one of your old ... More secure than any wintel firewall garbage around. ...
      (microsoft.public.win2000.general)
    • Re: iptables - newbie
      ... If your webserver is *inside* the LAN, you can do it inside the nat ... You'll also need a rule in the FORWARD chain of the filter table to ... If your webserver is actually on the firewall box (not recommended, ... iptables on it to filter in a similar manner to what you would ...
      (comp.os.linux.networking)
    • Re: linux newbie: how to stop port scan abuse?
      ... I would recommend converting to the IPTABLES firewall and from there create ... There is a script you can use that the author provides. ... >> tried to keep it as secure as possible. ...
      (comp.os.linux.security)
    • Re: are IPTABLES good enough security for a webserver
      ... > Will IPTABLES act as a secure enough firewall for a web server or should I ... router/firewall in front of a webserver configured with iptables. ...
      (comp.os.linux.security)