Tag: security

35 commands to understand Firewalld in RHEL7 environment

Firewalld provides a dynamically managed firewall with support for network/firewall zones that define the trust level of network connections or interfaces. It has support for IPv4, IPv6 firewall settings, ethernet bridges, and IP sets. There is a separation of runtime and permanent configuration options. It also provides an interface for services or applications to add firewall rules directly.Firewalld.org

Photo Credits: Cloudflare.com
Photo Credits: Cloudflare.com

IPtables VS Firewalld

In RHEL6, we had IPtables. Now, in RHEL7, the firewall mechanism or say, the firewall daemon changed to Firewalld. Both serve the same purpose, i.e; packet filtering using the Netfilter module inbuilt in the Linux kernel. However, it is important to know why the Firewalld took over the IPtables. In Firewalld, you can change settings dynamically whilst being on production compared to IPtables which needs to flush out the entire rules set once a change has been made. Another difference is that during the installation of firewalld, you have support for both IPv4 and IPv6 compared to IPtables, you will have to install Ip6tables for IPv6 support. For those who are not acquainted with IPv6, please check out the article on “Diving into the basics of IPv6“. To briefly describe Firewalld, it is a set of services and daemons that manage the Netfilter in the Linux kernel. Finally, it is important to understand that both RHEL6 and RHEL7 used the IPtables (commands) to talk to the Netfilter.

Photo Credits: 8gwifi.org
Photo Credits: 8gwifi.org

Zones concept in Firewalld

One of the important concepts in firewalld is ‘zones’. Zones are groups of rules which is managed by the firewalld. Zones are based on the level of trust a user has on the interface and traffic within a network. Zones are even defined from least trusted to most trusted. These are the types of zones:

  • Drop zones: This is where incoming connections are dropped without any messages.
  • Block zones: Same as block zone but the only difference is that it gives an ICMP reply.
  • Public zones: It is an untrusted zone, but may allow connections based on case to case basis.
  • External zones: It is used when your firewall is also a gateway or simply, configuration for NAT.
  • Internal zones: This is the other side of the gateway or simply the firewall configurations used inside your own network, usually in a private network.
  • Demilitarized zones: Demilitarized zones or say DMZ, is where only certain incoming connections are allowed.
  • Work zones: There is a trust in the majority of hosts on the network which makes it possible to allow more services.
  • Home zones: The trust here is more and more acceptable and much more restrictions are removed.
  • Trusted: Here, there is absolute trust. Note that this should be used carefully.

VIEW information on your firewall

1. You can check if your firewall is running from either of the following commands:

systemctl status firewalld
firewalld-cmd --state

2. Like we said earlier, we can also check in which zone is the interface card configured:

firewalld-cmd --get-default-zone

firewalld-cmd

3. Now, to check which interface card is in which zone, simply do the following. As you can see below, both interface cards enp0s3 and enp0s8 is in the active zone:

firewalld-cmd --get-active-zone

firewalld-cmd

4. To check which rules are in the zones:

firewalld-cmd --list-all

35 commands to understand Firewalld in RHEL7 environment 1

5. If you want to get all the existing zones, simply do the following:

firewalld-cmd --get-zones

6. To list all existing rules within each zone, use the following:

Currently, you will also know which zones are your interfaces.

firewalld-cmd --list-all

firewalld-cmd

7. But, you can still list the rules for a specific zone, say, the ‘home’ zone.

firewall-cmd --zone=home --list-all

35 commands to understand Firewalld in RHEL7 environment 2

8. For more details of all zones:firewall-cmd –list-all-zones

9. We have also seen, for example, in part 4 that firewall-zone –get-active-zone also shows us the services associated with the zone. But, we can also see a list of services with the firewall-zone command:

firewall-cmd --get-services

The services are just XML file located in /usr/lib/firewalld/services

Change information on the Firewall

10. Let’s say you want to move one interface from one zone to another zone. In my case, I want to move enp0s3 from the public to the home zone.

firewall-cmd --zone=home --change-interface=enp0s3

You can verify same using firewall-cmd –list-all-zones

11. However, another way to made verifications can be done using the command:

firewall-cmd --get-active-zones

12. Please note that restarting the service firewalld will result in loss of the change carried out. To ensure it is effective even after a restart of the service, go on the configuration on the network card which is /etc/sysconfig/network-scripts/ifcfg-enp0s3 and add the following line to it.

ZONE=home

13. Also, note that you can always change the default zone from public to home directly with the command:

firewall-cmd --set-default-zone=home

14. To add a specific service to a zone, for example, adding https to the zone public.

firewall-cmd --zone=public --add-service=https

15. Please note that this is only temporarily and after a restart of the service, the https will not be anymore in the home zone. To make it permanent:

firewall-cmd --permanent --zone=public --add-service=https

Always test your change with a firewall-cmd –reload

16. Most of the time, if you are running your own custom application, let’s say it is running on port 8080 and the services are not seen using firewall-cmd get-services, you can still add it to a zone by mentioning the port.

firewall-cmd --permanent --zone=public --add-port=8080/tcp

After adding the port, you must reload it to view the change.

More crazy Firewalld rules

17. You can also specify a range, for example, from 8000 to 8080 using the command:

firewall-cmd --permanent --zone=public --add-port=8000-8080/tcp

18. More interesting if you want to allow a specific IP Address for a specific zone, you can use the –add-source parameter:

firewall-cmd --permanent --zone=public --add-source=10.0.3.16/24

19. We can also block a specific IP Address from a zone. Let’s say we want to block IP 10.10.10.10/24 from the zone public. For that, we have to use the parameter –add-rich-rule.

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.10.10/24" reject'

35 commands to understand Firewalld in RHEL7 environment 3

20. You might also want a particular service to be allowed from a particular IP Address. Let’s say we want to allow IP 10.10.10.5 for the zone public and only for the FTP service. In this example below, limit value=”2/m” means to limit 2 connections per minute.

[[email protected] services]# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.10.5/24" service name="ftp" log prefix="tftp" level="info" limit value="2/m" accept'
21. Let’s say you want to know which zone is a specific interface. You can use the following command:
firewall-cmd --get-zone-of-interface=enp0s3
22. You can also find how many particular interfaces are in a particular zone:
firewall-cmd --zone=public --list-interfaces
23. To stop all communications, let’s say during an attack, you can fire this command:
firewall-cmd --panic-on

24. You can also stop the panic using the following command:

firewall-cmd --panic-off

25. You can also check if you are in a query panic using the following command:

firewall-cmd --query-panic

NAT, Port Forwarding and Masquerading

Network Address Translation (NAT) means to use a strategy to hide an IP address space into another IP address by modifying the network address information in the IP header. The packets in the IP header will transit through a routing device.

Port Address Translation (PAT) sometimes called Port forwarding works the same fashion except that it works on port level. You can forward port 22 on from your IP address to port 8000 to your internal web server.
The word Masquerading itself means to use something fake. NAT masquerading is another strategy to allow a device that does not have an IP address to communicate with other computers on the internet. IP Masquerading means to set up an IP gateway for a device.
26. To check if masquerading is on or off, you can use the following command:
firewall-cmd --query-masquerade
27. Or say you want to query a particular zone if masquerade is on or off, simply use the –zone parameter:
firewall-cmd --zone=public --query-masquerade
28. To enable masquerade for the zone public
firewall-cmd --zone=public --add-masquerade
29.  Before performing a port forwarding, we need to enable the masquerading:
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.10.5/24" masquerade'

35 commands to understand Firewalld in RHEL7 environment 4

30.  Now, let’s say we want to forward all SSH traffic which is on port 22 to port 8000. This can be achieved using the following command:

firewall-cmd --permanent --zone=public --add-forward-port=port=22:proto=tcp:toport=8000

31. Since we did not define the IP address, it will redirect to localhost. Otherwise, you can also add an IP address:

firewall-cmd --permanent --zone=public --add-forward-port=port=22:proto=tcp:toport=8000:toaddr=10.0.2.16

32.  You can also query it by using the parameter –query-forward-port:

firewall-cmd --permanent --zone=public --query-forward-port=port=22:proto=tcp:toport=8000:toaddr=10.0.2.16

Other stuff in Firewalld

33.  You can also use firewalld on the graphic user interface. This can be done by installing the package firewall-config. The following command can be used:

yum install firewall firewalld-config

34. There are other ways to check if firewalld is running:

systemctl status firewalld
firewall-cmd --state

35. To active debug mode on firewalld logs enter the following parameter in the /etc/sysconfig/firewalld 

FIREWALLD_ARGS='--debug'

After setting the parameter, the service need to be restarted.

If you want to get to the Ninja level using firewalld, please refer to this blog article by certdepot.net

Attending AWSome day online conference 2019

The AWSome day was a free online Conference and a training event sponsor by Intel that will provide a step-by-step introduction to the core AWS (Amazon Web Services) services. Its free and everyone can attend. It was scheduled on 26 March 2019 online. The agenda covered broad topics such as AWS Cloud Concepts, AWS Core Services, AWS Security, AWS Architecting and AWS Pricing and Support. It’s pretty interesting for IT manager, system engineers, system administrators, and architects who are eager to learn more about cloud computing and how to get started on the AWS cloud. I do have some experience in managing AWS servers and even host my own server. However, I registered for the free training to refresh my knowledge and get more exposure such as the AWS pricing which I am not aware at all. Another interesting thing is that you will receive a certificate of attendance and you received 25 USD of AWS credits. Pretty cool right?

Attending AWSome day online conference 2019 5

Right from the beginning, I knew this was something interesting. I encountered a minor problem whilst signing in. I had to send a mail to support and it was resolved immediately. Once connected to the lobby, it was pretty easy to attend and follow the online conference. After some minutes, Steven Bryen, head in the AWS Cloud delivered the keynote speech.

Attending AWSome day online conference 2019 6

There was also an online challenge and I score 25,821 on the Trivia Leaderboard.

Attending AWSome day online conference 2019 7

On the “Ask an Expert” tab, I was mostly interested in Man on the Side Attack – MOTS attack. They referred me to the WAF section on AWS. Another interesting link is the whitepaper of the AWS Overview of Security guidelines. AWS also offers comprehensive security across all the layers, SSL, DDoS, Firewall, HSM and Networking. I also shoot some question on Metric and Monitoring on application level such as on MariaDB. I discovered about the RDS performance insight. For applications on EC2, Containers, and Lamda, X-Ray looks very promising. Apart from virtualization, its good to note that AWS also provides containerization services.

The event was pretty enriching. The panel on the question area knows well their subject. I discovered a lot by participating in the AWSomeDay. I’m looking forward to AWS certifications in the near future.

Phishing Attack – Free Travel tickets with Emirates Airline

Today itself, a friend sent me a message about free travel ticket with Emirates airline through WhatsApp. On seeing the URL, I immediately doubt about the authenticity of such kind of strategy spammers are using to make money as well as to harvest data about you. Once you fill in the form, it will prompt you to share the information to 30 people on WhatsApp to get your ticket. Common, this does not make sense at all and I believe that the website should be reported and Emirates Airline to make an official announcement on its website about these scammers.


Phishing Attack - Free Travel tickets with Emirates Airline 8
Photo Credits: Emirates.com

The message sent to me was in French. Since I’m well conversant in French, I could easily read and interpreted it. The message received is as follows:


“Pour le 33° Anniversaire, la compagnie aérienne *Emirates Airline* donne à tout le monde *2 billets d´avion gratuits*. Récupérez votre billets d´avion immédiatement. http://bit.ly/Emirates-airline”

The translation looks like this in English:

“For the 33rd Birthday, the aviation airline “Emirates Airline” is giving a free *2 air travel tickets. Get your airline tickets immediately. http://bit.ly/Emirates-airline”

If you observed carefully the real URL has been shortened on bit.ly. There is nothing wrong when using bit.ly which is a great tool for URL shortener. However, if you try to access the URL, you will be redirected on http://5ack.com/Emirate/ which is well known for attacks.

Let’s see what does the whois tool said about 5ack.com:

1.According to domaintools.com, the IP Address behind is 107.180.59.131 

2. The IP Address 107.180.59.131 is well known for attacks and there is no real information as to who is behind this domain name.

3. Worst, the domain 5ack.com has a history of 55 counts of changed IP addresses.

Phishing Attack - Free Travel tickets with Emirates Airline 9
Extract from domaintools.com

4. On the following link https://chat.stackexchange.com/transcript/65945/2018/11/14/2 we can see someone has blacklisted the IP 107.180.59.131 who at that time was selling health supplement. Of course, it’s fake again.

Please don’t click on the link otherwise you might eat those baits and be a victim of Phishing attacks. I wonder how come those links ended in Mauritius which is probably due to French-speaking people here in Mauritius. Otherwise, several French-speaking countries in Africa is at risk. I wish someone from the security team of Emirates Airline read that blog and made an official announcement soon about those spammers hovering everywhere on the Internet. Let’s work together for a safe and secure Internet and keep on passing the message.

Operation KSK-ROLL by cyberstorm.mu – KSK Rollover Explained

The last cyberstorm.mu event was on OpenSource licensing with Dr. Till Jaeger at Flying Dodo, Bagatelle Mall Mauritius. We discussed several issues concerning cybersecurity laws, trademarks, OpenSource licensing issues etc.. Dr. Till Jaeger appreciated the meetup and encouraged us to evangelize more on OpenSource. The event was organized by Loganaden Velvindron member of cyberstorm.mu.

Dr. Till Jaeger and logan with a surprise gift.
Dr. Till Jaeger brought a surprise gift to Logan 🙂

I should say that we were already planning about our next event, hence, a hackathon on Operation KSK-ROLL by the cyberstorm.mu team which was pretty easy, important and successful. Dr. Till Jaeger congratulate us for creating the cyberstorm.mu team. Several pull requests sent to many repositories to encourage developers to adopt the new key.

Operation KSK-ROLL by cyberstorm.mu - KSK Rollover Explained 10

What is Operation KSK-ROLL?

At cyberstorm.mu all Non-IETF hackathons are usually given a name. This time for the KSK rollover hackathon we have chosen 'Operation KSK-Roll'. Operation KSK-ROLL has been started to make sure that software is up-to-date with the new KSK key.

What is the KSK rollover?

The DNS KSK Rollover happened on 11 October at 11:00 UTC. Rolling the KSK means generating a new key cryptographic key pair (public and private key).

What are those keys?

The public key is distributed to those who operate valid DNS resolvers such as ISPs, network administrators, system integrators etc.. whilst, the private key is kept secret.

If its secret, why do we need to generate another secret key?

For security purpose, the secret key is generated anew and this ensures that DNS resolvers have a more robust security layer on top of the DNS AKA: DNSSEC

What are DNS resolvers?

All websites, example tunnelix.com which is a domain name is behind an IP Address. For your browser to be able to resolve the website, a DNS resolver which is located at several parts of the world will identify the IP with the domain name. Consequently, this will render the website on your browser.

What is DNSSEC?

As mentioned previously, DNSSEC (DNS Security) is a layer added by ICANN to ensure by means of cryptographic keys to ensure an online protection from the provider of the root domain name to your browser.

How will you know if a website is DNSSEC signed?

There is a tool by VeriSign lab which provides DNSSEC Analyzer. You can enter the name of the domain, say tunnelix.com which will analyze the domain show you the public key and the chain from the . (dot),  com and tunnelix.com.

credits to: verisignlabs.com
credits to: verisignlabs.com

Is there another way to verify it?

Yes, you can use the nslookup or dig tool to check it. In the case of the dig tool here is a screenshot.

Operation KSK-ROLL by cyberstorm.mu - KSK Rollover Explained 11

What is the logic behind the DIG command?

Some years back (the Year 2015), I explained the anatomy of the dig command. You can view more details about the blog post called "Anatomy of a simple dig result".


What is the role of the KSK?

The KSK private key is used to generate a digital signature for the ZSK. In fact, the KSK public key is stored in the DNS to be used for authenticating the ZSK. So, the KSK is a key to sign another key for the ZSK. That is why it is called the "Key Signing Key".

So, what is the ZSK?

The ZSK (Zone Signing Key) is another private-public key pair which is used to generate a digital signature known as RRSIG ( Resource Record Signature). The RRSIG in itself is a digital signature for each RRSET (Resource Record Sets) in a zone. In fact, the ZSK is stored in the domain name system to authenticate the RRset.

What are RRsets?

RRsets (Resource Record sets) is a group of records DNS Record Set (RRsets) with the same record type, for example, all DNS A records are one RRset.

My contributions for KSK ROLL

Please follow me on my Github account. One of the repositories is Nagval which is a plugin to check the validity of one of more DNSSEC domains.

For more information about DNSSEC, ZSK, PSK etc, I would advise to check out Cloudflare which provided a good source of information.

Cyberstorm.mu continue to go beyond and further with innovations and more ideas to protect and secure the Internet. We believe that though we are a small team will be able to recruit more people who are strongly interested in developing their skills to strive for excellence.

I also wish to seize this opportunity to thanks Manuv Panchoo for designing the logo of  tunnelix.com


All rights reserved: tunnelix.com
All rights reserved: tunnelix.com

cyberstorm.mu meetup on OpenSource Licensing with Dr Till Jaeger

It was a great opportunity to meet with Dr. Till Jaeger, Attorney at Law on cybersecurity, laws, trademarks and opensource licensing on Tuesday the 02nd of October 2018 at Flying Dodo, Bagatelle Mall. The event was announced on the official cyberstorm.mu community Facebook group by Logan days back. Those present for the meetup was Loganaden Velvindron, Jagveer Loky, Rahul Golam, Kifah Meeran, Veegish Ramdani, Muzaffar Auhammud, Jeremie Daniel and myself from the cyberstorm.mu team.

Who is Dr. Till Jaeger? – Till Jaeger has been a partner at JBB Rechtsanwälte since 2001. He advises large and medium-sized IT businesses as well as government authorities and software developers on matters involving contracts, licensing and online use. Till Jaeger also covers conventional areas of copyright law and entertainment law, advising corporate clients on matters relating to open content, web design and photography. – Source: JBB.DE

Some pictures during the informal event:

 

OpenSource licensing with Dr. Till Jaeger and cyberstorm.mu

42935540_10212323570864049_8368692107799429120_n
42968234_10212323572504090_2567889336288673792_n
42950830_10212323576784197_4654246000414687232_n
43006824_10212323574624143_3826122953662136320_n
42972026_10212323735508165_2228714038051733504_n
42985512_10212323573544116_1829255669769830400_n
43021478_10212323736348186_8197301708435488768_n
43070514_249074402474539_4146444367671853056_n
43097410_10212323575984177_8134476138010378240_n
43119656_10212323575344161_97068219394686976_n
51e27cd0-87f1-402d-a02a-474cf81b9f39
Screen Shot 2018-10-07 at 6.59.57 PM
Screen Shot 2018-10-07 at 7.00.09 PM
Screen Shot 2018-10-07 at 6.59.25 PM
Screen Shot 2018-10-07 at 6.59.25 PM
Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image... Loading image...

I should admit that it was really an informal meeting over some beers, juice, Dame-Blanche, and Pizzas with Dr. Till Jaeger. It was very fruitful and amazing to the team. We received lots of advice for ourselves as well as for the cyberstorm.mu team. Some days back, the National Computer Board conducted a workshop on Opensource licensing which where Dr. Till Jaeger was the main resource person to deliver this workshop. Thanks to the National Computer Board for making this event a success. Cyberstorm.mu members were also invited to the event.

We have also welcomed Rahul Golam for joining cyberstorm.mu team and looking forward to work together. I seized this opportunity to announce that cyberstorm.mu is proud to announce it’s the official logo. Thanks to the hard work of the team.

Photo Credits: cyberstorm.mu
Photo Credits: cyberstorm.mu

Photo Credits: cyberstorm.mu
Photo Credits: cyberstorm.mu