| About InfoWorld : Advertise : Subscribe : Contact Us : Awards : Events : Store |
 |
||||
|
||||
 |
||||
 |
|
|||
 |
||||
|
|
|
||
|
|||||||||||||||||||||||||||||||||||||||||
 COLUMN
Linux firewalls WHEN LOOKING for an effective, inexpensive firewall solution, Linux firewalls do not often enter into the picture unless someone involved in the security planning process is a Linux guru. With the ability to easily run on that old system in the corner -- the one that cant even load the latest version of Windows (mine runs on a Pentium 133) -- Linux firewalls can provide many of the basic features and functionality of their commercial counterparts, such as NAT (network address translation) and stateful packet filtering, at a fraction of the cost.
Current Linux firewalls (2.4 kernel) run netfilter/iptables. Netfilter provides the kernel hooks that allow the firewall to inspect network traffic; iptables provides the table structure to define rule sets that govern traffic flow. Many Linux distributions include netfilter/iptables support by default; find more at http://www.netfilter.org. The hardest part about using Linux firewalls is properly configuring them. The first step is to ensure that the system acting as the firewall is as secure and hardened as possible. During initial installation, install only the minimum required packages to provide basic system functionality, IP forwarding, and iptables support. Your mantra is: "If the firewall does not need it, do not install it." For some distributions, this may mean removing additional packages after installation, even when selecting the most basic installation. For example, with Red Hat systems there are several programs you can only remove after installation (such as sendmail) if they are not needed. Linux hardening scripts can also help you through this process -- the best tool I have found is Bastille Linux, available at http://www.bastille-linux.org. Once the system is properly configured, it is time to create the iptables firewall script that will add the proper rule set to apply to inbound and outbound packets. A great resource is New Riders' Linux Firewalls (Second Edition) by Bob Ziegler. Firewall Builder, included in Mandrake and Debian distributions or available at http://fwbuilder.sourceforge.net, is a graphical front end that can ease this process. For newbies, Red Hat provides Lokkit, a basic GUI configuration tool ideal for beginners and networks that only require a very simple firewall configuration. Deciding how to access the firewall system is an important step that is often overlooked. In the systems I build, I only allow access through SSH using key authentication. Many documents on the Internet can help: http://www.linuxnewbie.org/nhf/intel/security/iptables_basics.html and http://www.iptables.org and are excellent introductions, as are the how-to guides at the aforementioned netfilter site. Linux firewalls can be a robust, cost-effective solution for almost any organization, as long as the system is properly configured. Send e-mail to mandy_andress@infoworld.com.  RELATED SUBJECTS  SecurityMORE > SPONSORED WHITE PAPERS 
SPONSORED LINKS
|
|||||||||||||||||||||||||||||||||||||||||
|
||||||||||
|
||||||||||
