Changeset 686

Show
Ignore:
Timestamp:
06/03/07 22:13:34 (1 year ago)
Author:
mbr
Message:

minor Netfilter -> iptables wording update

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • fwknop/trunk/CREDITS

    r651 r686  
    6868      measure for the fwknopd daemon to validate incoming SPA packets (this 
    6969      will probably be enabled by default). 
    70     - Suggested a new method of interacting with Netfilter to redirect 
     70    - Suggested a new method of interacting with iptables to redirect 
    7171      connections to one port to another port on the same system. 
    7272    - Suggested making the --Spoof-user argument useable by non-root users. 

  • fwknop/trunk/ChangeLog

    r684 r686  
    186186    - Removed legacy port knocking installation in install.pl (fwknopfifo, 
    187187      and fwdata file) unless the data collection mode is set to syslog or 
    188       syslog-ng for legacy Netfilter log messages. 
     188      syslog-ng for legacy iptables log messages. 
    189189    - Added inode checking for PCAP_PKT_FILE. This helps to ensure that log 
    190190      rotation schemes don't interfere with reading packets out of the file 
    …… 
    210210    - Updated fwknop to communicate with knoptm via a UNIX domain socket 
    211211      instead of the previous file-based communication. 
    212     - Updated to flush the fwknop Netfilter chains at start time. 
     212    - Updated to flush the fwknop iptables chains at start time. 
    213213    - Bugfix for removing the wrong hash key in the knoptm IP cache. 
    214214 
    …… 
    259259      be replayed against an fwknop server. 
    260260    - Updated to fall back to getpwuid() if getlogin() fails (Blair Zajac). 
    261     - Added --ipt-list to list all current rules in the FWKNOP Netfilter 
     261    - Added --ipt-list to list all current rules in the FWKNOP iptables 
    262262      chains. 
    263     - Added --ipt-flush to flush all current rules in the FWKNOP Netfilter 
     263    - Added --ipt-flush to flush all current rules in the FWKNOP iptables 
    264264      chains. 
    265265    - Bugfix for the installer dying if ~/lib already exists (Blair Zajac). 

  • fwknop/trunk/README

    r292 r686  
    44fwknop implements an authorization scheme that requires only a single 
    55encrypted packet to communicate various pieces of information including 
    6 desired access through a Netfilter policy and/or specific commands to execute 
     6desired access through an iptables policy and/or specific commands to execute 
    77on the target system.  The main application of this program is to protect 
    88services such as SSH with an additional layer of security in order to make the 
    …… 
    1111via libcap and hence there is no "server" to which to connect in the 
    1212traditional sense.  Any service protected by fwknop is inaccessible (by using 
    13 Netfilter to intercept packets within the Linux kernel) before authenticating; 
     13iptables to intercept packets within the Linux kernel) before authenticating; 
    1414anyone scanning for the service will not be able to detect that it is even 
    1515listening.  This authorization scheme offers many advantages over port 
    …… 
    2727 
    2828In addition, fwknop maintains an implementation of a port knocking scheme 
    29 based around Netfilter log messages.  Supported knock sequences include both 
     29based around iptables log messages.  Supported knock sequences include both 
    3030encrypted and shared sequences which can be augmented with both relative and 
    3131absolute timeouts, multi-protocol usage (tcp, udp, and icmp), and passive OS 

  • fwknop/trunk/TODO

    r581 r686  
    88 - Solve the key management issue by interfacing with various existing 
    99   authentication systems (LDAP, Radius, Unix crypt(), etc.). 
    10  - Update IPTables::ChainMgr to be able to manage a Netfilter ruleset on a 
     10 - Update IPTables::ChainMgr to be able to manage an iptables ruleset on a 
    1111   remote system. 
    1212 - Client derived access timeouts. 
    …… 
    3535 - Scp patch. 
    3636 - Privledge separation to reduce code that executes as root. 
    37  - ssh-agent and gpg-agent integration. 
     37 - ssh-agent integration. 
    3838 - Destination IP address restriction restrictions in access.conf. 
    3939 - Web SPA proxy. 

  • fwknop/trunk/access.conf

    r677 r686  
    2222# 1) Define parameters for accepting single-packet authorization messages 
    2323#    from any source IP address via libpcap.  Fwknop will reconfigure the 
    24 #    local Netfilter policy to allow access to SSHD (TCP port 22) for 30 
     24#    local iptables policy to allow access to SSHD (TCP port 22) for 30 
    2525#    seconds from the IP also specified in the packet.  This example probably 
    2626#    represents the best configuration for most needs: 

  • fwknop/trunk/fwknop.8

    r680 r686  
    1414that requires only a single encrypted 
    1515packet to communicate various pieces of information including desired access 
    16 through a Netfilter policy and/or specific commands to execute on the target 
     16through an iptables policy and/or specific commands to execute on the target 
    1717system.  The main application of this program is to protect services such as 
    1818.B SSH 
    …… 
    2323and hence there is no "server" to which to connect in the traditional sense. 
    2424Any service protected by fwknop 
    25 is inaccessible (by using Netfilter to intercept packets within the Linux 
     25is inaccessible (by using iptables to intercept packets within the Linux 
    2626kernel) before authenticating; anyone scanning for the service will not be 
    2727able to detect that it is even listening.  This authorization scheme offers 
    …… 
    3535collection method in Single Packet Authorization mode is to use libpcap to sniff 
    3636packets off the wire, fwknop can also read packets out of a file that is written 
    37 by the Netfilter 
     37by the iptables 
    3838. B ulogd 
    3939pcap writer (or a separate sniffer process that is writing to a file). 
    …… 
    7777A note about the interaction between 
    7878.B fwknop 
    79 and Netfilter; fwknop maintains a strict separation between dynamically 
    80 generated rules and any existing Netfilter policy by adding all rules 
     79and iptables; fwknop maintains a strict separation between dynamically 
     80generated rules and any existing iptables policy by adding all rules 
    8181to a custom chain "FWKNOP_INPUT".  Packets are jumped to this chain from 
    8282the INPUT chain.  Interaction with the FORWARD chain can be accomplished 
    …… 
    8888them with passive OS fingerprinting, but this mode is not enabled by 
    8989default.  This scheme is based around log 
    90 messages generated by the Netfilter firewall in the Linux kernel. 
     90messages generated by the iptables firewall in the Linux kernel. 
    9191.B fwknop 
    9292supports both shared and encrypted port knock sequences, passive OS fingerprinting, 
    …… 
    453453.B fwknop 
    454454requires perl.  To take advantage of all of the features in fwknop when run 
    455 in server mode a functioning Netfilter firewall is required on the underlying 
     455in server mode a functioning iptables firewall is required on the underlying 
    456456operating system.  If fwknop is being run in the legacy port knocking mode, 
    457 then Netfilter must log packets via syslog, and ideally the --log-tcp-options 
     457then iptables must log packets via syslog, and ideally the --log-tcp-options 
    458458argument will be specified in the iptables logging rule so that fwknop will 
    459459be able to use a strategy similar to 

  • fwknop/trunk/fwknop.conf

    r654 r686  
    136136 
    137137### Fwknop uses the IPTables::ChainMgr module to add allow rules to a 
    138 ### custom Netfilter chain "FWKNOP_INPUT".  This chain is called from 
    139 ### the INPUT chain, and by default no other Netfilter chains are used. 
     138### custom iptables chain "FWKNOP_INPUT".  This chain is called from 
     139### the INPUT chain, and by default no other iptables chains are used. 
    140140### However, additional chains can be added (say, if access needs to 
    141141### be allowed through the local system via the FORWARD chain) by 
    …… 
    148148### variable is: <Target>,<Direction>,<Table>,<From_chain>,<Jump_rule_position>, \ 
    149149###              <To_chain>,<Rule_position>. 
    150 ### "Target": Can be any legitimate Netfilter target, but should usually 
     150### "Target": Can be any legitimate iptables target, but should usually 
    151151###           just be "DROP". 
    152152### "Direction": Can be "src", "dst", or "both", which correspond to the 
    153153###              INPUT, OUTPUT, and FORWARD chains. 
    154 ### "Table": Can be any Netfilter table, but the default is "filter". 
     154### "Table": Can be any iptables table, but the default is "filter". 
    155155### "From_chain": Is the chain from which packets will be jumped. 
    156156### "Jump_rule_position": Defines the position within the From_chain where 

  • fwknop/trunk/install.pl

    r668 r686  
    13261326"    generated by a sniffer (or through the Netfilter ulogd pcap writer), or\n", 
    13271327"    by sniffing packets directly off the wire via the Net::Pcap perl module.\n", 
    1328 "    Fwknop can also acquire packet data from Netfilter syslog messages, but\n", 
     1328"    Fwknop can also acquire packet data from iptables syslog messages, but\n", 
    13291329"    this is only supported for the legacy port knocking mode; Single Packet\n", 
    13301330"    Authorization (SPA), which is used in the pcap modes, is a better\n", 
    13311331"    authorization strategy from every perspective (see the fwknop man page for\n", 
    1332 "    more information). If you intend to use Netfilter log messages (only makes\n", 
     1332"    more information). If you intend to use iptables log messages (only makes\n", 
    13331333"    sense for the legacy port knocking mode), then fwknop will need to\n", 
    13341334"    reconfigure your syslog daemon to write kern.info messages to the\n",