Protect network services with firewalld and SELinux

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Services openen in firewalld en poorten labelen voor SELinux

Know firewalld and zones

firewalld manages the firewall rules of the kernel (nftables). Every network card belongs to a zone; the zone says which services are allowed in.

Zone	Meaning
`public`	The default: only selected services (SSH, cockpit, DHCPv6 client)
`internal`, `home`, `work`	More trust: more services open
`trusted`	Everything allowed
`drop`	Everything dropped without an answer
`block`	Everything refused with a "rejected" answer
`dmz`	For servers in a DMZ: only selected services

#systemctl status firewalld
$firewall-cmd --state
running
#firewall-cmd --get-default-zone
public
#firewall-cmd --get-active-zones
public
  interfaces: enp1s0
#firewall-cmd --list-all
public (default, active)
  target: default
  interfaces: enp1s0
  services: cockpit dhcpv6-client ssh
  ports:
  rich rules:

14.2

Open a service

A service is a name for one or more ports (http = 80/tcp). Add it permanently, then reload.

#firewall-cmd --get-services | tr ' ' '\n' | grep -E '^(http|https|nfs|mysql)$'
#firewall-cmd --info-service=https
#firewall-cmd --add-service=http --permanent
#firewall-cmd --add-service={https,nfs} --permanent
#firewall-cmd --reload
#firewall-cmd --list-services
cockpit dhcpv6-client http https nfs ssh
#firewall-cmd --remove-service=cockpit --permanent
#firewall-cmd --reload

Kind of change	Works now	Kept after reload / reboot
`firewall-cmd --add-…`	Yes	No (runtime only)
`firewall-cmd --add-… --permanent`	No (after `--reload`)	Yes
`firewall-cmd --runtime-to-permanent`	—	Saves the current runtime rules

Examentip

Always use --permanent and --reload. Then check with firewall-cmd --list-all.

14.3

Open a port

When there is no service name, open the port with its protocol.

#firewall-cmd --add-port=8443/tcp --permanent
#firewall-cmd --add-port=5000-5010/udp --permanent
#firewall-cmd --reload
#firewall-cmd --list-ports
8443/tcp 5000-5010/udp
#firewall-cmd --remove-port=8443/tcp --permanent

14.4

Use zones and sources

Traffic from certain source addresses can use another zone — for example, the admin network may reach more services than the rest.

#firewall-cmd --zone=internal --add-source=192.168.50.0/24 --permanent
#firewall-cmd --zone=internal --add-service=mysql --permanent
#firewall-cmd --zone=internal --change-interface=enp2s0 --permanent
#firewall-cmd --set-default-zone=dmz
#firewall-cmd --reload
#firewall-cmd --zone=internal --list-all

14.5

Write rich rules

A rich rule is a rule with more conditions: a service or port for one address, logging, or a reject.

#firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.122.20" service name="mysql" accept' --permanent
#firewall-cmd --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" reject' --permanent
#firewall-cmd --add-rich-rule='rule service name="ssh" log prefix="SSH: " level="info" limit value="5/m" accept' --permanent
#firewall-cmd --reload
#firewall-cmd --list-rich-rules

14.6

Allow a service on a non-standard port

SELinux allows each service only its labeled ports. Apache may use ports labeled http_port_t. To run it on port 82, add that label to port 82.

#semanage port -l | grep -w http_port_t
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
#vim /etc/httpd/conf/httpd.conf
#systemctl restart httpd
Job for httpd.service failed because the control process exited with error code.
#ausearch -m AVC -ts recent | grep name_bind
type=AVC msg=audit(...): avc:  denied  { name_bind } for  pid=3102 comm="httpd" src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket permissive=0
#semanage port -a -t http_port_t -p tcp 82
#systemctl restart httpd
#firewall-cmd --add-port=82/tcp --permanent
#firewall-cmd --reload
$curl -I http://server1:82/

Command	What it does
`semanage port -l`	List all port labels
`semanage port -a -t TYPE -p tcp PORT`	Add a label to a free port
`semanage port -m -t TYPE -p tcp PORT`	Change the label of a port that already has one
`semanage port -d -t TYPE -p tcp PORT`	Remove your label
`semanage port -l -C`	Only your own changes

Let op

Port 8080 already has the label http_cache_port_t. To use a labeled port for another type, use -m (modify), not -a.

Onthoud

Service on a new port = three steps: the service config, semanage port -a, firewall-cmd --add-port.

14.7

Test from outside

Test from another machine. A test from the server itself does not go through its own firewall.

#ss -tlpn | grep httpd
$curl -I http://server1/
$curl -I http://server1:82/
$nc -zv server1 82
Ncat: Connected to 192.168.122.10:82.

Error from the client	Most likely cause
`Connection refused`	Nothing listens on the port (service down, wrong port), or a firewall reject rule
`No route to host` / timeout	The firewall drops it, or the network is wrong
Works on the server, not from outside	Firewall, or the service listens only on `127.0.0.1`

More: the RHCSA firewalld chapter.