Windows Batch Script to lockdown firewall and only allow a few websites with dynamic IP addresses (nslookup)

This script was pretty much an extension of my earlier work on locking down windows. The problem is that that script only really worked for locking down static IP addresses. If you had a dynamic IP address you would have to manually change the firewall rules.

This script will delete the old firewall rules, find the new IP address of a host and create a new rule using that IP address.

@ECHO OFF
netsh advfirewall set domainprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set privateprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set publicprofile firewallpolicy allowinbound,allowoutbound 

netsh advfirewall firewall delete rule name=all dir=out protocol=tcp remoteport=80,8080,8443,443 profile=any 

for /f "tokens=1*" %%k in ('nslookup example.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="example" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any 

for /f "tokens=1*" %%k in ('nslookup learning.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="learning" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any 

netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound

By saving this script somewhere secure you can create an event run by the inbuilt Windows Task Scheduler to run this script daily. This way you never have to worry about updating your firewalls when IP addresses change!

Securing Ubuntu 12.04

I have been extended my knowledge of Linux System Administration (in particular, securing Linux systems), and as such the first thing I did when I installed Ubuntu 12.04 LTS was to lock it down.

Installing Ubuntu is outside the scope of this blog post, so if you don't have Ubuntu yet I suggest you follow the official documentation.

Networking

We will first deal with locking down our machines network access. By restricting how our machine communicates with others we narrow down the attack vectors available.

1. The first thing we should do is turn on a firewall. Ubuntu comes with ufw pre-installed so we will just use that (I have covered this in a previous blog post).
   

   sudo ufw enable

   Check its status with:
   

   sudo ufw allow ssh

2. Enable any services you will need. For instance a web server will need the HTTP port of 80 open.
   

   sudo ufw allow ssh
   
   # You can specify a port directly
   sudo ufw allow 80
   # You can also specify whether it is TCP or UDP
   sudo ufw allow 80/tcp
   # Finally, you can specify whether it is incoming or outgoing
   sudo ufw allow in 80
   sudo reject out 1337

3. Sysctl allows you to configure the Linux kernel during runtime. We will edit the file /etc/sysctl to harden our network interface; open the file in your favorite editor and make the following changes:

   #IP spoofing/forging protection by turning on the reverse path filter
   net.ipv4.conf.all.rp_filter=1
   net.ipv4.conf.default.rp_filter=1
   
   # Protect against ICMP attacks
   net.ipv4.icmp_echo_ignore_broadcasts=1
   net.ipv4.icmp_ignore_bogus_error_responses=1
   
   # Turn off IPv4 features that are easy to abuse
   net.ipv4.conf.all.accept_source_route=0
   net.ipv6.conf.all.accept_source_route=0
   net.ipv4.conf.default.accept_source_route=0
   net.ipv6.conf.default.accept_source_route=0
   net.ipv4.conf.all.send_redirects=0
   net.ipv4.conf.default.send_redirects=0
   net.ipv4.conf.all.accept_redirects=0
   net.ipv6.conf.all.accept_redirects=0
   net.ipv4.conf.all.secure_redirects=0
   
   # Block SYN attacks
   net.ipv4.tcp_syncookies=1
   net.ipv4.tcp_max_syn_backlog=2048
   net.ipv4.tcp_synack_retries=2
   net.ipv4.tcp_syn_retries=2
   
   # Log Martians
   net.ipv4.conf.all.log_martians=1
   
   # Ignore directed ICMP pings
   net.ipv4.icmp_echo_ignore_all=1
   
   # Don't perform IP forwarding
   net.ipv4.ip_forward=0
   
   #####
   # IPv6
   #####
   
   # Number of router solicitations to send until assume no routers present
   net.ipv6.conf.default.router_solicitations=0
   
   # Do not accept router preferences
   net.ipv6.conf.default.accept_ra_rtr_pref=0
   
   # Do not accept prefix info from router
   net.ipv6.conf.default.accept_ra_pinfo=0
   
   # Do not accept Hop limit settings from router
   net.ipv6.conf.default.accept_ra_defrtr=0

   
   
4. Reload sysctl with your changes:
   

   sudo sysctl -p

5. Secure your TCP Wrapper by editing the /etc/hosts.deny file, ensuring the following line is the only one uncommented:
   

   ALL: ALL

6. Allow your TCP Wrapper services (like SSH) by editing the /etc/hosts.allow file. The basic syntax is:
   

   <service>: <host/network>

7. Prevent IP Spoofing via DNS by editing the file /etc/host.conf and adding the following lines:
   

   order bind,hosts
   nospoof on

8. If you have not already done so, update your system so that there are no security vulnerabilities:
   

   sudo apt-get update
   sudo apt-get upgrade

9. Install nmap, a tool for network discovery and security auditing:
   

   sudo apt-get install nmap

10. Perform a local nmap TCP scan of your machine and ensure that all ports that are open are supposed to be open.
    

    sudo nmap -v -sT localhost

    Perform a SYN scan, which is another way a hacker can probe your system:
    

    sudo nmap -v -sS localhost

    Perform a UDP scan to determine which UDP services are operational:
    

    sudo nmap -v -sU localhost

11. Perform the same NMap tests but on another host. If you followed the above instructions you may want to add -PN to the command so that nmap ignores the fact that your machine does not respond to pings. Note that this scan may take some time...

 

Filesystem

We will now protect our file-system.  

Note: you will get the best security by putting your system directories into their own partition. This will allow you to specify the mount options for each directory. This guide will only cover the default install.

1. Protect your shared memory by editing /etc/fstab as follows:
   

   tmpfs  /dev/shm  tmpfs  defaults,noexec,nosuid  0  0

2. Bind /var/tmp to /tmp so that we limited what applications can do with that system directory. Edit /etc/fstab as follows:
   

   /tmp  /var/tmp  none  rw,noexec,nosuid,nodev,bind  0  0

 

Startup Applications

We will now modify the start-up applications and services that turn on during boot.

1. Display the hidden start-up applications:
   

   sudo sed -i 's/NoDisplay=true/NoDisplay=false/g' /etc/xdg/autostart/*.desktop

2. Press the windows key on your keyboard, type in 'Startup Applications' and launch the program of the same name
3. Disable the following services (Note: These may change depending on your personal situation):
• Backup monitor
• Bluetooth manager
• Chat
• Desktop Sharing
• Gwibber
• Orca Screen Reader
• Personal File Sharing
• Ubuntu One

 

Disable Guest Login

Just edit /etc/lightdm/lightdm.conf and add the following line:

allow-guest=false

 

References:

• 'How to secure Ubuntu 12.04 LTS server' by thefanclub.co.za
• 'Securing a Linux VPS' from wolfpaw.co.uk
• NSA guide to securing RHEL 5
• NSA hardening tips for RHEL 5
• NSA guides to securing other operating systems
• 'Tuning the Linux kernel', a paper by Long Yi and James Connan
• 'Linux Kernel /etc/sysctl.conf Security Hardening' from www.cyberciti.biz
• 'Security auditing with NMAP' by www.techrepublic.com 
• Nmap reference for scanning techniques
• 'Securing an Ubuntu Server' by www.andrewault.net
• Ubuntu 12.04 LTS security by rationally paranoid
• Modify Ubuntu blog

UFW: Uncomplicated Fire Wall

Back when I used Red Hat Linux and Fedora I had to use the iptables tool to create a secure box over the Internet. It's been a few years since, and now I gladly find that the CLI has a new simplified firewall tool: ufw. This tool takes away the onerous task of creating the long chain rules required for iptables and compresses them into easy to decipher statements.

Here is a little script I used for my machine to lock away the whole internet except for the companies web-application:


#!/bin/bash
#
# Accept all outgoing packets from this machine by default
sudo ufw default allow outgoing
#
# Deny all incoming packets to this machine by default
sudo ufw default deny incoming
#
# Only accept outgoing connections to port 80 (www) to the following IP addresses
sudo ufw allow out to 1.2.3.4 port 80
sudo ufw allow out to 10.0.0.1 port 80
#
# Other reject all other connections to port 80
sudo ufw reject out 80
#
# Turns on the firewall and adds it to the boot-up script
sudo ufw enable

Configure Windows via a batch script

While I primarily use *nix based systems at home and work, I am sometimes called upon to administer Windows boxes. I have finally decided to do some basic research to figure out how to automate these tasks; behold, my Windows configuration batch script!!!

Note: This script must be executed with Administrator privileges.

@ECHO OFF
net user Guard /add
sc config "CertPropSvc" start= disabled
sc config "Browser" " start= disabled
sc config "UxSms" start= disabled
sc config "DPS" start= disabled
sc config "TrkWks" start= disabled
sc config "IKEEXT" start= disabled
sc config "PcaSvc" start= disabled
sc config "EMDMgmt" start= disabled
sc config "RasAuto" start= disabled
sc config "RasMan" start= disabled
sc config "RemoteRegistry" start= disabled
sc config "SCardSvr" start= disabled
sc config "SCPolicySvc" start= disabled
sc config "LanmanServer" start= disabled
sc config "TabletInputService" start= disabled
sc config "TermService" start= disabled
sc config "WebClient" start= disabled
sc config "idsvc" start= disabled
sc config "wcncsvc" start= disabled
sc config "WMPNetworkSvc" start= disabled
sc config "WinRM" start= disabled
sc config "WinHttpAutoProxySvc" start= disabled
sc config "AppMgmt" start= disabled
sc config "WdiServiceHost" start= disabled
sc config "WdiSystemHost" start= disabled
netsh advfirewall firewall add rule name="Rule1" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=10.0.0.60 profile=any
netsh advfirewall firewall add rule name="MAIL" dir=out action=allow protocol=tcp remoteport=110,143,993,995,25,587,465 remoteip=any profile=any
netsh advfirewall firewall add rule name="LOCAL" dir=out action=allow protocol=tcp remoteport=any remoteip=localsubnet profile=any
netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
netsh advfirewall set publicprofile state on

A quick rundown of what this code actually does:

• The program sc is a program that interacts with windows services. I use the config keyword to disable some services from starting.
• The netsh program does multiple things, one of which is to configure the windows firewall. In this script I add a couple of rules and apply them to the domain.
• The second line of the batch script creates a new user.

References:

• Windows Knowledge Base article about how to use 'netsh advfirewall' instead of 'netsh firewall'
• Grand Stream Dreams blog post about how to interact with windows firewall via batch scripts
• Stack overflow Q&A about creating users from the command line
• Paradineshift article about how to disable services via a batch script