WebOS Internals - User contributions [en]

Research iptables configuration recommendations

2010-08-28T20:03:32Z

Khawk13: /* Introduction */

==Introduction==

For a much slimmer foot print out there, I'd recommend the following modifications (still testing). There have been a number of changes to the way processes are listening and how they are limited across the various versions of WebOS. The latest is closed down somewhat tighter than the initial releases. However, it you're like me, and believe that your phone shouldn't be offering up any services at all to the Internet, the below modifications to the stock iptables config will help make a much less accessible phone.

It should be noted that this config works with MyTether, but I can't guarantee that it will work with all other configs (like OpenSSH or Dropbear SSH), so some minor tweaking may be in order to get those services to work.

==/etc/pmnetconfig/iptables-common.config==
<pre># Generated by iptables-save v1.4.2 on Mon Jun 29 14:11:31 2009
*nat
:PREROUTING ACCEPT [2:696]
:POSTROUTING ACCEPT [44:2752]
:OUTPUT ACCEPT [44:2752]
COMMIT
# Completed on Mon Jun 29 14:11:31 2009
# Generated by iptables-save v1.4.2 on Mon Jun 29 14:11:31 2009
*mangle
:PREROUTING ACCEPT [922:161037]
:INPUT ACCEPT [920:160341]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [964:158847]
:POSTROUTING ACCEPT [964:158847]
COMMIT
# Completed on Mon Jun 29 14:11:31 2009
# Generated by iptables-save v1.4.2 on Mon Jun 29 14:11:31 2009
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [964:158847]
:ALLOWED_PACKETS - [0:0]
:ICMPFLOOD - [0:0]
:INVALID_PACKETS - [0:0]
-A FORWARD -m state --state INVALID -j INVALID_PACKETS
-A INPUT -i lo -j ALLOWED_PACKETS
-A INPUT -s 127.0.0.0/8 -i ! lo -j INVALID_PACKETS
-A INPUT -p tcp -m tcp --dport 113 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A INPUT -i bridge0 -p tcp -m tcp --dport 4444:4445 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ALLOWED_PACKETS
-A INPUT -i bridge0 -j ALLOWED_PACKETS
-A INPUT -i usb0 -j ALLOWED_PACKETS
-A INPUT -m limit --limit 3/sec -j LOG --log-prefix "IPT_PACKET_DROPPED_NO_MATCH: " --log-level 7
-A INPUT -j QUEUE
-A ALLOWED_PACKETS -j ACCEPT
-A ICMPFLOOD -m recent --set --name ICMP --rsource
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --rttl --name ICMP --rsource -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "IPT_ICMPFLOOD: "
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --rttl --name ICMP --rsource -j DROP
-A ICMPFLOOD -j ALLOWED_PACKETS
-A INVALID_PACKETS -m limit --limit 1/sec --limit-burst 100 -j LOG --log-prefix "IPT_INVALID_PACKETS_DROPPED: "
-A INVALID_PACKETS -j DROP
COMMIT
# Completed on Mon Jun 29 14:11:31 2009</pre>
==/etc/pmnetconfig/iptables-default.config==
<pre>
iptables -I INPUT 24 -m limit --limit 3/sec -j LOG --log-prefix "IPT_PACKET_DROPPED_NO_MATCH: " --log-level 7
</pre>
==/etc/pmnetconfig/iptables-usbnetmode.config==
<pre>
#This file left blank.
</pre>

Research iptables configuration recommendations

2010-08-28T20:01:45Z

Khawk13: New page: ==Introduction== For a much slimmer foot print out there, I'd recommend the following modifications (still testing). There have been a number of changes to the way processes are listening...

==Introduction==

For a much slimmer foot print out there, I'd recommend the following modifications (still testing). There have been a number of changes to the way processes are listening and how they are limited across the various versions of WebOS. The latest is closed down somewhat tighter than the initial releases. However, it you're like me, and believe that your phone shouldn't be offering up any services at all to the Internet, the below modifications to the stock iptables config will help make a much less accessible phone.

==/etc/pmnetconfig/iptables-common.config==
<pre># Generated by iptables-save v1.4.2 on Mon Jun 29 14:11:31 2009
*nat
:PREROUTING ACCEPT [2:696]
:POSTROUTING ACCEPT [44:2752]
:OUTPUT ACCEPT [44:2752]
COMMIT
# Completed on Mon Jun 29 14:11:31 2009
# Generated by iptables-save v1.4.2 on Mon Jun 29 14:11:31 2009
*mangle
:PREROUTING ACCEPT [922:161037]
:INPUT ACCEPT [920:160341]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [964:158847]
:POSTROUTING ACCEPT [964:158847]
COMMIT
# Completed on Mon Jun 29 14:11:31 2009
# Generated by iptables-save v1.4.2 on Mon Jun 29 14:11:31 2009
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [964:158847]
:ALLOWED_PACKETS - [0:0]
:ICMPFLOOD - [0:0]
:INVALID_PACKETS - [0:0]
-A FORWARD -m state --state INVALID -j INVALID_PACKETS
-A INPUT -i lo -j ALLOWED_PACKETS
-A INPUT -s 127.0.0.0/8 -i ! lo -j INVALID_PACKETS
-A INPUT -p tcp -m tcp --dport 113 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A INPUT -i bridge0 -p tcp -m tcp --dport 4444:4445 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ALLOWED_PACKETS
-A INPUT -i bridge0 -j ALLOWED_PACKETS
-A INPUT -i usb0 -j ALLOWED_PACKETS
-A INPUT -m limit --limit 3/sec -j LOG --log-prefix "IPT_PACKET_DROPPED_NO_MATCH: " --log-level 7
-A INPUT -j QUEUE
-A ALLOWED_PACKETS -j ACCEPT
-A ICMPFLOOD -m recent --set --name ICMP --rsource
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --rttl --name ICMP --rsource -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "IPT_ICMPFLOOD: "
-A ICMPFLOOD -m recent --update --seconds 1 --hitcount 6 --rttl --name ICMP --rsource -j DROP
-A ICMPFLOOD -j ALLOWED_PACKETS
-A INVALID_PACKETS -m limit --limit 1/sec --limit-burst 100 -j LOG --log-prefix "IPT_INVALID_PACKETS_DROPPED: "
-A INVALID_PACKETS -j DROP
COMMIT
# Completed on Mon Jun 29 14:11:31 2009</pre>
==/etc/pmnetconfig/iptables-default.config==
<pre>
iptables -I INPUT 24 -m limit --limit 3/sec -j LOG --log-prefix "IPT_PACKET_DROPPED_NO_MATCH: " --log-level 7
</pre>
==/etc/pmnetconfig/iptables-usbnetmode.config==
<pre>
#This file left blank.
</pre>

Research Securing Pre

2010-08-28T18:58:31Z

Khawk13: /* Networking Configurations */

==Intro==
A rooted box with broadband capabilities running a web engine and [http://www.palm.com/us/company/privacy.html|Palm's Privacy Policy] clipped to your belt? Anyone else nervous about this?

So here we'll explore some of the general best practices that sysadmins using Linux normally employ when securing their systems and how such practices can be used on the Palm Pre to provide a higher level of privacy and security on your device.

==System Logging mechanisms==
* [[Research_RDXD| RDXD Logging facility]]
* [[Research_Uploadd_| Uploadd facility]]
* [[Research_PmLog_| PmLog (syslog alternative)]]
* [[Research_Secure_Logging_Recommendations|Alternative Logging configuration for security and privacy]]

==Networking Configurations==
Protocols listening for any inbound connection
* [[Research_tcp_14400|TCP Port 14400]]
* [[Research_tcp_53|TCP Port 53]]
* [[Research_tcp_16888|TCP Port 16888]]
* [[Research_tcp_16889|TCP Port 16889]]
* [[Research_tcp_4444|TCP Port 4444]]
* [[Research_tcp_4445|TCP Port 4445]]

The Palm Pre does have iptables installed, so lets look at the [[Research_iptables_configuration_1.4.5|Current Iptables configuration]] with that in mind, lets look at an [[Research_iptables_configuration_recommendations|alternative Iptables configuration for security and privacy]].