1

I have a service that sends rulesets to a fleet of hosts. Each host in its turn is expected to apply its ruleset to its firewall (iptables) and then send an acknowledgement back to the service.

I wonder if there's a way to verify that the host is not 'lying' and that it applied the ruleset as is.

One way I could think of is to put a certificate on the host and let it send back an iptables log signed with the certificate but this is obviously not good enough as the host could fake the iptables log and sign it.

  • Why not do a connection test, where you attempt to connect from a remote client to the host on the ports that have purportedly been closed, and verify that the connections are unsuccessful? – mti2935 Nov 16 '15 at 16:49
  • An attacker on the host may apply the ruleset plus some extra access rules granting access to unauthorized hosts. – Ezra Nov 16 '15 at 16:53
  • Why not send a MD5 hash of the rules in a second transmission? Or, have the clients send back the resulting ruleset to the server? – schroeder Nov 17 '15 at 23:11
1

I agree with the previous answerers: one of the obvious steps is to do port scans and vulnerability scans from the external sides of the firewalls. Doing so isn't firing a silver bullet (as has been pointed out, an attacker of even modest skill could set an inbound-traffic rule that will only respond to connections from a bad guy's specified ips).

In addition to that an important approach is to do sampling and manual inspection. In other words, of the hosts/firewalls that you need to make sure are applying rules properly, select a subset (preferably in a random/pseudo-random manner), connect into them, and inspect the rule-sets. (And beyond that, if an attacker already owns the box to degree where he/she can conceal a malicious rule/bypass from direct inspection, you're already behind the eight-ball.)

Of course, sampling isn't a magic solution, just like vulnerability & configuration scans aren't magic solutions. The more boxes you check vs. the number that need to be applying the rules properly the more useful the method will be. But really it's a situation that requires multiple approaches to verify the proper firewall rules are actually in effect.

2

If the attacker has enough control of the host to manipulate your codes perception of the state of iptables then the host is compromised and you can't trust it at all! Iptables maybe patched to subtlety allow the attacker to bypass your rules but still respond telling everyone on the system that everything is fine. Iptables is useless at this point: putting a Bulletproof vest on top of a gunshot wound won't stop the bleeding!

The only real solution I can see is to use tripwire or an other host based intrusion detection system to monitor the host for changes that look malicious. Whatever you do though you cant be 100% your host isn't compromised. It's a matter of risk mitigation.

1

Naked black box scanning (scanning from the outside with no network defenses in between) with a tool like SAINT or Nessus will give you a reasonable idea if the firewall is correctly configured. It will test protocols and ports for any kind of connection or response using various techniques.

Nessus can also do authenticated scans which will check what the host says about itself, which can't be trusted, but can identify configuration errors.

Before doing network scans with such a tool may require consent from the network operator. Make sure to check that first to avoid issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.