5

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for hardening purposes.

How to disable conntrack protocol parsing in the linux kernel?

  • 1
    As long as none of your iptables uses a RELATED, it shouldn't parse the protocol. – Ángel Apr 25 '16 at 21:02
  • If you disable connection tracking helpers how are you going to handle protocols like FTP? – Daisetsu Apr 25 '16 at 21:07
  • @Daisetsu You can handle protocols like FTP even without the helpers, you just have to rely on port numbers to identify the protocol. – forest Oct 24 '18 at 3:58
  • @Ángel that only handles one of the two issues mentioned. Not using RELATED doesn't mitigate the second issue, "where the parser has a bug which is exploitable". – sourcejedi Dec 25 '18 at 18:50
1

You can disable the module.

modprobe nf_conntrack nf_conntrack_helper=0

More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/

  • This has to be done before it's loaded obviously – Daisetsu Apr 25 '16 at 21:13
  • This isn't really an answer, considering this would cause a one-time change. – forest Feb 1 '18 at 4:56
1

There are a few ways to set module parameters, both temporary and persistent. The previous answer provides only a temporary change which furthermore does not work if the module is already loaded.

Persistent changes

The change will take effect as soon as the module is loaded, whether it is done manually or automatically at boot. If the module is already loaded, you must either reboot, or load it and unload it, which may or may not be possible if it has unremovable dependencies. To do this, create a file, such as /etc/modprobe.d/no_conntrack_helper.conf, with the following contents:

options nf_conntrack nf_conntrack_helper=0

Temporary changes (modprobe)

This requires the module be unloaded before you run the command. The changes will disappear when the module is unloaded or when the system reboots. You can change specific parameters by passing them as arguments to the modprobe utility when loading the module. Load the module as root:

modprobe nf_conntrack nf_conntrack_helper=0

Temporary changes (sysfs)

Some modules can have their parameters modified even after the module has been loaded. This can be done by writing to a special file in sysfs. I do not know if the specific parameter you want to change can be modified at runtime, but if it can, you would want to run the following command as root:

echo 0 > /sys/module/nf_conntrack/parameters/nf_conntrack_helper

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.