8

We have a strong perimeter firewall. Would it make sense to still use IPTables on each host to hard block any and all ports except for the ones that are needed (DNS, 80 for the web server, nagios ports, etc.), or would this just lead to inefficiency. The web server gets millions of hits per day.

  • 2
    Yes you should - it's called defence in depth. – user10211 Oct 16 '12 at 13:57
  • Do you know of a good overall checklist of things such as this (disable unnecessary services, disable ports, etc) just so I can systematically check things off and make sure I'm not missing any? – user974896 Oct 16 '12 at 14:15
  • 1
    I like the CIS benchmarks at benchmarks.cisecurity.org . They address various operating systems and some common services (Apache etc.). – hwilbanks Oct 16 '12 at 15:29
14

Yes, it is a good idea to lock down all of the hosts inside the firewall as well to protect against any threats coming from your internal network. That way, if someone gains access to your network or if there is a virus/worm/etc attacking your local machines, there are that many fewer services that could potentially be compromised.

Someone else will need to speak to the inefficiencies in this particular case, although my suspicion is that they would be negligible.

|improve this answer|||||
  • Thanks. As I mentioned in my previous comment do you know of a good "best practices" security checklist. I know a lot of them are common sense but would like a systematic way of auditing each host that is backed by industry standards. – user974896 Oct 16 '12 at 14:42
  • One option it to use a tool such as nessus to automatically scan your hosts for vulnerabilities. – Justin Ethier Oct 16 '12 at 14:57
  • That's part of the plan :), I'm actually playing with it right now. I noticed that there weren't many local configuration checks although nessus does have the ability. For example I do not see a plugin that does not check php.ini to check for things like disabled functions. – user974896 Oct 16 '12 at 15:08
6

Definitely do this. I've made it a habit to deploy services using Puppet, so the allow service rules are written into the same definition file that installs the service. The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.