2

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet.

Let's assume if I have the same password for all web-pages, is it possible to set this up with iptables? if so, how?

I am a very new Linux user. Thank you for your help.:)

  • 1
    Bad idea. A script can try to send all possible combinations of your password to a server. The missing password is yours. – Johannes Kuhn Jan 3 '14 at 22:05
  • I think he means outbound IPtables... – Lucas Kauffman Jan 3 '14 at 22:08
  • this is a good idea, I'll try it. Thank you! iptables -A OUTPUT -s match --string "password" --dport 80 -p tcp -j DROP – Natasha Almazova Jan 3 '14 at 22:16
  • 1
    PLease try that and don't forget to post here what parameter value you actually use after -string (and for what web sites) ;) – Hagen von Eitzen Jan 3 '14 at 22:47
  • It might be obvious, but: do not use a common password for all sides and do not use unencrypted password transmits. – eckes Jan 4 '14 at 4:58
3

The rule you would want is following:

iptables -A OUTPUT -s match --string "password" --dport 80 -p tcp -j DROP

A breakdown is as follows, append to your output chain anything going to port 80 using TCP that has the string "password" gets dropped. This doesn't check for any sort of encrypted connection so if your password is sent plaintext outbound it'll drop the packet.

  • That's providing the application is running on port 80, if the app is running on port 8080 it will fail. – Lucas Kauffman Jan 3 '14 at 22:15
  • Very true and can be said for any port. Modify as needed. – Ajaxasaur Jan 3 '14 at 23:26
  • This may block other things, such as this web page because it contains the string "password". – u2702 Jan 3 '14 at 23:29
  • OP is meant to replace his password for the string "password". – Ajaxasaur Jan 3 '14 at 23:53
  • This does not reliable work depending on the encoding and fragmentation/chunking of the string transferred. But I guess it is (besides using filtering proxies which are better but not perfect in decoding different protocols) the correct answer to the question. – eckes Jan 4 '14 at 4:57
2

Though you are keen to use IPtables but I would recommend to use Web Application Firewall like open-source Modsecurity. Modsecurity will provide you far greater granularity as compared to that of IPtables which is a network layer firewall. I have further provided a brief example for Password protection rules and you can explore them further. There are tons of issues when you are try to solve Application layer problem at network layer.

<LocationMatch "^/exchweb/bin/auth/owaauth.dll$">
SecDefaultAction "log,deny,t:lowercase"
SecRule REQUEST_METHOD !POST
SecRule ARGS:destination " URL" "t:urlDecode"
SecRule ARGS:flags "[0-9]{1,2}"
SecRule ARGS:username "[0-9a-zA-Z].{256,}"
SecRule ARGS:password ".{256,}"
SecRule ARGS:SubmitCreds "!Log.On"
SecRule ARGS:trusted "!(0|4)"
</LocationMatch>  

There are further more problems with IPtables rules your Input may be using some of transformation like URL-encode, lowercase, hex-encode and simple string matching rule may not work.

1

I'd say it's likely that IPTables isn't the best way to approach this problem. The problem with using a network level firewall is that it lacks good insight into the context of what you're doing (e.g. it just sees HTML as a string of text with no idea of what's being done).

So the problem with things like matching a string is that you'll get lots of false positives (areas where a page mentions the string without it actually being a password submission form) and false negatives (login pages that don't explicitly have the string on them).

A better way to approach this might be to use a browser extension like HTTPS everywhere. With this you can explicitly configure it to redirect you to HTTPs versions of the site you're trying to log in to (assuming that the service has one of course)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.