0

I have a set of INPUT chain rules restricting traffic based on source ip and destination ports.The services are ftp and a job service.The server has a public ip address.

The default policy of the INPUT chain is deny. The default policy of the FORWARD chain is deny.

The only service accessible from any ip address is the ssh service(updated software).

There is only one user on the system, that is the admin user.

My question is, is there any utility in putting OUPUT chain rules on this machine. And have any one of you come across attack cases where the attacker is able to initiate network connections from the machine without getting root access ? (if the attacker gets root access, then he can simply knock off the iptable rules)

2

It is a good idea to have secure egress rules for your server. This can protect against an attacker gaining a reverse shell.

Remote shellcode is used when an attacker wants to target a vulnerable process running on another machine on a local network or intranet. If successfully executed, the shellcode can provide the attacker access to the target machine across the network. Remote shellcodes normally use standard TCP/IP socket connections to allow the attacker access to the shell on the target machine. Such shellcode can be categorised based on how this connection is set up: if the shellcode can establish this connection, it is called a "reverse shell" or a connect-back shellcode because the shellcode connects back to the attacker's machine

If there are any vulnerabilities on your server and you have secured the ingress rules to prevent the attacker running another service and then connecting to it, it is a good idea to prevent the attacker from connecting to other hosts from any sort of access gained from your machine. This will reduce the risk if you are running things with the rule of least privilege. That is, they may not have root but they could then do other things such as downloading tools and/or exploits from their own machine over the network or internet with a view to privilege escalation. Locking down outgoing connections can significantly reduce this risk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.