The Firewall¶
ufw (Uncomplicated Firewall) is the front end for the Linux packet filter. Mint ships it installed and turned off, with the gufw graphical front end (the benchmark, CIS 4.1.1, expects gufw present on a workstation). Debian doesn't install it: sudo apt install ufw gufw. Turning it on with a default of deny-incoming closes every door except the ones you open on purpose.
Turn it on¶
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed
sudo ufw enable
sudo ufw status verbose
enable also makes it start at boot (CIS 4.1.2; on Debian also sudo systemctl unmask ufw && sudo systemctl enable --now ufw). Default deny incoming is 4.1.3; deny routed (4.1.4) means the machine won't forward packets between networks even if the kernel setting were turned on. The Debian benchmark's Level 2 item (Debian CIS 4.1.4) is ufw default deny outgoing, after which every outbound connection needs its own allow rule (ufw allow out 53, ufw allow out 80,443/tcp, and so on); a README that requires the machine to reach the internet for updates makes this more work than it's worth in a round. If you're connected over SSH, allow port 22 before enabling or you'll cut yourself off:
sudo ufw allow 22/tcp
Open what the README requires¶
Every service the README says the machine provides needs its port allowed. Nothing else does.
| Service | Rule |
|---|---|
| SSH | sudo ufw limit 22/tcp, which allows the port and rate-limits it (six connections per 30 seconds from one address, then blocked). The STIG asks for limit on every listening service (UBTU-22-251025). |
| Web | sudo ufw allow 80/tcp and sudo ufw allow 443/tcp |
| FTP | sudo ufw allow 21/tcp (and the passive range from vsftpd.conf, e.g. sudo ufw allow 40000:40100/tcp) |
| Samba | sudo ufw allow samba (opens 137, 138, 139, 445) |
| DNS | sudo ufw allow 53 |
sudo ufw allow 25/tcp |
|
| MySQL, PostgreSQL | Usually nothing; the database is reached from localhost. Only if the README names remote clients: sudo ufw allow from 10.0.0.0/24 to any port 3306 |
ufw app list shows named profiles installed by packages; ufw allow 'Apache Full' is the same as opening 80 and 443.
Close what it doesn't¶
sudo ufw status numbered
sudo ufw delete 3
A rule for a port the README doesn't mention was added by someone. Delete by number, or by repeating the rule: sudo ufw delete allow 4444/tcp.
Logging¶
sudo ufw logging on
Blocked packets go to /var/log/ufw.log (and the kernel log), which is where you find who's knocking.
Verify¶
sudo ufw status verbose
Status active, default deny (incoming), allow (outgoing), and a rule list that matches the README's services exactly. The rules are stored in /etc/ufw/user.rules and user6.rules; reading those files is another way to confirm nothing extra is there.
Example¶
sudo ufw status says inactive. README: web server and SSH. sudo ufw default deny incoming, sudo ufw allow 22/tcp, sudo ufw allow 80/tcp, sudo ufw allow 443/tcp, sudo ufw enable. status numbered then shows a fourth rule, allow 4444/tcp, that was already in user.rules before you enabled it. Delete it.
Try it¶
- Enable ufw with default deny, then try to SSH in from another VM. Allow 22 and try again.
- Add a rule for 4444, list it numbered, delete it by number.
Build it¶
A firewall.sh that sets the defaults and allows the ports listed in a ports.txt, then prints ufw status numbered.