Newsgroup: it.comp.sicurezza.varie
Titolo: [lungo] iiptables e sygate personal firewall vs. nmap

Salve a tutto il NG,
vi scrivo per sottoporVi un problema di firewall che ho riscontrato
sulla mia macchina casalinga dual boot.
Avviando il sistema da Windows XP SP1 (tutti gli hotfix installati),
parte in automatico Sygate
Personal Firewall (versione 5.5 build 2525). Uso la configurazione
base
del firewall, non ho modificato nulla.
A questo punto stabilisco la connessione usando il modem come bridge,
in
modo che il modem non si preoccupi di filtrare alcuna porta.
Provo quindi a fare un portscan della macchina Windows da una macchina
che sta su Internet (e _NON_ nella LAN) e ottengo il seguente
risultato:
root@seele:~# nmap -O jupiter -v -v
Starting nmap 3.55 ( 
http://www.insecure.org/nmap/
 ) at 2004-08-01
11:33
CEST
Host x.x.x.x appears to be down, skipping it.
Note: Host seems down. If it is really up, but blocking our ping
probes,
try -P0
Nmap run completed -- 1 IP address (0 hosts up) scanned in 12.539
seconds
Provo con l'opzione -P0:
root@seele:~# nmap -O jupiter -P0 -v -v
Starting nmap 3.55 ( 
http://www.insecure.org/nmap/
 ) at 2004-08-01
11:34
CEST
Host jupiter (x.x.x.x) appears to be up ... good.
Initiating SYN Stealth Scan against jupitert (x.x.x.x) at 11:34
Adding open port 1026/tcp
Adding open port 5000/tcp
Adding open port 135/tcp
The SYN Stealth Scan took 310 seconds to scan 1660 ports.
Warning:  OS detection will be MUCH less reliable because we did not
find at least 1 open and 1 closed TCP port
For OSScan assuming that port 135 is open and port 41364 is closed and
neither are firewalled
Interesting ports on jupiter (x.x.x.x):
(The 1657 ports scanned but not shown below are in state: filtered)
PORT     STATE SERVICE
135/tcp  open  msrpc
1026/tcp open  LSA-or-nterm
5000/tcp open  UPnP
Device type: general purpose
Running: FreeBSD 3.X|4.X, Microsoft Windows 95/98/ME|NT/2K/XP
OS details: FreeBSD 3.2-4.0, Microsoft Windows Millennium Edition
(Me),
Windows 2000 Professional or Advanced Server, or Windows XP
OS Fingerprint:
TSeq(Class=RI%gcd=1%SI=1FFA%IPID=I%TS=0)
T1(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)
TCP Sequence Prediction: Class=random positive increments
                         Difficulty=8186 (Worthy challenge)
TCP ISN Seq. Numbers: 3AF0B5BD 3AF261DB 3AF419D8 3AF58B50 3AF6F0EE
3AF8809E
IPID Sequence Generation: Incremental
Nmap run completed -- 1 IP address (1 host up) scanned in 319.062
seconds
Soddisfatto del risultato, scollego da Internet la macchina Windows e
avvio la macchina da Linux (Slackware 10, kernel 2.4.26, iptables
v1.2.10) e reimposto la connessione.
Cerco su google alcune regole specifiche per iptables per evitare gli
scan di nmap 
(
http://seclists.org/lists/firewall-wizards/2002/Feb/0003.html
).
La configurazione di iptables e' quindi la seguente:
root@jupiter:~# iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source              
destination
    0     0 ACCEPT     tcp  --  any    any     anywhere            
anywhere
        tcp dpt:http
  576 31424 ACCEPT     tcp  --  any    any     anywhere            
anywhere
        tcp dpt:ssh
    0     0 ACCEPT     all  --  any    any     anywhere            
anywhere
        state RELATED,ESTABLISHED
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Chain OUTPUT (policy ACCEPT 496 packets, 33492 bytes)
 pkts bytes target     prot opt in     out     source              
destination
root@jupiter:~# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 24 packets, 1714 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source              
destination
root@jupiter:~# iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 227 packets, 12098 bytes)
 pkts bytes target     prot opt in     out     source              
destination
    0     0 DROP       tcp  --  any    any     anywhere            
anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
    0     0 DROP       tcp  --  any    any     anywhere            
anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
    0     0 DROP       tcp  --  any    any     anywhere            
anywhere            tcp flags:SYN,RST/SYN,RST
    0     0 DROP       tcp  --  any    any     anywhere            
anywhere            tcp flags:FIN,SYN/FIN,SYN
Chain INPUT (policy ACCEPT 217 packets, 11244 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Chain OUTPUT (policy ACCEPT 139 packets, 10911 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Chain POSTROUTING (policy ACCEPT 139 packets, 10911 bytes)
 pkts bytes target     prot opt in     out     source              
destination
Riprovo quindi a rifare il portscan con nmap (sempre dalla macchina su
Internet):
root@seele:~# nmap -O jupiter -v -v
Starting nmap 3.55 ( 
http://www.insecure.org/nmap/
 ) at 2004-08-01
11:26
CEST
Host jupitert (x.x.x.x) appears to be up ... good.
Initiating SYN Stealth Scan against jupiter (x.x.x.x) at 11:26
Adding open port 80/tcp
Adding open port 22/tcp
The SYN Stealth Scan took 112 seconds to scan 1660 ports.
Warning:  OS detection will be MUCH less reliable because we did not
find at least 1 open and 1 closed TCP port
For OSScan assuming that port 22 is open and port 37491 is closed and
neither are firewalled
For OSScan assuming that port 22 is open and port 42588 is closed and
neither are firewalled
For OSScan assuming that port 22 is open and port 34861 is closed and
neither are firewalled
Interesting ports on jupiter (x.x.x.x):
(The 1658 ports scanned but not shown below are in state: filtered)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
Device type: general purpose|broadband router|printer|router
Running (JUST GUESSING) : Linux 2.4.X|2.5.X|2.6.X|2.3.X (94%), Siemens
embedded (88%), Lexmark embedded (88%), FreeSCO Linux 2.0.X (88%),
Draytek embedded (88%), Conexant embedded (88%), Panasonic embedded
(87%)
Aggressive OS guesses: Linux 2.4.10 - 2.4.18 (94%), Linux 2.4.19 -
2.4.20 (94%), Linux 2.4.0 - 2.5.20 (94%), Linux 2.4.19 (x86) (94%),
Linux 2.4.6 - 2.4.21 (94%), Microsoft Xbox running Debian Linux 2.4.20
(88%), Siemens Speedstream 2602 DSL/Cable router (88%), Linux
2.6.0-test9 - 2.6.0 (x86) (88%), Linux 2.4.22 (SPARC) (88%), Linux
2.4.18 - 2.4.20 (88%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SInfo(V=3.55%P=i686-pc-linux-gnu%D=8/1%Time=410CB7C7%O=22%C=-1)
TSeq(Class=RI%gcd=1%SI=3611D0%IPID=Z%TS=100HZ)
TSeq(Class=RI%gcd=1%SI=360F16%IPID=Z%TS=100HZ)
TSeq(Class=RI%gcd=1%SI=361EEA%IPID=Z%TS=100HZ)
T1(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)
Uptime 0.018 days (since Sun Aug  1 11:02:29 2004)
TCP Sequence Prediction: Class=random positive increments
                         Difficulty=3546858 (Good luck!)
TCP ISN Seq. Numbers: 4D40C80C 4C9E11FC 4CE2A868 4C6BFC32 4C696B41
4CA9EA5C
IPID Sequence Generation: All zeros
Nmap run completed -- 1 IP address (1 host up) scanned in 136.851
seconds
Nonostante le regole specifiche impostate per iptables, nmap e'
riuscito
a fare lo scan della macchina Linux senza che mi venisse richiesto di
specificare l'opzione -P0 (infatti riconosce subito che la macchina e'
up); per la macchina Windows, nmap si accorge _SOLO_ dopo aver
specificato l'opzione -P0 che la macchina e' up!
Tutto cio' implica inoltre un minore tempo per fare un portscan
completo
(136 secondi contro 319 secondi).
Mi sapreste indicare dove sbaglio la configurazione di iptables ?
Vorrei che anche la macchina Linux sia "invisibile" ad un portscan
mediante nmap al quale non venga fornito il parametro -P0.
RingraziandoVi per l'attenzione e la collaborazione, porgo distinti
saluti.

 
Semplice ,
Nmap fa l'halt check usando gli icmp , di sicuro il tuo personal firewall (sygate) stà bloccando gli icmp , mentre da linux non hai nessuna regola che inibisca gli icmp di tipo 0-8
Ciauz

Ciauz
ma la policy di default per INPUT e' DROP, quindi _tutti_ gli icmp in
entrata vengono bloccati.




Prova dalla macchina remota a pingarti e vedi il risultato .... 

Prova dalla macchina remota a pingarti e vedi il risultato .... 
iceman@seele:~$ ping jupiter -c 10
PING jupiter (x.x.x.x) from x.x.x.x : 56(84) bytes of data.
--- jupiter ping statistics ---
10 packets transmitted, 0 received, 100% loss, time 9014ms



Di sicuro il tuo sygate mura le richieste icmp-echorequest rispondendo con un host unrechable.
Linux non lo fà , se la catena e drop , non invia nessuna risposta , quindi l'nmap non trovando risposta assume che l'host sia up ...

Linux non lo fą , se la catena e drop , non invia nessuna risposta , quindi l'nmap non trovando risposta assume che l'host sia up ...
Ok, quindi potresti dirmi come impostare su iptables la risposta ad un
icmp (8) come 'host unreachable' ?
Grazie

 Grazie
Adesso mi sfugge !! (dovrei rivedermi tutto l'howto).
Cerca la direttiva REJECT 

Cerca la direttiva REJECT 
Niente di tutto cio', ho risolto. Bastava leggere il man di nmap, in
particolare dell'opzione -P0.
Grazie e ciao

 Grazie
/sbin/iptables -A INPUT -p icmp  -j DROP
per il buon funzionamento della rete e' deprecated bloccare gli
icmp, almeno per il tipo 3 
Quindi per aprire aggiungi:
/sbin/iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT
ecc.ecc.
 
-- 
The Moon is Waning Gibbous (97% of Full)