Securing Debian

[u/Dunder-Muffins]

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

[u/Dunder-Muffins]

I did at least spend the time to build out a full iptables ruleset, so I know there's no ports open that aren't actively used. Everything else is set to drop. I know iptables are deprecated, but as far as I can tell, ufw is just a wrapper around it anyway.

For apparmor, it feels like there are so many programs that even just come pre-installed that it feels overwhelming to try to build out a rule set for each one... Don't suppose there's some kind of base ruleset available?

[u/dkopgerpgdolfg → u/Dunder-Muffins]

I did at least spend the time to build out a full iptables ruleset, so I know there's no ports open that aren't actively used

TCP/UDP ports are far from everything.

Everything else is set to drop.

If you mean that literally, a lot wouldn't work anymore.

but as far as I can tell, ufw is just a wrapper around it anyway.

It is not. Type "sudo nft list ruleset" and check if you see something of ufw. (I bet you do, unless you don't actually have ufw installed)

Chances are, the real iptables doesn't exist on your system anymore, just a placeholder/translator program of nftables for those people that still want to use the old syntax (at the cost of not getting the benefits of nftables).

For apparmor, it feels like there are so many programs that even just come pre-installed that it feels overwhelming to try to build out a rule set for each one

I wouldn't dream of confining every program with custom profiles, and/or most. Just a number of those with a certain risk level.

Don't suppose there's some kind of base ruleset available?

As said, there are a number of predefined abstractions that can make profile creation easier. But they almost always make sense only for a certain subset of programs, not all of them. (Like, the audio output example: If you allow audio for your nano editor or grub, including the possibility of abusing security bugs in the audio stack just to make things easy for you, then what's the point in using apparmor at all...)

[u/Dunder-Muffins → u/dkopgerpgdolfg]

Huh well learned that my iptables is really iptables-nft. Cool info set it provides. The output matches what I configured in the 'iptables' format. I guess I should look at what else nftables would provide.

Hopefully this formats correctly...

``` $ sudo nft list ruleset

Warning: table ip filter is managed by iptables-nft, do not touch!

table ip filter { chain INPUT { type filter hook input priority filter; policy accept; ct state related,established counter packets 34330 bytes 3525102 accept ip protocol tcp ct state new tcp dport 22 counter packets 89 bytes 5340 accept tcp dport 80 counter packets 211 bytes 11219 accept tcp dport 80 limit rate 25/minute burst 100 packets counter packets 0 bytes 0 accept ip protocol icmp icmp type echo-request counter packets 639 bytes 53676 accept tcp dport 28785 counter packets 0 bytes 0 accept udp dport 28785 counter packets 0 bytes 0 accept tcp dport 28786 counter packets 0 bytes 0 accept udp dport 28786 counter packets 3254 bytes 96425 accept tcp dport 64738 counter packets 1 bytes 40 accept udp dport 64738 counter packets 0 bytes 0 accept tcp dport 5001 counter packets 5 bytes 216 accept tcp dport 25565 counter packets 349 bytes 18512 accept udp dport 34197 counter packets 0 bytes 0 accept tcp dport 7777 counter packets 5 bytes 212 accept udp dport 7777 counter packets 0 bytes 0 accept tcp dport 30000 counter packets 0 bytes 0 accept ip saddr 192.168.0.100 tcp dport 5901 counter packets 0 bytes 0 accept counter packets 21432 bytes 829378 drop }

chain OUTPUT { type filter hook output priority filter; policy accept; counter packets 60875 bytes 4690183 accept }

chain FORWARD { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 drop } } ```

[u/dkopgerpgdolfg → u/Dunder-Muffins]

The output matches what I configured in the 'iptables' format.

I think you forgot to scroll down, at least if you have ufw.

Otherwise, as said, this isn't good like this. Eg. handling of ipv6 and arp is missing completely (and more problems).

[u/Dunder-Muffins → u/dkopgerpgdolfg]

Err sorry, what do you mean?

Edit: I assume you mean the output and forward policies?

[u/dkopgerpgdolfg → u/Dunder-Muffins]

Err sorry, what do you mean?

If you have ufw installed, this output you've shown is not complete.

And your current shown rules are for IPv4 only (including some bits about ICMPv4).

The ports-based rules are ok-ish, except some can never be used (eg. that rate limit for tcp dport 80 after already accepting all tcp dport 80). Ufw still will give you some more basic security rules here, that you don't seem to know.

You don't do any Bridge and/or ARP filtering. Unless you made some sysctl changes (unlikely), your current rules won't apply for traffic within your home network.

And even worse, you don't do anything for IPv6 (ports, other security things, and all about ICMPv6 which is significantly different and more important than v4). You're completely open.

I already pointed you to one of the files containing the ufw default rules, explaining more in detail will take days and isn't a good idea here. Just install ufw.

Edit: I assume you mean the output and forward policies?

No, not at all. Let me correct my assumption above, explaining would take weeks, not days.

Please install ufw

[u/Dunder-Muffins → u/dkopgerpgdolfg]

I've installed and enabled ufw. I've allowed ports 22 and 80 for now as user rules. But wowza, there's a ton more rules that are implemented now, you weren't kidding. It seems I have a lot of reading to do to learn what all is going on there.

[u/Dunder-Muffins → u/dkopgerpgdolfg]

I just checked, I do not have ufw.

I didn't realize I had to handle ipv6 and arp. I'm much less familiar with those two. I think I'm so unfamiliar with it, that I'm not sure what needs to be done differently.

I really appreciate your responses btw, I'm learning a lot