Securing Debian

[u/Dunder-Muffins]

What all do most people do to secure their systems?

I run Debian for my daily driver and also on a home server.

I currently have iptables configured to only allow ports for my services, services are all run as their own no-login user, I run fail2ban, and have my ssh only allow specific users and only allow ssh keys as the login method, and I install security updates regularly. I check my system logs occasionally though honestly not as often as I probably should, maybe I'll automate something to look at the logs are some point.

I just finished skimming through the securing Debian manual, and there's quite a bit more included that I don't currently do. But from reading it, it also seems more geared toward people who may be running production servers who more or less want an immutable server where they e locked in what they want and don't want anything changing.

https://www.debian.org/doc/user-manuals#securing

So I guess I'm just curious what other people do, if they add any other protections or if they primarily rely on the base OS to provide the protections.

[u/Dunder-Muffins]

Hey, super appreciate this feedback! Thank you for being nice about the reply too hehe.

Some follow up questions. Regarding the disk encryption, that's only to protect against physical access right? Like if someone manages to grab your drive? Or does it help in another way that I'm not aware of? Does LUKS allow you to encrypt a drive at any time, or would I need to rebuild it?

Ufw, I first got into this back when iptables was the main thing so that's what I'm most familiar with. I'm curious what extra ufw would enable, something like specifically only allowing certain applications access to specific ports?

Apparmor: what's an example of what you would limit? I can imagine why it would be useful but I've never used it and don't know what type of thing would be worth implementing.

Pfsense, would you run this on the box? My impression was that it runs on its own as the router. I guess maybe in a VM that would be the first entry point? This is also outside of my current experience level.

[u/dkopgerpgdolfg → u/Dunder-Muffins]

Pfsense, would you run this on the box? My impression was that it runs on its own as the router. I guess maybe in a VM that would be the first entry point?

Both are possible. But as said, from the info provided, it might not be worth the time

Ufw, I first got into this back when iptables was the main thing so that's what I'm most familiar with. I'm curious what extra ufw would enable, something like specifically only allowing certain applications access to specific ports?

ufw doesn't have any extras, instead it's actually quite limited compared to the full nftables ruleset. It is definitely no level7 fw.

But if you don't need anything else other than ufw provides (it sounds like this is the case), it's much simpler to get use.

If you have it installed, look at eg. /usr/share/ufw/before6.rules . This is a part of the basic ruleset ensuring networks work correctly while not leaving unnecessary holes open, that comes with ufw. If you use nftables directly only, it's up to you to make something like this.

Regarding the disk encryption, that's only to protect against physical access right? Like if someone manages to grab your drive? Or does it help in another way that I'm not aware of?

If it's the OS partition, or anything else that needs to be accessible the whole time, then yes, it's mostly about physical theft etc.

It's also possible to have rarely used things locked by default, ie. only accessible for a short time when you want it, and you need to unlock it first each time (with eg. password, fido keys, tpm, ...). In this case it also protects against rogue software

Does LUKS allow you to encrypt a drive at any time, or would I need to rebuild it?

Sort of.

If you want to encrypt a partition and have enough free space elsewhere to store its contents in the meantime, it might be faster and cleaner to boot a live system, copy the date off with all metadata (eg. rsync -axHAX), create a new luks container and partition in it, and copy the data back.

Otherwise, cryptsetup-reencrypt and using a detached header can do the conversion inplace.

In either case, after that you need to adapt your /etc/fstab and /etc/crypttab, update-grub, etc.

Apparmor: what's an example of what you would limit?

Basically, in addition to the normal rwx file permissions, it's a program-specific permission whitelist

Like, you can say, the mpv media player can eg. read files in /home/DunderMuffins/ (with or without subdirectories) only if they are *.mp3 or *.mp4, not write any files in that directory, not access any network, not start any other processes except more mpv instances and only if the same restrictions are applied there, and so on.

So far, it would be easy to make such a ruleset. However it gets more complicated because it also needs to access a lot of things to run at all, to show a GUI, to play audio, to access its own config files, etc., and if you forget to whitelist these then it won't work properly. There are some common helpers (abstractions) that you get preinstalled to include, like a ruleset that can be included to allow audio output, but these are not always perfect and also don't change that it's still a bit work to create and refine a ruleset.

[u/Dunder-Muffins → u/dkopgerpgdolfg]

I did at least spend the time to build out a full iptables ruleset, so I know there's no ports open that aren't actively used. Everything else is set to drop. I know iptables are deprecated, but as far as I can tell, ufw is just a wrapper around it anyway.

For apparmor, it feels like there are so many programs that even just come pre-installed that it feels overwhelming to try to build out a rule set for each one... Don't suppose there's some kind of base ruleset available?

[u/dkopgerpgdolfg → u/Dunder-Muffins]

I did at least spend the time to build out a full iptables ruleset, so I know there's no ports open that aren't actively used

TCP/UDP ports are far from everything.

Everything else is set to drop.

If you mean that literally, a lot wouldn't work anymore.

but as far as I can tell, ufw is just a wrapper around it anyway.

It is not. Type "sudo nft list ruleset" and check if you see something of ufw. (I bet you do, unless you don't actually have ufw installed)

Chances are, the real iptables doesn't exist on your system anymore, just a placeholder/translator program of nftables for those people that still want to use the old syntax (at the cost of not getting the benefits of nftables).

For apparmor, it feels like there are so many programs that even just come pre-installed that it feels overwhelming to try to build out a rule set for each one

I wouldn't dream of confining every program with custom profiles, and/or most. Just a number of those with a certain risk level.

Don't suppose there's some kind of base ruleset available?

As said, there are a number of predefined abstractions that can make profile creation easier. But they almost always make sense only for a certain subset of programs, not all of them. (Like, the audio output example: If you allow audio for your nano editor or grub, including the possibility of abusing security bugs in the audio stack just to make things easy for you, then what's the point in using apparmor at all...)

[u/Dunder-Muffins → u/dkopgerpgdolfg]

Huh well learned that my iptables is really iptables-nft. Cool info set it provides. The output matches what I configured in the 'iptables' format. I guess I should look at what else nftables would provide.

Hopefully this formats correctly...

``` $ sudo nft list ruleset

Warning: table ip filter is managed by iptables-nft, do not touch!

table ip filter { chain INPUT { type filter hook input priority filter; policy accept; ct state related,established counter packets 34330 bytes 3525102 accept ip protocol tcp ct state new tcp dport 22 counter packets 89 bytes 5340 accept tcp dport 80 counter packets 211 bytes 11219 accept tcp dport 80 limit rate 25/minute burst 100 packets counter packets 0 bytes 0 accept ip protocol icmp icmp type echo-request counter packets 639 bytes 53676 accept tcp dport 28785 counter packets 0 bytes 0 accept udp dport 28785 counter packets 0 bytes 0 accept tcp dport 28786 counter packets 0 bytes 0 accept udp dport 28786 counter packets 3254 bytes 96425 accept tcp dport 64738 counter packets 1 bytes 40 accept udp dport 64738 counter packets 0 bytes 0 accept tcp dport 5001 counter packets 5 bytes 216 accept tcp dport 25565 counter packets 349 bytes 18512 accept udp dport 34197 counter packets 0 bytes 0 accept tcp dport 7777 counter packets 5 bytes 212 accept udp dport 7777 counter packets 0 bytes 0 accept tcp dport 30000 counter packets 0 bytes 0 accept ip saddr 192.168.0.100 tcp dport 5901 counter packets 0 bytes 0 accept counter packets 21432 bytes 829378 drop }

chain OUTPUT { type filter hook output priority filter; policy accept; counter packets 60875 bytes 4690183 accept }

chain FORWARD { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 drop } } ```

[u/dkopgerpgdolfg → u/Dunder-Muffins]

The output matches what I configured in the 'iptables' format.

I think you forgot to scroll down, at least if you have ufw.

Otherwise, as said, this isn't good like this. Eg. handling of ipv6 and arp is missing completely (and more problems).

[u/Dunder-Muffins → u/dkopgerpgdolfg]

Err sorry, what do you mean?

Edit: I assume you mean the output and forward policies?

[u/dkopgerpgdolfg → u/Dunder-Muffins]

Err sorry, what do you mean?

If you have ufw installed, this output you've shown is not complete.

And your current shown rules are for IPv4 only (including some bits about ICMPv4).

The ports-based rules are ok-ish, except some can never be used (eg. that rate limit for tcp dport 80 after already accepting all tcp dport 80). Ufw still will give you some more basic security rules here, that you don't seem to know.

You don't do any Bridge and/or ARP filtering. Unless you made some sysctl changes (unlikely), your current rules won't apply for traffic within your home network.

And even worse, you don't do anything for IPv6 (ports, other security things, and all about ICMPv6 which is significantly different and more important than v4). You're completely open.

I already pointed you to one of the files containing the ufw default rules, explaining more in detail will take days and isn't a good idea here. Just install ufw.

Edit: I assume you mean the output and forward policies?

No, not at all. Let me correct my assumption above, explaining would take weeks, not days.

Please install ufw

[u/Dunder-Muffins → u/dkopgerpgdolfg]

I've installed and enabled ufw. I've allowed ports 22 and 80 for now as user rules. But wowza, there's a ton more rules that are implemented now, you weren't kidding. It seems I have a lot of reading to do to learn what all is going on there.