LINUX FIREWALLS: ENHANCING SEC [Hardcover]

by Steve Suehring

TCP/IP packet handling may seem crystal clear when you first hear about it, but after you've configured your Ethernet card's netmask address, the details become rather vague. You might find yourself asking--if you were a Danish prince--"What is a packet, if its chief good and market of its time be but to route and wrap?" If routing and wrapping were all packets did, we would all enjoy our ignorance blissfully. But packets--like men, as the prince learned--can be hollow carriers of ill will, and excluding the bad ones requires us to understand what they really truly are. At last. Just how interesting packets turn out to be is revealed in Linux Firewalls , Robert L. Zeigler's sober, agile, and subtle text. Narrowing consideration to threats faced by small networks from external sources, Zeigler and his editors introduce security by delivering prerequisite tutorials on packet architecture and normal network-based client/server daemon-to-daemon communications. Nonthreatening daemon-to-daemon communication is part of the regular operation of a networked POSIX-compliant operating system (like Linux or Windows NT), but the incessant background chatter makes finding hostile intrusions a search for sometimes subtle irregularities in a high throughput environment. In fact, bombardment of networks with useless packets can create diversions for more pernicious attacks. Distinguishing the good packets from the potentially hostile or merely useless packets requires levels of filtering criteria that depend on the specifics of the network environment. Zeigler sorts out all of these issues and outlines practical network administration strategies for packet filtering. Linux Firewalls is a how-to for the home Linux box, including the creating and debugging firewall rules for home LANs and network interfaces. For larger LAN users, Zeigler describes intrusion logging; configurations based on varying levels of trust; and the how, why, and when of reporting intrusions to network authorities. In the wrong hands, firewall reports are either hyped-up cloak-and-dagger sensationalism or monotonous treatises in bitwise accounting. Zeigler strikes a middle ground with a book fit for members of the Linux community who are curious about what is happening over their TCP/IP connections. These are folks who have the prowess to build kernel releases on their own but who aren't necessarily wonks at developing kernel or device driver sources. --Peter Leopold

Genres: Programming, Technical

Hardcover

First published September 24, 2005

Reviews

[Kerszi · Rating 4 out of 5]

Wszystko o iptables i nftables aż do bólu. Ale głównie o tym, chociaż jest też o zabezpieczeniach sieci.

[Jascha · Rating 5 out of 5]

Ever since the early 90s, when the Internet phenomenon exploded, security became an issue, since the number of exposed machines grown exponentially. This also led to an inevitable increase in the amount of books being written on the subject, thousands and thousands of pages targeting both simple end users, interested in protecting their home LAN, and network administrators, responsible to keep the gates of huge castles and companies well guarded against dragons and hackers. Among them, Linux Firewalls definitely stands out, both for its quality and readability. Despite being 10 years old, it still represents a must have for any network and system administrator interested in learning how to defend the perimeter.

Definitely targeting network professionals, on the contrary of many titles out there, Linux Firewalls tackles security from all sides. True, it is a text mainly focused on iptables, but it's not a reference, which is what the official man pages have been written for. The authors do instead cover security in a broad sense, from designing secure networks, depending on size and value of the services being protected, up to security incident response.

Throughout the three parts of the book (which is actually made of four parts, considering the appendixes), we make the acquaintance of iptables through an example that, overall, is a good starting point for the reader to build upon its own firewall configuration. Each and every network protocol (ok, not every protocol...) is analyzed individually from the perspective of the gateway firewall. The authors share their expertise and show us the challenges we network administrators must face when that specific service is served either locally or remotely and how securely iptables can control it, if it can.

Talking about shared expertise, I have particularly enjoyed the emphasis that the authors give not only to preventing malicious traffic from entering our network, but also to preventing it from leaving our gates, be it purposely generated or not. The chapters dedicated to investigating and reporting successful intrusions were ice on the cake.

It's pretty hard to find something wrong with this title. If I must, well I think that more space should have been dedicated to both NAT and mangle tables. True, NAT has its own chapter dedicated but still, overall, they are really given a small share of the cake.

A must have for any system/network administrator willing to understand how to secure his perimeter. This text is more than just firewalling; it's a concentrate of precious notes from a veteran to avoid newbies pitfalls. It definitely deserves an honored place in the bookshelf.

As usual, you can find more reviews on my personal blog: http://books.lostinmalloc.com Feel free to pass by and share your thoughts!

[Laurent]

Read the first and this edition. Great read.