holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Initial DocBook XML Conversion.

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@900 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
pauls 2003-12-22 19:01:16 +00:00
parent 1c2db120ae
commit 228e25fba0
1 changed files with 406 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

406
Shorewall-docs/whitelisting_under_shorewall.xml Normal file
View File

@ -0,0 +1,406 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<!-- $Id$ -->
<article status="draft">
<articleinfo>
<title>Whitelisting under Shorewall</title>
<author>
<firstname>Tom</firstname>
<surname>Eastep</surname>
<email>teastep@shorewall.net</email>
</author>
<pubdate>Decmber 22, 2003</pubdate>
<copyright>
<year>2003</year>
<holder>Tom Eastep</holder>
</copyright>
<legalnotice>
<para>
Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled <quote><ulink url="Copyright.htm" type="">GNU Free Documentation License</ulink></quote>.
</para>
</legalnotice>
</articleinfo>
<para>
For a brief time, the 1.2 version of Shorewall supported an <literal>/etc/shorewall/whitelist</literal> file. This file was intended to contain a
list of IP addresses of hosts whose POLICY to all zones was ACCEPT. The whitelist file was implemented as a stop-gap measure until the
facilities necessary for implementing white lists using zones was in place. As of Version <literal>1.3 RC1</literal>, those facilities were available.
</para>
<para>
White lists are most often used to give special privileges to a set of hosts within an organization. Let us suppose that we have the following environment:
</para>
<itemizedlist mark="bullet" spacing="compact">
<listitem>
<para>
A firewall with three interfaces -- one to the Internet, one to a local network and one to a <acronym>DMZ</acronym>.
</para>
</listitem>
<listitem>
<para>
The local network uses <acronym>SNAT</acronym> to the internet and is comprised of the Class B network <literal>10.10.0.0/16</literal> (Note: While this example uses an RFC 1918 local network, the technique described here in no way depends on that or on <acronym>SNAT</acronym>. It may be used with Proxy <acronym>ARP</acronym>, Subnet Routing, Static NAT, etc.).
</para>
</listitem>
<listitem>
<para>
The network operations staff have workstations with IP addresses in the Class C network <literal>10.10.10.0/24</literal>.
</para>
</listitem>
<listitem>
<para>
We want the network operations staff to have full access to all other hosts.
</para>
</listitem>
<listitem>
<para>
We want the network operations staff to bypass the transparent <acronym>HTTP</acronym> proxy running on our firewall.
</para>
</listitem>
</itemizedlist>
<para>
The basic approach will be that we will place the operations staff's class C in its own zone called ops. Here are the appropriate configuration files:
</para>
<!-- Zone File -->
<figure label="1">
<title>Zone File</title>
<informaltable colsep="1" pgwide="0">
<tgroup cols="3" align="left">
<thead valign="middle">
<row valign="middle">
<entry align="left">ZONE</entry>
<entry align="left">DISPLAY</entry>
<entry align="left">COMMENTS</entry>
</row>
</thead>
<tbody valign="middle">
<row valign="middle">
<entry align="left">
<literal>net</literal>
</entry>
<entry align="left">Net</entry>
<entry align="left">Internet</entry>
</row>
<row valign="middle">
<entry align="left">
<literal>ops</literal>
</entry>
<entry align="left">Operations</entry>
<entry align="left">Operations Staff's Class C</entry>
</row>
<row valign="middle">
<entry align="left">
<literal>loc</literal>
</entry>
<entry align="left">Local</entry>
<entry align="left">Local Class B</entry>
</row>
<row valign="middle">
<entry align="left">
<literal>dmz</literal>
</entry>
<entry align="left">DMZ</entry>
<entry align="left">Demilitarized zone</entry>
</row>
</tbody>
</tgroup>
</informaltable>
<para>
The <literal>ops</literal> zone has been added to the standard 3-zone zones
file -- since <literal>ops</literal> is a sub-zone of <literal>loc</literal>, we list it <emphasis>BEFORE</emphasis>
<literal>loc</literal>.
</para>
</figure>
<!-- Interfaces File -->
<figure label="2">
<title>Interfaces File</title>
<informaltable colsep="1" pgwide="0">
<tgroup cols="4" align="left">
<thead valign="middle">
<row valign="middle">
<entry align="left">ZONE</entry>
<entry align="left">INTERFACE</entry>
<entry align="left">BROADCAST</entry>
<entry align="left">OPTIONS</entry>
</row>
</thead>
<tbody valign="middle">
<row valign="middle">
<entry align="left">
<literal>net</literal>
</entry>
<entry align="left">
<literal>eth0</literal>
</entry>
<entry align="left">&lt;whatever&gt;</entry>
<entry align="left">&lt;options&gt;</entry>
</row>
<row valign="middle">
<entry align="left">
<literal>dmz</literal>
</entry>
<entry align="left">
<literal>eth1</literal>
</entry>
<entry align="left">&lt;whatever&gt;</entry>
<entry align="left"/>
</row>
<row>
<entry align="left">
<literal>-</literal>
</entry>
<entry align="left">
<literal>eth2</literal>
</entry>
<entry align="left">
<literal>10.10.255.255</literal>
</entry>
<entry align="left"/>
</row>
</tbody>
</tgroup>
</informaltable>
<para>
Because <literal>eth2</literal> interfaces to two zones (<literal>ops</literal> and <literal>loc</literal>), we don't specify a zone for it here.
</para>
</figure>
<!-- Hosts File -->
<figure>
<title>Hosts File</title>
<informaltable colsep="1" pgwide="0">
<tgroup cols="3" align="left">
<thead valign="middle">
<row valign="middle">
<entry align="left">ZONE</entry>
<entry align="left">HOST(S)</entry>
<entry align="left">OPTIONS</entry>
</row>
</thead>
<tbody valign="middle">
<row valign="middle">
<entry align="left">
<literal>ops</literal>
</entry>
<entry align="left">
<literal>eth2:10.10.10.0/24</literal>
</entry>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<literal>loc</literal>
</entry>
<entry align="left">
<literal>eth2:0.0.0.0/0</literal>
</entry>
<entry align="left"/>
</row>
</tbody>
</tgroup>
</informaltable>
<para>
Here we define the <literal>ops</literal> and <literal>loc</literal> zones. When Shorewall is stopped, only the hosts in the <literal>ops</literal> zone will be allowed to access the firewall and the <acronym>DMZ</acronym>. I use <literal>0.0.0.0/0</literal> to define the <literal>loc</literal> zone rather than <literal>10.10.0.0/16</literal> so that the limited broadcast address (<literal>255.255.255.255</literal>) falls into that zone. If I used <literal>10.10.0.0/16</literal> then I would have to have a separate entry for that special address.
</para>
</figure>
<!-- Policy File -->
<figure label="3">
<title>Policy File</title>
<informaltable colsep="1" pgwide="0">
<tgroup align="left" cols="5">
<thead valign="middle">
<row valign="middle">
<entry align="left">SOURCE</entry>
<entry align="left">DEST</entry>
<entry align="left">POLICY</entry>
<entry align="left">LOG LEVEL</entry>
<entry align="left">LIMIT BURST</entry>
</row>
</thead>
<tbody>
<row valign="middle">
<entry align="left">
<!-- To color the cell grey, uncomment the following 2 lines
<?dbhtml bgcolor="#EEEEEE" ?>
<?dbfo bgcolor="#EEEEEE" ?>
-->
<emphasis role="bold">
<literal>ops</literal>
</emphasis>
</entry>
<entry align="left">
<emphasis role="bold">
<literal>all</literal>
</emphasis>
</entry>
<entry align="left">
<emphasis role="bold">
<literal>ACCEPT</literal>
</emphasis>
</entry>
<entry align="left"/>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<emphasis role="bold">
<literal>all</literal>
</emphasis>
</entry>
<entry align="left">
<emphasis role="bold">
<literal>ops</literal>
</emphasis>
</entry>
<entry align="left">
<emphasis role="bold">
<literal>CONTINUE</literal>
</emphasis>
</entry>
<entry align="left"/>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<literal>loc</literal>
</entry>
<entry align="left">
<literal>net</literal>
</entry>
<entry align="left">
<literal>ACCEPT</literal>
</entry>
<entry align="left"/>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<literal>net</literal>
</entry>
<entry align="left">
<literal>all</literal>
</entry>
<entry align="left">
<literal>DROP</literal>
</entry>
<entry align="left">
<literal>info</literal>
</entry>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<literal>all</literal>
</entry>
<entry align="left">
<literal>all</literal>
</entry>
<entry align="left">
<literal>REJECT</literal>
</entry>
<entry align="left">
<literal>info</literal>
</entry>
<entry align="left"/>
</row>
</tbody>
</tgroup>
</informaltable>
<para>
Two entries for <literal>ops</literal> (in bold) have been added to the standard 3-zone policy file.
</para>
</figure>
<!-- Rules File -->
<figure label="4">
<title>Rules File</title>
<informaltable colsep="1" pgwide="0">
<tgroup align="left" cols="7">
<thead valign="middle">
<row valign="middle">
<entry align="left">ACTION</entry>
<entry align="left">SOURCE</entry>
<entry align="left">DEST</entry>
<entry align="left">PROTO</entry>
<entry align="left">DEST PORT(S)</entry>
<entry align="left">SOURCE PORT(S)</entry>
<entry align="left">ORIGINAL DEST</entry>
</row>
</thead>
<tbody>
<row valign="middle">
<entry align="left">
<literal>REDIRECT</literal>
</entry>
<entry align="left">
<literal>loc!ops</literal>
</entry>
<entry align="left">
<literal>3128</literal>
</entry>
<entry align="left">
<literal>tcp</literal>
</entry>
<entry align="left">
<literal>http</literal>
</entry>
<entry align="left"/>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<literal>...</literal>
</entry>
<entry align="left"/>
<entry align="left"/>
<entry align="left"/>
<entry align="left"/>
<entry align="left"/>
<entry align="left"/>
</row>
</tbody>
</tgroup>
</informaltable>
<para>
This is the rule that transparently redirects web traffic to the transparent proxy running on the firewall. The <emphasis role="bold">SOURCE</emphasis> column explicitly excludes the <literal>ops</literal> zone from the rule.
</para>
</figure>
<!-- Routestopped File -->
<figure label="5">
<title>Routestopped File</title>
<informaltable colsep="1" pgwide="0">
<tgroup align="left" cols="2">
<thead valign="middle">
<row valign="middle">
<entry align="left">INTERFACE</entry>
<entry align="left">HOST(S))</entry>
</row>
</thead>
<tbody>
<row valign="middle">
<entry align="left">
<literal>eth1</literal>
</entry>
<entry align="left"/>
</row>
<row valign="middle">
<entry align="left">
<literal>eth2</literal>
</entry>
<entry align="left">
<literal>10.10.10.0/24</literal>
</entry>
</row>
</tbody>
</tgroup>
</informaltable>
</figure>
<para>
<revhistory>
<revision>
<date>December 22, 2003</date>
<authorinitials>PAS</authorinitials>
<revremark>Initial conversion to DocBook XML from HTML.</revremark>
</revision>
</revhistory>
</para>
</article>