Suggestion: Fedora Security HowTo/guide

[svarreby]

I have been wrestling with this since day one and I think that this topic is "very hard" to grasp (security = iptables).

Today I discovered that Fedora's firewall is, by default, blocking all communication with Samba's server ... (there went 24 hours of pain and some strong words).

I would like some initiated Fedora user (or staff-member) to help us security-noobs with this (for example):

1. Recommend a Fedora-friendly firewall package
(This could well be both zone-oriented ones and standalone ones)

2. Show us how to install it (if it's necessary)

3. Give clear and hand-holding instructions on how to set up the most common scenarious
__________________________________________________ __
- 2 NIC's = zones (if you're hooked up with other computers on a LAN)
- 1 NIC (most users would fit in here)
-----------------------------------------------------------------------------------

4. Common used services (FTP/Samba/Apache)

5. Publish examples (files)

... that's just my 2 cents

[Ug]

I would, if I knew anything about security. ;)

[ghenry]

For this, rather than implement your own firewall version with Fedora, I would use Smoothwall (http://www.smoothwall.org)

Their support is great, runs on any old pc and does everything you would need.

I like it :p

[svarreby]

I have been testing both Firestarter and FireHol. The later, http://firehol.sourceforge.net is, as far as I can see, a big hit :)

I know absolute nada when it comes to iptables and therefor I am looking for a "dummies-way-of-getting-iptables".

There's a package; http://prdownloads.sourceforge.net/firehol/firehol-1.159-rh7up.noarch.rpm?download

wich is aimed at Red Hat 7.0 and higher. There is two ways to install it. The automatic way (dubbel-click on the .rpm file) or with the source file. After I installed the .rpm, I issued the following command;

/etc/init.d/firehol helpme >/tmp/firehol.conf

This command analyzes your computer and configure the iptables-based firewall (could'nt be simplier :).

Then I went to Sygate;

http://scan.sygate.com

and did a stealth-scan. Every port was stealthed.

Amazing!

PS It discovered my Samba and there's no problem with file sharing anymore :)