4 Effective Methods to Disable SELinux Temporarily or Permanently

On some of the Linux distribution SELinux is enabled by default, which may cause some unwanted issues, if you don’t understand how SELinux works and the fundamental details on how to configure it. I strongly recommend that you understand SELinux and implement it on your environment. But, until you understand the implementation details of SELinux you may want to disable it to avoid some unnecessary issues.
 
To disable SELinux you can use any one of the 4 different methods mentioned in this article.

The SELinux will enforce security policies including the mandatory access controls defined by the US Department of Defence using the Linux Security Module (LSM) defined in the Linux Kernel. Every files and process in the system will be tagged with specific labels that will be used by the SELinux. You can use ls -Z and view those labels as shown below.

# ls -Z /etc/
-rw-r--r--  root root  system_u:object_r:etc_t:s0       a2ps.cfg
-rw-r--r--  root root  system_u:object_r:adjtime_t:s0   adjtime
-rw-r--r--  root root  system_u:object_r:etc_aliases_t:s0 aliases
drwxr-x---  root root  system_u:object_r:auditd_etc_t:s0 audit
drwxr-xr-x  root root  system_u:object_r:etc_runtime_t:s0 blkid
drwxr-xr-x  root root  system_u:object_r:bluetooth_conf_t:s0 bluetooth
drwx------  root root  system_u:object_r:system_cron_spool_t:s0 cron.d
-rw-rw-r--  root disk  system_u:object_r:amanda_dumpdates_t:s0 dumpdates

Method 1: Disable SELinux Temporarily

To disable SELinux temporarily you have to modify the /selinux/enforce file as shown below. Please note that this setting will be gone after the reboot of the system.

# cat /selinux/enforce
1

# echo 0 > /selinux/enforce

# cat /selinux/enforce
0

 
You can also use setenforce command as shown below to disable SELinux. Possible parameters to setenforce commands are: Enforcing , Permissive, 1 (enable) or 0 (disable).

# setenforce 0

Method 2: Disable SELinux Permanently

To disable the SELinux permanently, modify the /etc/selinux/config and set the SELINUX=disabled as shown below. One you make any changes to the /etc/selinux/config, reboot the server for the changes to be considered.

# cat /etc/selinux/config
SELINUX=disabled
SELINUXTYPE=targeted
SETLOCALDEFS=0

 
Following are the possible values for the SELINUX variable in the /etc/selinux/config file

• enforcing – The Security Policy is always Encoforced
• permissive - This just simulates the enforcing policy by only printing warning messages and not really enforcing the SELinux. This is good to first see how SELinux works and later figure out what policies should be enforced.
• disabled - Completely disable SELinux

 
Following are the possible values for SELINUXTYPE variable in the /etc/selinux/config file. This indicates the type of policies that can be used for the SELinux.

• targeted - This policy will protected only specific targeted network daemons.
• strict - This is for maximum SELinux protection.

Method 3: Disable SELinux from the Grub Boot Loader

If you can’t locate /etc/selinux/config file on your system, you can pass disable SELinux by passing it as parameter to the Grub Boot Loader as shown below.

# cat /boot/grub/grub.conf
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5PAE)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5PAE ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5PAE.img
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5 ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5.img

Method 4: Disable Only a Specific Service in SELinux – HTTP/Apache

If you are not interested in disability the whole SELinux, you can also disable SELinux only for a specific service. For example, do disable SELinux for HTTP/Apache service, modify thehttpd_disable_trans variable in the /etc/selinux/targeted/booleans file.
 
Set the httpd_disable_trans variable to 1 as shown below.

# grep httpd /etc/selinux/targeted/booleans
httpd_builtin_scripting=1
httpd_disable_trans=1
httpd_enable_cgi=1
httpd_enable_homedirs=1
httpd_ssi_exec=1
httpd_tty_comm=0
httpd_unified=1

 
Set SELinux boolean value using setsebool command as shown below. Make sure to restart the HTTP service after this change.

# setsebool httpd_disable_trans 1
# service httpd restart

Linux IPTables: How to Add Firewall Rules (With Allow SSH Example)

This article explains how to add iptables firewall rules using the “iptables -A” (append) command.

“-A” is for append. If it makes it easier for you to remember “-A” as add-rule (instead of append-rule), it is OK. But, keep in mind that “-A” adds the rule at the end of the chain.

Again, it is very important to remember that -A adds the rule at the end.

Typically the last rule will be to drop all packets. If you already have a rule to drop all packets, and if you try to use “-A” from the command-line to create new rule, you will end-up adding the new rule after the current “drop all packets” rule, which will make your new rule pretty much useless.

Once you’ve mastered the iptables, and when you are implementing it on production, you should use a shell script, where you use -A command to add all the rules. In that shell script, your last line should always be “drop all packets” rule. When you want to add any new rules, modify that shell script and add your new rules above the “drop all packets” rule.

Syntax:

iptables -A chain firewall-rule

• -A chain – Specify the chain where the rule should be appended. For example, use INPUT chain for incoming packets, and OUTPUT for outgoing packets.
• firewall-rule – Various parameters makes up the firewall rule.

If you don’t know what chain means, you better read about iptables fundamentals first.

Firewall Rule Parameters

The following parameters are available for all kinds of firewall rules.

-p is for protocol

• Indicates the protocol for the rule.
• Possible values are tcp, udp, icmp
• Use “all” to allow all protocols. When you don’t specify -p, by default “all” protocols will be used. It is not a good practice to use “all”, and always specify a protocol.
• Use either the name (for example: tcp), or the number (for example: 6 for tcp) for protocol.
• /etc/protocols file contains all allowed protocol name and number.
• You an also use –protocol

-s is for source

• Indicates the source of the packet.
• This can be ip address, or network address, or hostname
• For example: -s 192.168.1.101 indicates a specific ip address
• For network mask use /mask. For example: “-s 192.168.1.0/24″ represents a network mask of 255.255.255.0 for that network. This matches 192.168.1.x network.
• When you don’t specify a source, it matches all source.
• You can also use –src or –source

-d is for destination

• Indicates the destination of the packet.
• This is same as “-s” (except this represents destination host, or ip-address, or network)
• You can also use –dst or –destination

-j is target

• j stands for “jump to target”
• This specifies what needs to happen to the packet that matches this firewall rule.
• Possible values are ACCEPT, DROP, QUEUE, RETURN
• You can also specify other user defined chain as target value.

-i is for in interface

• i stands for “input interface”
• You might over look this and assume that “-i” is for interface. Please note that both -i and -o are for interfaces. However, -i for input interface and -o for output interface.
• Indicates the interface through which the incoming packets are coming through the INPUT, FORWARD, and PREROUTING chain.
• For example: -i eth0 indicates that this rule should consider the incoming packets coming through the interface eth0.
• If you don’t specify -i option, all available interfaces on the system will be considered for input packets.
• You can also use –in-interface

-o is for out interface

• o stands for “output interface”
• Indicates the interface through which the outgoing packets are sent through the INPUT, FORWARD, and PREROUTING chain.
• If you don’t specify -o option, all available interfaces on the system will be considered for output packets.
• You can also use –out-interface

Additional Options for Firewall Parameters

Some of the above firewall parameters in turn has it’s own options that can be passed along with them. Following are some of the most common options.

To use these parameter options, you should specify the corresponding parameter in the firewall rule. For example, to use “–sport” option, you should’ve specified “-p tcp” (or “-p udp”) parameter in your firewall rule.

Note: All of these options have two dashes in front of them. For example, there are two hyphens in front of sport.

–sport is for source port (for -p tcp, or -p udp)

• By default all source ports are matched.
• You can specify either the port number or the name. For example, to use SSH port in your firewall rule, use either “–sport 22″ or “–sport ssh”.
• /etc/services file contains all allowed port name and number.
• Using port number in the rule is better (for performance) than using port name.
• To match range of ports, use colon. For example, 22:100 matches port number from 22 until 100.
• You can also use –source-port

–dport is for destination port (for -p tcp, or -p udp)

• Everything is same as –sport, except this is for destination ports.
• You can also use –destination-port

–tcp-flags is for TCP flags (for -p tcp)

• This can contain multiple values separated by comma.
• Possible values are: SYN, ACK, FIN, RST, URG, PSH. You can also use ALL or NONE

–icmp-type is for ICMP Type (for -p icmp)

• When you use icmp protocol “-p icmp”, you can also specify the ICMP type using “–icmp-type” parameter.
• For example: use “–icmp-type 0″ for “Echo Reply”, and “–icmp-type 8″ for “Echo”.

Example Firewall Rule to Allow Incoming SSH Connections

Now that you understand various parameters (and it’s options) of firewall rule, let us build a sample firewall rule.

In this example, let us allow only the incoming SSH connection to the server. All other connections will be blocked (including ping).

WARNING: Playing with firewall rules might render your system inaccessible. If you don’t know what you are doing, you might lock yourself (and everybody else) out of the system. So, do all your learning only on a test system that is not used by anybody, and you have access to the console to restart the iptables, if you get locked out.

1. Delete Existing Rules

If you already have some iptables rules, take a backup before delete the existing rules.

Delete all the existing rules and allow the firewall to accept everything. Use iptables flush as we discussed earlier to clean-up all your existing rules and start from scratch.

Test to make sure you are able to ssh and ping this server from outside.

When we are done with this example, you’ll only be able to SSH to this server. You’ll not be able to ping this server from outside.

2. Allow only SSH

Allow only the incoming SSH connection to this server. You can ssh to this server from anywhere.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

The above iptables command has the following 4 components.

• “-A INPUT” – This indicates that we are appending a new rule (or adding) to the INPUT chain. So, this rule is for incoming traffic.
• “-i eth0″ – Incoming packets through the interface eth0 will be checked against this rule.
• “-p tcp –dport 22″ – This rule is for TCP packets. This has one tcp option called “–dport 22″, which indicates that the destination port for this rule on the server is 22 (which is ssh).
• “-j ACCEPT” – Jump to accept, which just ACCEPTS the packet.

In simple terms the above rule can be stated as: All incoming packets through eth0 for ssh will be accepted.

3. Drop all Other Packets

Once you’ve specified your custom rules to accept packets, you should also have a default rule to drop any other packets.

This should be your last rule in the INPUT chain.

To drop all incoming packets, do the following.

iptables -A INPUT -j DROP

4. View the SSH rule and Test

To view the current iptables firewall rules, use “iptables -L” command.

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
DROP       all  --  anywhere             anywhere

As you see from the above output, it has the following two rules in sequence.

• Accept all incoming ssh connections
• Drop all other packets.

Instead of adding the firewall rules from the command line, it might be better to create a shell script that contains your rules as shown below.

# vi iptables.sh
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

# sh -x iptables.sh
+ iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
+ iptables -A INPUT -j DROP

# iptables -L INPUT
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
DROP       all  --  anywhere             anywhere

Similar to iptables append/add command, there are few other commands available for iptables. I’ll cover them in the upcoming articles in the iptables series. I’ll also provide several practical firewall rule examples that will be helpful in real life scenarios.

IPTables Flush: Delete / Remove All Rules On RedHat and CentOS Linux

On Red Hat based Linux, iptables comes with certain default rules. It is good idea to clean them up, and start from scratch.

This article is part of an ongoing iptables tutorial series. This is the 2nd article in that series. In our 1st part, we discussed about IPTables Tables, Chains, Rules Fundamentals.

Before we start learning how to add firewall rules using iptables, it is helpful to understand how to cleanup all the existing default rules and start everything from scratch.

Default Rules in IPTables

Start the iptables firewall as shown below.

# service iptables status
Firewall is stopped.

# service iptables start
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]

You can see the default rules under: iptables -> Filter Table -> RH-Firewall-1-INPUT Chain, as shown below. You can also use ‘iptables –list’ to view all the rules.

# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
3    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
4    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

IPTables Rules are stored in /etc/sysconfig/iptables

Please note that the iptables rules are stored in the /etc/sysconfig/iptables file. If you view this file, you’ll see all the default rules.

# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

Temporarily delete all the firewall rules

Use ‘iptables –flush’ option to delete all the rules temporarily.

# iptables --flush

# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (0 references)
target     prot opt source               destination

After the ‘iptables –flush’, if you restart the iptables, you’ll see all the default rules again. So, –flush is only temporary.

# service iptables stop

# service iptables start

# iptables --list

Permanently remove all the default firewall rules

Before deleting all the firewall rules, you’ll see the following in the /etc/sysconfig/iptables file.

# cat  /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

First, flush all these rules temporarily, as we discussed above.

# iptables --flush

Next, save the current iptables (which is empty, as we just flushed it) to the /etc/sysconfig/iptables file for permanent use using ‘service iptables save’

# service iptables save
Saving firewall rules to /etc/sysconfig/iptables:          [  OK  ]

Finally, view the /etc/sysconfig/iptables to make sure there are no rules.

# cat  /etc/sysconfig/iptables
# Generated by iptables-save v1.3.5 on Thu Oct 28 08:44:01 2010
*filter
:INPUT ACCEPT [102:7668]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [78:8560]
COMMIT
# Completed on Thu Oct 28 08:44:01 2010

Now, if you stop and start the iptables, you’ll not see the default rules anymore. So, remember to do ‘service iptables save’ to make the ‘iptables –flush’ permanent.

# service iptables stop

# service iptables start

# iptables --list

Now you understand the fundamentals of iptables, and how to clean-up all the existing rule to start from scratch. In our next article, you’ll learn how to start adding new iptables firewall rules with several practical examples.

Fail2Ban Howto: Block IP Address Using Fail2ban and IPTables

Fail2ban scans log files for various services ( SSH, FTP, SMTP, Apache, etc., ) and bans the IP that makes too many password failures. It also updates the firewall rules to reject these ip addresses.

Fail2ban is an intrusion prevention framework written in the Python programming language.

Main purpose of Fail2ban is to prevent brute force login attacks.

Also, refer to our earlier article on Tripwire (Linux host based intrusion detection system).

Install Fail2ban

To install fail2ban from source, download it from sourceforge..

Use apt-get to install Fail2ban on a Debian based system as shown below.

# apt-get install fail2ban

You can also install Fail2ban manually by downloading the fail2ban deb package.

# dpkg -i fail2ban_0.8.1-1_all.deb

How to configure fail2ban

All Fail2ban configuration files are located under the /etc/fail2ban directory.

/etc/fail2ban/fail2ban.conf

Main purpose of this file is to configure fail2ban log related directives.

• Loglevel: Set the log level output.
• logtarget : Specify the log file path

Actions taken by the Fail2ban are logged in the /var/log/fail2ban.log file. You can change the verbosity in the conf file to one of: 1 – ERROR, 2 – WARN, 3 – INFO or 4 – DEBUG.

/etc/fail2ban/jail.conf

jail.conf file contains the declaration of the service configurations. This configuration file is broken up into different contexts. The DEFAULT settings apply to all sections.

The following DEFAULT section of jail.conf says that after five failed access attempts from a single IP address within 600 seconds or 10 minutes (findtime), that address will be automatically blocked for 600 seconds (bantime).

[DEFAULT]
ignoreip = 127.0.0.1
maxretry = 5
findtime = 600
bantime = 600

• ignoreip: This is a space-separated list of IP addresses that cannot be blocked by fail2ban.
• maxretry: Maximum number of failed login attempts before a host is blocked by fail2ban.
• bantime: Time in seconds that a host is blocked if it was caught by fail2ban (600 seconds = 10 minutes).

Service Configurations

By default, some services are inserted as templates. Following is an example of the ssh services section.

[ssh]
enabled = true
port = ssh
filter = sshd
logpath  = /var/log/auth.log
action = iptables

• enabled : Enable the fail2ban checking for ssh service
• port: service port ( referred in /etc/services file )
• filter: Name of the filter to be used by the service to detect matches. This name corresponds to a file name in ‘/etc/fail2ban/filter.d’; without the ‘.conf’ extension. For example: ‘filter = sshd’ refers to ‘/etc/fail2ban/filter.d/sshd.conf’.
• logpath: The log file that fail2ban checks for failed login attempts.
• Action: This option tells fail2ban which action to take once a filter matches. This name corresponds to a file name in ‘/etc/fail2ban/action.d/’ without the ‘.conf’ extension. For example: ‘action = iptables’ refers to /etc/fail2ban/action.d/iptables.conf’.

Fail2ban will monitor the /var/log/auth.log file for failed access attempts, and if it finds repeated failed ssh login attempts from the same IP address or host, fail2ban stops further login attempts from that IP address/host by blocking it with fail2ban iptables firewall rule.

Fail2ban Filters

The directory /etc/fail2ban/filter.d contains regular expressions that are used to detect break-in attempts, password failures, etc., for various services.

For example:

• sshd.conf – Fail2ban ssh related filters
• apache-auth.conf – Fail2ban apache service filters

We can also add our own regular expression to find unwanted action.

Fail2ban Actions

The directory /etc/fail2ban/action.d contains different scripts defining actions which will execute once a filter matches. Only one filter is allowed per service, but it is possible to specify several actions, on separate lines.

For example:

• IPtables.conf – block & unblock IP address
• Mail.conf – Sending mail to configured user

Start/Stop Fail2ban Service

After making configuration changes stop and start the Fail2ban daemon as shown below.

# /etc/init.d/fail2ban stop

# /etc/init.d/fail2ban start

How to View and Delete Iptables Rules – List and Flush

Question: How do I view all the current iptables rules? Once I view it, is there a way to delete all the current rules and start from scratch?

Answer: Use the iptables list option to view, and iptables flush option to delete all the rules as shown below. You should have root permission to perform this operation.

1. View / List All iptables Rules

When you want to check what rules are in iptables, use –list option as shown below.

# iptables --list

Example 1: Iptables list output showing no rules

# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The above output shows chain headers. As you see, there are no rules in it.

Example 2: Iptables list output showing some rules

When there is a rule to disable ping reply, you have the iptables list output as like the following. You can see the rule in the OUTPUT chain.

# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       icmp --  anywhere             anywhere            icmp echo-request

2. Delete iptables Rules using flush option

When you want to delete all the rules, use the flush option as shown below.

# iptables --flush

After doing this, your iptables will become empty, and the “iptables –list” output will look like what is shown in the example 1.

You can also delete (flush) a particular iptable chain by giving the chain name as an argument as shown below.

# iptables --flush OUTPUT