使用firewalld阻止ICMP时间戳和时间戳回复

操作系统:CentOS 7.0

根据安全扫描的结果,有人build议我们使用防火墙阻止ICMP时间戳和时间戳回复消息( CVE-1999-0524 )。 我已经使用firewalld为SSH设置了一些基本的IP过滤function,并允许使用HTTPS,但是难以忍受这一点。

我唯一能想到的就是firewall-cmd --add-icmp-block ,但我找不到与时间戳或时间戳回复相关的icmptype

可用的types( firewall-cmd --get-icmptypes )如下: destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded firewall-cmd --get-icmptypes destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded

如何使用firewalld阻止ICMP时间戳请求?

firewalld附带一组预定义的ICMPtypes,您可以直接使用:

 # firewall-cmd --get-icmptypes destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded timestamp-reply timestamp-request 

parsing器( /usr/lib/python2.7/site-packages/firewall/core/io/icmptype.py )并不限于这些types,而是允许进行扩展:

首先,根据man iptables-extensions(8)icmp

icmp(特定于IPv4)如果指定了“–protocol icmp”,则可以使用此扩展。 它提供了以下选项:

  [!] --icmp-type {type[/code]|typename} This allows specification of the ICMP type, which can be a numeric ICMP type, type/code pair, or one of the ICMP type names shown by the command iptables -p icmp -h 

icmp6(特定于IPv6)如果指定了--protocol ipv6-icmp' or –protocol icmpv6',则可以使用此扩展。 它提供了以下选项:

  [!] --icmpv6-type type[/code]|typename This allows specification of the ICMPv6 type, which can be a numeric ICMPv6 type, type and code, or one of the ICMPv6 type names shown by the command ip6tables -p ipv6-icmp -h 

您提到的两种types是IPv4特定的,因此您应该使用以下来找出iptables所识别的适当名称:

 # iptables -p icmp -h | grep timestamp timestamp-request timestamp-reply 

现在,如果你检查firewalld包的内容,你会发现预定义的ICMPtypes的存储位置:

 # rpm -ql firewalld | grep icmptype /etc/firewalld/icmptypes /usr/lib/firewalld/icmptypes/destination-unreachable.xml /usr/lib/firewalld/icmptypes/echo-reply.xml /usr/lib/firewalld/icmptypes/echo-request.xml /usr/lib/firewalld/icmptypes/parameter-problem.xml /usr/lib/firewalld/icmptypes/redirect.xml /usr/lib/firewalld/icmptypes/router-advertisement.xml /usr/lib/firewalld/icmptypes/router-solicitation.xml /usr/lib/firewalld/icmptypes/source-quench.xml /usr/lib/firewalld/icmptypes/time-exceeded.xml /usr/lib/firewalld/xmlschema/icmptype.xsd /usr/share/man/man5/firewalld.icmptype.5.gz 

如果您检查上面引用的parsing器,您将看到它在与iptables交谈时使用XML文件名作为ICMPtypes,所以您需要使用上面find的ICMPtypes为要使用的ICMPtypes编写两个新文件。 用户创build的ICMPtypes应该存储在/etc/firewalld/icmptypes

 # cat timestamp-request.xml <?xml version="1.0" encoding="utf-8"?> <icmptype> <short>Timestamp Request</short> <description>This message is used for time synchronization.</description> <destination ipv4="yes"/> <destination ipv6="no"/> </icmptype> # cat timestamp-reply.xml <?xml version="1.0" encoding="utf-8"?> <icmptype> <short>Timestamp Reply</short> <description>This message is used to reply to a timestamp message.</description> <destination ipv4="yes"/> <destination ipv6="no"/> </icmptype> 

你最终会得到:

 # ll -Z /etc/firewalld/icmptypes -rw-r--r--. root root system_u:object_r:firewalld_etc_rw_t:s0 timestamp-reply.xml -rw-r--r--. root root system_u:object_r:firewalld_etc_rw_t:s0 timestamp-request.xml 

使用提供的XSDvalidation它们:

 # xmllint --schema /usr/lib/firewalld/xmlschema/icmptype.xsd timestamp-request.xml timestamp-request.xml validates # xmllint --noout --schema /usr/lib/firewalld/xmlschema/icmptype.xsd timestamp-reply.xml timestamp-reply.xml validates 

重新加载防火墙:

 # firewall-cmd --reload 

最后添加它们:

 # firewall-cmd --add-icmp-block=timestamp-request # firewall-cmd --add-icmp-block=timestamp-reply # firewall-cmd --list-icmp-blocks timestamp-reply timestamp-request 

你可以检查他们已经被添加直接查看iptables规则:

 iptables -nvL | grep icmp 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited 0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 13 reject-with icmp-host-prohibited 0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 14 reject-with icmp-host-prohibited 0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 13 reject-with icmp-host-prohibited 0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 14 reject-with icmp-host-prohibited 

types13和14是新添加的ICMPtypes 。

作为参考,您可以阅读firewalld.icmptypes(5)页。

这些ICMPtypes已经被包括在上游 。

也许这也可能是有用的,即使它不是用firewalld完成的:

  echo“net.ipv4.tcp_timestamps = 0”>> /etc/sysctl.conf
 sysctl -p