Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Security Tools
Now that you've established a reasonably secure baseline OS and account configuration, it's time to put the good security tools to work. Enable Network Time Protocol (NTP). With Ubuntu, this is easily done via the System Settings tool for date and time (see Figure 9).
)
Figure 9 Set your time automatically.
My Fedora version had this feature disabled. I needed to download the NTP client—done easily with Yum or Apt. Once this software was installed, my Fedora time-and-date configuration tool enabled my ability to use NTP to set the time.
I wonder what Fedora applet lets you Add/Remove Software? Let's not rush to Ubuntu. My version had no firewall configuration tool. I consider this an important omission! Every operating system attaching to the Internet should have a firewall enabled. With Ubuntu's software tool, you can download several firewall configuration tools. I chose a very simple one, because my workstation design is very simple (see Figure 10).
)
Figure 10 A simple Ubuntu firewall tool.
This firewall is enabled and simply prevents attaching to any services (also known as daemons) that are running on Ubuntu. That's not quite what we need, but good enough for the sake of this article.
By comparison, Fedora's firewall features offer many security alternatives; however, each alternative can create network performance problems. In this case, I discourage experimentation, unless you write down each change you make, in case you need to back them out.
Let's review some nice firewall features in Fedora. Remember your root passphrase? I hope so—as you open the firewall configuration tool, you'll be asked to provide it. The first screen lets you configure trusted services. These are services you allow to access your Fedora system (see Figure 11). Consider c-a-r-e-f-u-l-l-y what you'll allow past your firewall! IPsec gives an encrypted, unmonitorable tunnel to your computer. Is that a good choice? Probably not.
)
Figure 11 What services will you trust through your firewall?
Now that you've carefully removed the trust checkmark from services that Fedora trusts by default, do you feel that you can trust any network out there? Let's review trusted interfaces, as shown in Figure 12.
)
Figure 12 What network interfaces will you trust?
Review the caution from Fedora carefully! If you access the Internet via dial-up, that's typically the PPP interface. If you trust this interface, you now trust the Internet, thereby negating your firewall. Be careful setting the firewall. Be careful when others ask you to configure your firewall in a certain way.
There's another important filter you might want to configure: the Internet Control Message Protocol (ICMP). ICMP configures your networking (see Figure 13). The Redirect message tells your computer that another device is now the network gateway, forcing all your network traffic through another device. By filtering this message, you prevent your computer from falling into a man-in-the-middle attack.
)
Figure 13 Stopping redirect messages.