From ad271f9d55546b00dffd0149f9161a17fffb9231 Mon Sep 17 00:00:00 2001 From: Samuel Hunter Date: Wed, 30 Jun 2021 20:09:56 -0700 Subject: Add UFW Tutorial --- index.html | 2 +- nginx.html | 2 +- ufw.html | 173 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 175 insertions(+), 2 deletions(-) create mode 100644 ufw.html diff --git a/index.html b/index.html index cab7e9e..80b9557 100644 --- a/index.html +++ b/index.html @@ -52,6 +52,7 @@
  • Schedule tasks with Crontabs/Cronjobs.
  • Mirror your site on Tor.
  • Password-protecting Webpages (HTTP Authentication)
    • +
  • Using ufw as a firewall.

    • "Build your own platform!"

    @@ -107,7 +108,6 @@
  • Nitter
  • Pleroma (like Twitter)
  • PeerTube (like YouTube)
    • -
  • Using ufw as a firewall.
  • XMPP ejabberd
  • Movim for XMPP
    • diff --git a/nginx.html b/nginx.html index 1b269db..3a3db0a 100644 --- a/nginx.html +++ b/nginx.html @@ -186,7 +186,7 @@ Now we can just reload or restart to make nginx< 
    systemctl reload nginx
    -

    The Firewall

    +

    The Firewall

    Vultr and some other VPS automatically install and enable ufw, a firewall program. diff --git a/ufw.html b/ufw.html new file mode 100644 index 0000000..7f80f08 --- /dev/null +++ b/ufw.html @@ -0,0 +1,173 @@ + + + + Using UFW as a Firewall – LandChad.net + + + + + + + +

    Using UFW as a Firewall

    + +
    +

    + Uncomplicated Firewall (UFW) is a front-facing program for the more involved iptables firewall program installed in most GNU/Linux distributions. + If you're reading this, I assume you know the basic steps on how to use a Linux shell and how to install software for your server. + Otherwise, I recommend following Setting Up a Web Server. +

    + +

    How to Get It

    + +

    + If you followed the basic setup course, then you know that Vultr already installed ufw for you. + If you don't use Vultr, then you can install it on a Debian system by running in a remote shell: +

    + + 
    sudo apt-get update && sudo apt-get install ufw
    + +

    + The first command checks to see what packages can be installed, and the second command installs ufw. + It's strung together by a && to run the second command as long as the first succeeded. +

    + +

    First-Time Setup

    + +

    + ufw is an administration program, so you will need root access to use it. + To make sure you don't have to keep typing sudo in all your commands, you can login to the root user by running: +

    + + 
    sudo su -
    + +

    I'll assume you're in a root account from now on, but otherwise, remember to prepend all ufw commands with sudo.

    + +

    You can check the status of ufw right now by running:

    + + 
    ufw status
    + +

    Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

    + + + + 
    ufw default deny incoming # block all incoming connections by default
+ufw allow in ssh # or: ufw allow in 22
+ufw enable
    + + + +

    + With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + To view all your rules, run: +

    + + 
    ufw status verbose
    + +

    A firewall that allows to connect to SSH and their website may look like:

    + + 
    Status: active
+Logging: on (low)
+Default: deny (incoming), allow (outgoing), deny (routed)
+New profiles: skip
+
+To                           Action      From
+--                           ------      ----
+22 (SSH)                     ALLOW IN    Anywhere
+80,443/tcp (WWW Full)        ALLOW IN    Anywhere
+22 (SSH (v6))                ALLOW IN    Anywhere (v6)
+80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)
    + +

    If you want to delete e.g. the 'WWW Full' rule, run:

    + + 
    ufw delete allow in 'WWW Full'
+ufw reload
    + +

    Enabling Common Services

    + +

    + You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. + You should look at the ports your services are open on and enable them individually. + Here is a list of a few common services: +

    + +

    Websites: HTTP and HTTPS

    + + 
    ufw allow in 'WWW Full'
+ufw reload
    + +

    Email: IMAP, POP3, and SMTP

    + + 
    ufw allow in IMAPS
+ufw allow in POP3
+ufw allow in SMTP
+ufw allow in 'Postfix SMTPS'
+ufw allow in 'Mail Submission'
+ufw reload
    + +

    Everything Else

    + +

    You can view all applications ufw knows about by running:

    + + 
    ufw app list
    + +

    Fine-Tuning Rules

    + +

    Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

    + + 
    ufw default allow in
+ufw deny in PORT
+ufw reject in PORT
+ufw reload
    + +

    You can add rules to comments to remember what they are there for:

    + + 
    ufw allow in PORT comment 'Secret SSH'
+ufw reload
+ufw status verbose
    + +

    Output:

    + + 
    To                         Action      From
+--                         ------      ----
+PORT                       ALLOW IN    Anywhere                   # Secret SSH
+PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH
    + +

    To deny outgoing ports:

    + + 
    ufw deny out PORT
    + +

    Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

    + + 
    ufw limit PORT/tcp
    + +

    To blocklist IP addresses:

    + + 
    ufw deny from IP_ADDRESS
    + +

    To read more what you can do with ufw, run:

    + + 
    man ufw
    + +

    Further Reading

    + + + + Contributor - shunter.xyz +
    + + + -- cgit v1.2.3