Bug 232931
| Summary: | Autogenerated ip6tables ruleset is insecure, allowing incoming TCP connections to higher ports | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Peter Bieringer <pb> |
| Component: | system-config-securitylevel | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 5.0 | CC: | twoerner |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | RHBA-2008-0340 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-05-21 16:04:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 243739 | ||
| Bug Blocks: | |||
Assigning to system-config-securitylevel as this is generating the configuration. *** Bug 243741 has been marked as a duplicate of this bug. *** This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release. Dependency 243739 (closed with WONTFIX) and 243741 (closed with DUPLICATE) are not covering the above mentioned issue. This bug is regarding the missing ! --syn for incoming TCP packets and the wrong ICMP type for admin-prohibited and has nothing to do with the on RHEL5 not supported IPv6 connection tracking. So at least the dependency should be removed. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2008-0340.html |
Description of problem: After default installation of RHEL5 I found, that the generated ruleset is insecure, it allows TCP connections to higher ports (32768-61000), which was unexpected and sure unwanted. In addition, it uses the wrong ICMPv6 type for rejects. Version-Release number of selected component (if applicable): iptables-ipv6-1.3.5-1.2.1 How reproducible: After each installation Steps to Reproduce: 1. install default RHEL5 2. IPv6 telnet from outside to e.g. port 36000 Actual results: Chain RH-Firewall-1-INPUT (2 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all lo * ::/0 ::/0 50 4776 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT esp * * ::/0 ::/0 0 0 ACCEPT ah * * ::/0 ::/0 0 0 ACCEPT udp * * ::/0 ff02::fb/128 udp dpt:5353 0 0 ACCEPT udp * * ::/0 ::/0 udp dpt:631 0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:631 0 0 ACCEPT udp * * ::/0 ::/0 udp dpts:32768:61000 1 80 ACCEPT tcp * * ::/0 ::/0 tcp dpts:32768:61000 !!!! 0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:22 0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachabl Expected results: Matching the REJECT ruleset. Additional info: Following changes in the ruleset fixes that problem and the wrong ICMP error message. # diff -u ip6tables.orig ip6tables --- ip6tables.orig 2007-03-19 16:08:03.000000000 +0100 +++ ip6tables 2007-03-19 16:12:35.000000000 +0100 @@ -15,7 +15,7 @@ -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT --A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 -j ACCEPT +-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT --A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-port-unreachable +-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited COMMIT See also a comment on: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=214117#c6