Now another really important security feature that we have inside of Linux
is being able to tune our Linux kernel using sysctl.
If I use the sysctl command with the option ‑a,
I'm going to get an awful lot of output, where we can see the
setting for each option that is available.
It's great to see how much is available,
but we can also use it with the ‑ar option so we can
implement a regular expression.
Here we're looking for icmp.
ICMP, our Internet Control Message Protocol,
essentially, they're really looking at our pings.
We're going to be able to ping our localhost,
because we're not blocking all ICMP traffic at the moment.
If we don't block ICMP traffic,
it becomes an easy and quick way that we can discover hosts on the network.
Being able to discover your host on network,
that means that somebody might dig a little bit further into
the services that are enabled on that system,
so sometimes it's a good idea to disable our ping messages.
So I can create a configuration file for sysctl to read.
We're creating it in the etc and sysctl.d directory.
And we can create numbered files. The higher the number,
the later it is read, so the more effective it becomes.
So if the setting has been previously made,
putting it into a file called 99 means then it's going to be read very late
on and most likely going to be the most effective setting.
We can add the setting to disable all of our ICMP traffic.
Number 1 is enabling it.
Having made the change through to the file,
of course, it won't be effective yet,
but we can read all of our files into our system by running sysctl ‑‑system.
This then emulates what would be read at system boot.
We can check then our setting is then effective,
and now we should no longer be able to ping our localhost.
So the best way to understand this is by doing,
so let's go through and investigate our procfs from the command line,
searching these settings with our sysctl command,
writing values back, and persisting these values.
And look at this, we can dive straight into our sysctl command.
Using option ‑a, we get to see all of the settings,
the tunings that we can make within our procfs.
There are lots there,
so we might prefer to dig in a little bit further and use a regular expression.
We just need a very simple text regular expression
here to search for the string icmp.
Icmp are our ping messages,
and we can then go through and see that top line is saying
that icmp_echo_ignore_all is currently disabled, so we're
not ignoring all of our messages.
We are broadcasts, but other ones we are responding to.
We're going to be able to test this. If I go through
and take a look at pinging localhost,
we're getting our response. This is just a unicast message going to one host.
But this in itself is a security risk, because it makes us easily found on
the network, so we can perhaps disable these messages.
I can do it in real time using the sysctl command, and it's relatively
straightforward, but we'll look at making it both in real time, as well
as making changes in a persisting file.
So if I use sysctl ‑w to write, and then I can go through my structure. The
file system structure below procfs would be represented by directories, but we
just use dots to separate the file system elements.
So we're looking now at net.ipv4.icmp_echo_ignore_all. It's a
mouthful, but we can also use tab‑completion. When we look at this, 1
then is enabling it. With it enabled, again,
we can see that top message where we can see its current setting. As I try
and ping now, we can see that we're not getting a response because we've
enabled the ignoring of our ICMP messages.
Now if we set it back to what it was before, so setting it through to 0, of
course we're going to be able to be back in that same scenario where we can
ping our system. But we can take our setting and configure it to be persistent.
So I'm just going to copy this setting, we can always change the value, but
we're going to add it through to the persistent settings, so inside of etc and
sysctl.d. I'm putting it in a high‑numbered file so they become the most
effective. 99‑icmp.conf has to be a .conf file. And then we can go through and
paste in our setting and just changing it from 0 through to 1 so the setting is
enabled. With that back in place, we won't have made any changes,
we've only written through to a file, but the idea of writing through
to the file is it is loaded on our system boot.
We can emulate that with systemctl, so our sysctl ‑‑system.
It reads in all of the files that it would during a boot, and we can see then
that our setting has been made and we can test that it's effective both by
pinging and reading the current configuration.
So if we go through and read the current configuration, we can see that
we're ignoring all ICMP traffic, and of course we're back in the situation where we're unable to ping our host.