Finally,
we can end up taking a look at working with firewalls and our firewall issues.
Now obviously part of the issue's going to be that you've got a firewall
that is blocking access on a port that you require.
But also firewalls could expose information about your system.
And especially when working with the defaults, we've got to be very careful.
If we go through and take a look on our AlmaLinux 8 system,
so working on AlmaLinux 8,
we can go through and start our firewall daemon if it's not running.
And if we take a look at our firewall list,
we're able to see that it has things like SSH,
which is important to be allowed through,
but also it has the Cockpit web interface.
That is allowed through even though Cockpit is not installed.
Now at this stage you might be thinking, what is the big deal?
The problem is that we're exposing information about the potential
operating system because many people will know that Cockpit is open in
the default firewall on Enterprise 8‑style systems.
So it gives them a good indication of the operating system that
you're running and more information than they'd have had had
you not had the firewall running.
On our openSUSE system or our Ubuntu system,
it doesn't really matter, we can make sure then that we've got nmap installed,
and we can go through and scan our AlmaLinux 8 system.
We're going to be able to see the response coming back that SSH is open,
but we can see that port 9090 is closed.
Now we can only see that because it's allowed through the firewall,
but there's nothing responding on the other end.
So why don't we go out to our command line so we can see what we mean by
this and get an idea of how working with the defaults could be very bad
in exposing information that we weren't even aware of and would be more
secure not running the firewall.
So we want to see what is allowed through the firewall and then see what
happens when we scan from one of our other systems.
We'll also see how we can disable ICMP responses through our firewall.
We are back working on our AlmaLinux 8 system,
and we're going to go through and make sure that the firewall is enabled.
These Vagrant machines the firewall is not enabled by default,
so we can go through then and enable it for system start up and start
it now with a ‑‑now and the services firewalld.
With that up and running,
we're able to go through and see the status of our
firewall by using our firewall‑cmd command.
And this then should go through and list to show what
is enabled through our firewall, so ‑‑list‑all.
When we look at our services, our services include cockpit,
the web interface management tool, dhcpv6‑client,
and ssh.
Probably at the moment we only need SSH,
so we could remove Cockpit and DHCPv6, but these are our defaults.
Now many people will enable the firewall,
and because the firewall is working for them,
they won't look at the configuration and won't realize that there are
extra services and possibly exposing information.
We can see this by moving through to our openSUSE system.
We're using openSUSE, and we would use zypper to install on openSUSE.
It reminds us of the software management tools that we
have in our different operating systems,
our different Linux distributions,
but also we know that we haven't got any restrictions that
we put in place through ICMP blocks with the Ubuntu system
that we did with systemctl.
So with this then installed,
we're able to go through and scan to see what we can see.
Now because we've got a firewall we can't connect
in the normal manner with nmap,
which is connecting to a variety of different ports.
But if I go through and just take a look as a standard user,
when we try and scan our system,
we can see then that we can't determine whether it's up or not.
But if we then go through and look at sudo and bang,
bang, run the same command but with elevated privileges,
takes a little bit longer,
but we end up connecting to each one of those ports directly rather
than trying to determine if the host is up first.
As we go through, we can see there are 998 filtered ports,
port 22 is open, but 9090 is closed.
And this is the very poignant clue to me that this is
probably a Red Hat Enterprise Linux 8‑based system to have
that defaulting through the firewall.
It's showing it's closed because it's open in the firewall, i.e.
it's not filtered, but there's no service on the other side.
Now of course I can still ping the system.
If we go through and look at 192.168.56.11,
we haven't put any blocks in as far as ICMP is concerned.
Now I prefer to do it through sysctl, but we can also do it through our firewall.
We might as well return through to our AlmaLinux 8 system and looking at how
we can implement the block through our firewalld firewall.
So back now working on AlmaLinux 8, you've got to keep up,
we're in AlmaLinux 8 now.
So as long as you know where we're working with,
we're able then to go through and block our ICMP echos.
So we can go back into our firewall‑cmd command and
then ‑‑add and then ‑icmp‑block,
and then we have to specify the block that we want to implement.
And we can move it to the top of the screen, put =echo‑request.
So with that then it's success.
We could list all and we could see then our icmp‑blocks,
and we can see then that echo‑request is blocked.
If we go through then,
we can see now that we're getting our packet filter coming back.
We're not getting our proper response.
But having investigated our firewalls,
why don't we move back to our slides so we could summarize a little of what we've looked at within this module.