Linux Workstation Hardening: Enhancing Security with UFW

Master UFW and Kernel Hardening to Fortify Your Linux Workstation Against Threats

While Linux is secure by design, an additional layer of protection can make a big difference. One of the simplest and most effective tools to harden your Linux workstation is UFW (Uncomplicated Firewall), which is designed to be easy to configure and use. This guide will walk you through configuring UFW for enhanced security and provide kernel-level hardening with sysctl. These steps will help secure your system without impacting your normal day-to-day activities.

Step 1: Install and Enable UFW

First, ensure that UFW is installed and active on your system:

sudo apt install ufw
sudo ufw enable

Check the current firewall status:

sudo ufw status verbose

Step 2: Set Default Firewall Policies

For increased security, set strong default policies that deny all incoming and outgoing connections, only allowing the necessary ones later.

sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw default deny forward

This configuration blocks all unsolicited network traffic and sets the stage for granular control over which connections are allowed.

Denying all incoming and outgoing connections by default ensures that only explicitly allowed traffic can pass through. This ‘default deny’ approach is a good security practice because it blocks everything until you specifically allow the necessary services.

Step 3: Allow Only Necessary Services

After defining the default policies, explicitly allow traffic for essential services.

Allow DNS (Port 53)

sudo ufw allow out 53

Allow HTTP and HTTPS (Ports 80 and 443)

sudo ufw allow out 80/tcp
sudo ufw allow out 443/tcp

Allow SSH (Port 22), if necessary, for remote access

sudo ufw allow out 22

Allow DHCP (Port 68/UDP)

sudo ufw allow out 68/udp

Allow Tor (Port 9050/tcp), if using Tor for anonymous browsing

sudo ufw allow out 9050/tcp

Only open ports you absolutely need. Allowing unnecessary services increases the attack surface of your system. If you’re unsure whether you need a service, it’s best to leave it blocked until you know for sure.

Step 4: Enable Logging

Logging helps you monitor the firewall’s activity and troubleshoot if needed:

sudo ufw logging on

Logs are stored in /var/log/ufw.log.

Important! Please notice, the following steps 5 and 6’s before.rules are optional and for advanced users. Only apply them if you know what you are doing and based on your needs and setup.

Step 5: Additional UFW Hardening Tips -optional-

Limit SSH Connection Attempts

If using SSH, mitigate brute-force SSH attacks by limiting the number of connection attempts:

sudo ufw limit ssh

Block Suspicious IP Addresses

Manually block IP addresses from known malicious sources (this is a sample address. Add instead the ones you know as malicious, if any):

sudo ufw deny from 203.0.113.50

Restrict Access by Network Interface

Limit SSH access to specific interfaces (e.g., VPN interface tun0):

sudo ufw allow in on tun0 to any port 22 proto tcp

Blocking specific IP addresses or limiting SSH attempts can be useful if you’re seeing unusual or malicious activity. However, these steps are more relevant for servers or systems exposed to the internet. If you’re working in a private environment, you may not need to apply these.

Step 6: Advanced UFW Configuration

Modify the before.rules -optional-

You can also modify the /etc/ufw/before.rules file for additional firewall hardening. This file allows you to define custom rules that are applied before the default UFW rules.

To edit the file:

sudo nano /etc/ufw/before.rules

Consider adding these rules to further harden your system:
(this is a sample address. Add instead the trusted ones you know, if any)

# Block all traffic from local network except from trusted IPs
-A ufw-before-input -s 192.168.1.100 -j ACCEPT  # Example: only allow from trusted IP

This will add another layer of filtering, ensuring that no unwanted traffic is allowed from untrusted local networks.

Kernel-Level Hardening with `sysctl`

Beyond firewall rules, tightening the network behavior at the kernel level can improve your workstation’s security. Apply the following kernel settings permanently by adding them to a custom configuration file:

sudo nano /etc/sysctl.d/99-hardening.conf

Paste the following:

# Protect against IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Disable ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable sending ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Ignore bogus ICMP error responses
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Optional: Disable IPv6 if not used
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# Prevents the system from acting as a router
net.ipv4.tcp_forward = 0

# Prevent time-wait assassination attacks
net.ipv4.tcp_rfc1337 = 1

# Reduces the risk of certain types of time-based attacks
net.ipv4.tcp_timestamps = 0

# Protects against smurf attacks
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disables all ICMP echo requests (ping), making the system less detectable to attackers via network scanning
net.ipv4.icmp_echo_ignore_all = 1

# Reduce the risk of exploitation through specific TCP vulnerabilities, at the cost of performance in some scenarios. 
net.ipv4.tcp_sack = 0
net.ipv4.tcp_dsack = 0
net.ipv4.tcp_fsack = 0

# Prevent the system from accepting potentially malicious routing information, thereby protecting against man-in-the-middle attacks
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

sudo sysctl --system

These _sysctl configurations help harden your kernel, particularly in protecting against network-based attacks that might bypass basic firewall rules. By applying these settings to a custom configuration file like hardening.conf, you’re ensuring that they remain persistent and won’t be overwritten during system updates._

Step 7: Testing and Monitoring

Check active rules:

sudo ufw status numbered

Remove a rule:

sudo ufw delete <number>

Scan your system from another device:

nmap -Pn <your-ip>

Review logs:

sudo less /var/log/ufw.log

Regularly check your firewall’s activity and system logs to ensure that no unexpected traffic is passing through. This is essential for maintaining a secure system, especially after any changes or updates to your configuration.

Summary

By following the steps in this guide, you have established a strong foundation for securing your Linux workstation:

UFW for controlling incoming and outgoing network traffic.
sysctl or kernel-level protections that mitigate a variety of network-based attacks.
Logging for monitoring and troubleshooting.

No single measure will make your system completely invulnerable. The goal is to reduce potential attack vectors through a layered approach : combining firewalls, kernel hardening, and monitoring to create a more secure environment.

The hardening process outlined here should significantly enhance your system’s security without impeding regular system use, such as performing ping scans and traceroutes.

Apply Filters to SQL Queries: A Cybersecurity Use Case