Week 4 Linux Firewalls 1_868612559.pptx

This presentation explains firewalls in a much broader detail, from the importance to the usage. It makes it easier for students to understand its concept and how they work within linux distribution.

1. System Firewall Week 4 ITLSA1-22

2. System Firewall What is a Firewall? A firewall is a facility that prevents unauthorized access to or from a private network or a computer It is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Acts as a barrier between a trusted network and an untrusted network (e.g., the Internet). Types of Firewalls Hardware Firewalls: Physical devices that provide a barrier at the network perimeter. Software Firewalls: Programs installed on individual computers to protect them. Network Firewalls: Often a combination of hardware and software firewalls.

3. System Firewall Importance of Firewalls Protects against unauthorized access. Helps prevent cyber-attacks. Controls and monitors network traffic. Provides logging and reporting on network traffic. T racks system events, which you can analyze to set more suitable rules.

4. System Firewall: Basics of Firewall Configuration Default Policies Incoming Traffic: Generally, incoming traffic is more likely to be dangerous and is often restricted. Outgoing Traffic: Outgoing traffic is typically less restricted but should still be monitored. Allowing and Denying Traffic Allow Rules: Permit certain types of traffic e.g., allowing SSH traffic on port 22 Deny Rules: Block certain types of traffic e.g., blocking all incoming traffic by default

5. Uncomplicated Firewall ( ufw ) The Debian family of Linux uses ufw to protect the system. By default, ufw comes pre-installed on Ubuntu ufw is a much easier way to create an IPv4 or IPv6 host-based firewall Basic Application of ufw : Ufw’s most fundamental use is to control access to ports, allowing or denying connections based on specific requirements. IP Address Blocking : ufw can be used to deny access from specific IP addresses, particularly those known to pose security risks, thereby enhancing network security.

6. Uncomplicated Firewall ( ufw ) Check if the ufw is installed Use the apt or dpkg commands to check apt command Run: apt list –-installed | grep ufw The first part of the command lists all installed packages The second part filters the output to show lines that contain ufw dpkg command Run: dpkg –l | grep ufw The first part of the command lists all installed packages The second part filters the output to show lines that contain ufw If you see ufw listed in the output, it means ufw is installed If there is no output, ufw is not installed dpkg (Debian Package) is the low-level package manager for Debian-based systems like Ubuntu

7. Notes: How Pipes Work Basic Structure command_1 | command_2 Example Command Explanation ls –la | grep ufw 1. ls –la - lists all files, directories, and hidden files, with detailed information 2. | - The pipe symbol takes the output ‘ ls –la’ and passes it as input to the next command 3. grep ufw - grep: used for searching text using - ufw: pattern to search for - Searches through the output of ls -la for any lines that contain the string " ufw ”

8. Practical Uses of Pipes Pipes allow the combination of simple commands to perform more complex tasks Each command in the pipeline processes the data sequentially Filtering Output ps aux | grep ssh Lists all running processes and filters the list to show only those related to SSH Counting Lines cat file.txt | wc –l Outputs the contents of file.txt and counts the number of lines. Sorting and Displaying ls -la | sort Lists files in a detailed view and sorts the output alphabetically Combining Multiple Filters ls -la /var/log | grep '\.log' | wc –l Lists all files in /var/log, filters for files ending in .log, and counts the number of log files

9. Uncomplicated Firewall ( ufw ): Configuration Setting up and configuring a basic firewall on a Linux system can be done using Uncomplicated Firewall ( ufw ). Configuration Steps Install ufw ( if not already installed) Update the package list on your system Install ufw on your system Enable ufw sudo ufw enable – to activate ufw once it has been enabled Once enabled – ufw starts enforcing the firewall rules Set default policies sudo ufw default deny incoming - command sets the default policy to deny all incoming traffic. sudo ufw default allow outgoing - command sets the default policy to allow all outgoing traffic. Allow specific incoming connection sudo ufw allow ssh allows incoming traffic on port 22 (SSH) sudo ufw allow http allows incoming traffic on port 80 (HTTP) sudo ufw allow https allows incoming traffic on port 443 (HTTPS)

10. Understanding Port Numbers What are Port Numbers? They are numerical identifiers, u sed to differentiate types of network traffic Help direct data to the correct application or service on a computer Each port number corresponds to a specific process or service Common Ports Port 22 - Secure Shell (SSH) Used for secure remote logins and command execution Used to log into a remote machine and execute commands securely Provides a secure channel over an unsecured network by using encryption Port 80 - Hypertext Transfer Protocol (HTTP) Used for transmitting web pages over the internet Browser uses HTTP to request the web page from the server, the server responds with the requested content Port 443 - Hypertext Transfer Protocol Secure (HTTPS) Secure version of HTTP Uses SSL/TLSA encryption to secure the data transferred between the web server and the browser Used for secure web page transfers Importance of Understanding Ports Knowing which ports are used by which services helps in configuring firewalls and securing networks Recognizing port numbers can aid in troubleshooting network issues and understanding network traffic

11. Uncomplicated Firewall ( ufw ): View Status & Rules Three views to check the status and rules Default View Provides a simple list of active firewall rules, showing which ports and services are allowed Command: sudo ufw status Verbose View Provides detailed information about the firewall status, including logging status, default policies, and more detailed rules Command: sudo ufw status verbose Numbered View Lists the active firewall rules with numbers. This is useful for managing the rules, such as deleting specific rules by their number Command: sudo ufw status numbered

12. Practical Activity Create a file and name it firewall-rules.txt , firewall_report.txt or ufw_documentation.txt Compile a report and append all the output you’ll get from running the commands to configure the uncomplicated firewall Check if UFW is installed Install UFW (if not already installed Enable UFW Set default policies Allow the following incoming traffic: ssh, http, https Check UFW status and rules: The output must include – default view, verbose view and numbered view Deactivate UFW: sudo ufw disable Reset UFW to default settings: sudo ufw reset Compile a report with all the above details included Share a screenshot of your report/documentation output in class (Teams chat)