Enable firewall for disabled Linux operating systems

After hanging out on the Internet, I suddenly saw a message in the forum saying that there is a way to enable the disabled Linux machine to continue running ipchains and enable the machine to continue implementing the firewall function. At that time, my first response was a disdain. Can a firewall still work when it is shut down? According to the links in the forum,

After hanging out on the Internet, I suddenly saw a message in the forum saying that there is a way to enable the disabled Linux machine to continue running ipchains and enable the machine to continue implementing the firewall function. At that time, my first response was a disdain. Can a firewall still work when it is shut down? According to the link mentioned in the forum, I found a post. as mentioned above, in the 2.0.x kernel, how does one use Shutdown? The h (shutdown) command can make the firewall still active. at this time, no drive is mounted and no process is running. That is to say, the firewall will run under Level 0, but it can still filter packets. However, the Post says this feature is no longer available in the kernel of 2.2.x.
I couldn't sit down here. I decided to implement similar features on the 2.2.x kernel, and I wanted to not add any patches in the kernel. It turns out that I did it.

Secure firewall

I think security means the possibility that the firewall has been completely shut down and all process spaces and file systems have been cleared, in this way, no hacker can access the system. Because there is no process space on the machine and no drive is attached. Therefore, hackers cannot run code in the kernel space outside the system. This requires the writing of explanatory code to produce the desired results, which is a very hard task.

However, it should be noted that the firewall cannot avoid "denial of service" attacks. In fact, this firewall is not more effective than any other firewall for "denial of service" attacks and other attacks that specifically consume resources. Of course, in reality, the system is generally not prone to such attacks.

This method ensures that no user can control the machine, thus greatly improving the security. This is exactly what the IT security field often says. to make a machine absolutely safe, we should shut it down and lock it in a room.

Implementation started

I used to test a Red Hat 6.2 machine based on x86. It has two NICs installed. The entire process requires no special system or kernel addition or modification. At first, I tried to search in the controlled running script, hoping to find some relevant clues. Finally, I fixed the focus on the rc0 script (which runs when the machine is down. It turns out that this is exactly where I am looking. So I began to delete some scripts from them and conducted a series of tests.

After a relatively short period of time, I concluded that for Red Hat Linux 6.2, you can delete the following script to implement the above functions:

/Etc/rc. d/rc0.d/S00killall

/Etc/rc. d/rc0.d/K90network

/Etc/rc. d/rc0.d/K92ipchains

After deleting these three scripts, we can make the network still work and make the ipchains still run. Remember to delete the killall script because its task is to find all directories in/etc/rc. d/rc0.d/and run all scripts starting with K. That is to say, the script will run the K90 network and K92ipchains scripts, and the two scripts will delete the network and ipchains.

Some explanations

In fact, we set Linux to a subset of the kernel. When the machine is paused, or even after the machine runs Shutdown, this part of the kernel will still reside in the memory. This method prevents the machine from suspending all processes, disabling all NICs, and detaching all file systems during shutdown. In addition, this method prevents the machine from executing any internal tasks after it is disabled. However, the kernel is still running and the memory manager is still running.

Because the kernel is still running, all the tasks we run after the shutdown can be run. Of course, most tasks require some I/O operations (as in this example ). Therefore, we must make these ports exist after the machine is shut down. This is achieved through K90network. This prevents the NIC from stopping after it is shut down.

In addition, any kernel-based service that needs to be used must be in the running state (such as ipchains ). By default, when the system is disabled, all ipchains rules will be suspended. In this example, the firewall will not work, so you must delete the script for clearing ipchains rules. In this example, delete the K92ipchains script.

Limitations

After the system is shut down, only some programs run, which obviously has some limitations. In this example, the most obvious limitation is that if the IP address of the client is obtained through background programs (such as PPP and DHCP), this function cannot be implemented. This limits the use of dynamic connection users. In addition, because all user proxy spaces (such as Socks5) are disabled during the relational system process, in this example, packet forwarding and NAT functions can only be implemented.

In addition, because all the drives are detached and all swap space is deleted from the machine, if the machine memory is large enough, so there will be no problems when the amount of information processed is large. However, if an old machine with poor performance is used, some problems may occur when the amount of information transmitted is too large.

Summary

As a Linux enthusiast, I think this small discovery is very interesting. In addition, when we complete specific security tasks, this also gives us a specific solution mode. Currently, what I want to know most is whether other free Unix (such as OpenBSD) can also perform similar experiments successfully. In addition, although I am doing experiments at home, if I use it for small and medium-sized companies, I want to provide the company with a highly secure data packet filtering function. In addition, it can also provide a very safe, high-bandwidth firewall or router for some large commercial tasks.