Build default-deny inbound and outbound through the adapter

Aperta
  • Qualcosa non va?
#78 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
40/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
bash, linux, powershell
Ambito
networking, security

Direzione di ricerca

Read Design 03, 01 and 12 linked in the issue, then inspect the adapter in core/platform/platform.sh and core/platform/Platform.ps1 which already do inbound deny. Create module lockout.firewall under phases/lockout/modules/firewall/ with .sh and .ps1 entry points adding outbound default deny and allow list. Write bats and Pester tests in tests/phases/lockout/firewall/; done when CI passes on Ubuntu and Windows runners with snapshot/restore intact.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area: firewall phase: lockout platform: linux platform: windows type: build

Read first

Read these before starting. If this issue and the spec disagree, the spec wins; say so in the pull request.

Summary

Build the firewall step of the first-minute lockout: the host's firewall drops all incoming and outgoing traffic except what the host needs and what scoring needs. This stops a reverse shell or beacon planted before the run from calling out, and closes every port that is not scored or the admin path. A revert timer undoes it if the team can no longer log in.

Depends on

  • Blocked by #66 (automatic runs and the login check) and #75 (credentials, which run before the firewall in the bundle).
  • Uses the dependency map from #72 for the outbound allow list, when it exists.
  • Blocks #85 (the first-minute bundle).

Location & Context

  • Branch: phase-4/firewall. Module ID: lockout.firewall, in phases/lockout/modules/firewall/, with module.yml and the .sh and .ps1 entry points (design 00, section 4).
  • The adapter it extends: core/platform/platform.sh and core/platform/Platform.ps1, which already do snapshot, scoring allowlist, inbound default deny and restore on UFW, firewalld, nftables, iptables and Windows Firewall.
  • Tests: tests/phases/lockout/firewall/ for the module (bats and Pester), and tests/platform/firewall.bats and tests/platform/Firewall.Tests.ps1 for the adapter.

Current Behavior

Labyrinth has no firewall module. The adapter can set an inbound default deny, but has no outbound default and no outbound-allow list, so nothing stops a planted program from connecting out.

Plan

  1. Add an outbound default deny and the outbound-allow list to the adapter, on every backend.
  2. Build the module: inbound and outbound default deny through the adapter, under the revert timer, with the allows in design 03, section 6.1 (scoring, scored ports from every source, official sources, ICMP, the admin path; for outbound, replies, loopback, DNS, NTP, the SIEM, the package mirror, and each scored service's outbound addresses).
  3. Refuse an allow or a deny narrower than "every source" on a scored port.
  4. On a domain controller, allow domain traffic from member hosts (design 12, section 3).
  5. Add the module to the shipped profiles that use it, its manual entry and its help page (about.txt).

Acceptance tests

Write these first, in bats and Pester:

  • After default-deny, a reverse shell planted before the run cannot connect out, and scoring checks still work.
  • A scored service whose outbound dependency is missing from the allow list fails its probe, and the module is rolled back.
  • An allow with a narrower source on a scored port is refused, and so is a deny of one.
  • The revert timer restores the firewall when verify is made to fail.
  • After default-deny, the host still answers ping and an established session survives.
  • On each backend, snapshot, then changes, then restore gives the same state.
  • Negative test: protected accounts and scored services are untouched before and after.

Done when

  • The Linux and Windows versions both pass CI, including the real-host tests on the Ubuntu and Windows Server runners. A test never cuts the runner off from GitHub.
  • The manual and the module's help page are written.
  • The tests above pass in the lab on each firewall backend (docs/lab/README.md).

Out of scope

  • Reopening outbound after the lockout: the Harden phase (#68).
  • Installing UFW on a Debian host with no front end: the Harden phase (design 01, section 5).
  • Firewall drift alerts (#91) and dynamic bans (#108).
  • Router and firewall appliances: runbooks only (#111).
Lingua principale
PowerShell
Stelle
0
Fork
0
Merge medio
54m
PR unite (30g)
43

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di dotnetdork/Labyrinth

Tutte le issue di dotnetdork/Labyrinth

Issue simili

Altre issue su Networking

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.