SSL Overview

It is important that transmissions between a web server and a browser are secure. There are three tasks that must be performed in order to do this:

1. Verify the identities of the hosts participating in the transmission by performing authentication procedures.
2. Check the integrity of the data by adding digital signatures containing a digest value - a unique value representing the data.
3. Secure the privacy of the transmission by encrypting it. Transactions between a browser and the sever can then be encrypted, with only the browser and the server able to decrypt the transmissions.

SSL

The protocol most often used to implement secure transmissions is the Secure Sockets Layer (SSL) protocol. SSL was originally developed by Netscape for secure transactions on the web.

SSL uses a form of public- and private-key encryption for authentication. Data is encrypted with the public key, but can only be decrypted using the private key. Once the data is authenticated, an agreed-upon cipher is used to encrypt it. Digital signatures encrypt an MD5 digest value for data to ensure integrity.

Certificates

Authentication is carried out using certificates of authority. Certificates are held by both the browser and the web server, uniquely identifying both parties in a secure transmission, and verifying that they are who they say they are. Certificates are signed by an independent certificate authority such as VeriSign, verifying that they are valid.

A certificate contains:

• The public key of the server or browser that it is given to
• The digital signature of the certificate authority
• Identity information such as the name of the user or company running the server or browser.

SSL Session

An SSL session is set up using a handshake sequence:

1. The server and browser exchange certificates
2. A cipher is agreed upon to to encrypt the transmissions
3. The digest integrity check is chosen
4. The type of public-key encryption, usually RSA or DSA, is chosen
5. A unique session key is set up that is used by both the browser and the server.

Firewalls Overview

What is a firewall?

Many systems connected to the internet are open to attempts by outside users to gain unauthorized access by setting up an illegal connection to the system. A firewall prevents any direct unauthorized attempts at access.

A good foundation for network security is to set up a Linux system to operate as a firewall for the network. The firewall can be used to set up either packet filtering or proxies. Packet Filtering is the process of deciding whether or not a packet received by the firewall should be passed on to the local network. The packet filtering software checks the source and destination addresses of the packet and sends the packet on if it is allowed.

Proxies can be used to control access to specific services, such as web or FTP servers. A proxy is required for each service. For example, the web server has its own web proxy, while an FTP server has an FTP proxy. Proxies can also be used to cache commonly used data, such as web pages, so that users do not need to constantly access the originating site.

An additional task performed by firewalls is NAT (Network address translation). Network address translation redirects packets to appropriate destinations. It performs tasks such as redirecting of packets to certain hosts, forwarding packets to other networks and chaning the host source of packets to implement IP masquerading.

The current Linux kernel incorporates support for firewalls using the Netfilter (IPtables) packet filtering package, which implements both packet filtering and NAT tasks for the Linux 2.4 kernel and above.

Implementing a firewall is simply a matter of providing a series of rules to govern what kind of access should be allowed on the system. If that system is also a gateway for a private network, the system's firewall can also help protect the network from outside attacks.

Iptables

Netfilter implements packet filtering and NAT tasks separately using different tables and commands. The command used to execute both is iptables, but for NAT, add the -nat option.

With iptables, different tables of rules can be set up to select packets according to differing criteria. Netfilter supports three tables: filter, nat and mangle. Packet filtering is implemented using a filter table that holds rules for dropping or accepting packets. Network address translation operations are implemented using the nat table. Specialized changes made to packets before they are sent out, when they are received or as they are being forwarded are implemented using the mangle table.

By default, iptables operates on the filter table, which need not be specified. To list the rules use the -L (list) option. This will include a DNS lookup for hostnames, and will show port lables and hostnames. To show only numeric output and avoid the DNS lookup, use the -n (numeric output), which will show IP addresses and port numbers eg
iptables -L -n
Chain input (policy ACCEPT):
Chain forward (policy ACCEPT):
Chain output (policy ACCEPT):
To operate on the nat table, add the -t nat option eg:
iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 867 packets, 146K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  vlan2  *       0.0.0.0/0            192.168.1.0/24
Chain POSTROUTING (policy ACCEPT 99 packets, 6875 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0
Chain OUTPUT (policy ACCEPT 99 packets, 6875 bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain WANPREROUTING (0 references)
 pkts bytes target     prot opt in     out     source               destination


The TCP/IP Protocol Suite

The TCP/IP Protocol Suite consists of many different protocols, each designed for a specific task in a TCP/IP network. The protocols are each known by an acronym.

The three basic protocols are:

Protocol	Acronym	Task
Internet Protocol	IP	Handles the actual transmissions: the packets of data with sender and receiver in each
Transmission Control Protocol	TCP	Handles receiving and sending out communications. It is designed to work cohesive messages or data, checking received packets and sorting them into their designated order, forming the original message. Data sent out is broken into separate , order-designated packets.
User Datagram Protocol	UDP	Handles receiving and sending out packets of data, but does not check their order.

The TCP and IP protocols are designed to provide stable and reliable connections that ensure that all data is reorganized into it's original order.

The UDP protocol is designed to send as much data as possible with no guarantee that packets will be received, or placed in their correct order. It is used for transmitting large amounts of data that can survive the loss of a few packets - for example, temporary images, videos and banners displayed on the internet.

Other protocols provide various network and user services. These protocols make use of either TCP or UDP protocol to send and receive packets, which, in turn, use the IP protocol to transmit the packets.

A complete list of protocols is:

Protocol	Acronym	Task
Transport
Internet Protocol	IP	Handles the actual transmissions: the packets of data with sender and receiver in each
Transmission Control Protocol	TCP	Handles receiving and sending out communications. It is designed to work cohesive messages or data, checking received packets and sorting them into their designated order, forming the original message. Data sent out is broken into separate , order-designated packets.
User Datagram Protocol	UDP	Handles receiving and sending out packets of data, but does not check their order.
Internet Control Message Protocol	ICMP	Status messages for IP.
Routing
Routing Information Protocol	RIP	Determines routing.
Open Shortest Path First	OSPF	Determines routing.
Network Address
Address Resolution Protocol	ARP	Determines unique IP address of systems.
Domain Name Service	DNS	Translates hostnames into IP addresses.
Reverse Address Resolution Protocol	RARP	Determines addresses of systems.
User Service
File Transfer Protocol	FTP	Transmits files from one system to another using TCP.
Trivial File Transfer Protocol	TFTP	Transfers files from one system to another using UDP.
Telnet		Remote login to another system on the network.
Simple Mail Transfer Protocol	SMTP	Transfers email between systems.
Remote Procedure Call	RPC	Allow programs on remote systems to communicate.
Gateway
Exterior Gateway Protocol	EGP	Provides routing for external networks.
Gateway-to-Gateway Protocol	GGP	Provides routing between internet gateways.
Interior Gateway Protocol	IGP	Provides routing for internal networks.
Network Service
Network File System	NFS	Allows mounting of file systems on remote machines.
Network Information Service	NIS	Maintains user accounts across a network.
Boot Protocol	BOOTP	Starts system using boot information on server for network.
Simple Network Management Protocol	SNMP	Provides status messages on TCP/IP configuration.
Dynamic Host Configuration Protocol	DHCP	Automatically provides network configuration information to host systems.

In a TCP/IP network, messages are broken into small components called datagrams. These are then transmitted through various routes and reassembled into their original message at the destination computer.

Datagrams can in turn be broken down into smaller components, called packets. These are the physical units that are actually transmitted. Sending messages as small components is faster and more reliable than sending them as one single large transmission. If one component is lost or corrupted, only that component must be resent. With a single large transmission, the whole message must be resent.

Configuring and Managing TCP/IP Networks

TCP/IP networks are configured and managed with a set of utilities, ifconfig, route and netstat.

Utility	Description
ifconfig	Enables full configuration of network interfaces, adding new ones and modifying others.
route	Enables full configuration of the routing tables, adding new entries and modifying others.
netstat	Provides information about the status of network connections.