
Guarddog 1.9.5
~~~~~~~~~~~~~~
by Simon Edwards <simon@simonzone.com>

!!! READ THESE INSTRUCTIONS THROUGH TO THE END !!!

Guarddog is user friendly firewall generation/management utility for KDE on
Linux. It allows you simply specify which protocols should be allowed and
requires no knowledge of port numbers.  Generates scripts for ipchains.

Installation
------------
If you have the option, install from an RPM or DEB or whatever and save
everyone the trouble. If that's not an option then read on...

Guarddog uses autoconf and should be easily compiled and installed with a
simple ./configure, make, make install. See the file INSTALL for generic
instructions on this part of the install. Make sure you have all the Qt
development material and headers installed. Otherwise configure will stop
and complain about it. If you are using an RPM based distribution then
you need to make sure that you also have any qt2-devel RPMs installed.
Having only the libraries installed is not enough. Same goes for KDE 2.
Make sure you have any kde...-devel RPMs also installed.

Boot time
---------
Guarddog generates a shell script at /etc/rc.firewall which should be run at
boot time.

* Mandrake Linux - runs /etc/rc.firewall at boot time by default which
  is good. But most other distributions are not setup like this. The firewall
  should be run before any network interfaces are enabled.

* SuSE - can be setup to run the firewall at boot time by appending the following
  lines to /sbin/init.d/boot.local :

  # Guarddog
  if [ -r /etc/rc.firewall ]; then
      . /etc/rc.firewall
  fi

  Thanks to Bjrn Breitsprecher for help with this.

* Other Distributions - I expect that running the firewall script at boottime
  on other Linux distributions follows similar lines at SuSE above. Basically
  find a suitable boot script and add some lines to execute the rc.firewall
  file if it exists.

  If you figure out how to start Guarddog at boot time for your particular
  distribution, please send me an email and let me know how.

Network Interface Up/Down
-------------------------
The firewall script that Guarddog creates needs to be run when ever an 
network interface is brought up or down.  In fact if Guarddog is not run
after a network interface is brought up then the firewall *should* stop
all traffic through that interface. This is a security feature.

* Mandrake Linux and maybe Redhat - Unfortunately this isn't as simple as
  I would hope... The Mandrake networking scripts have 'hooks' which can
  be used to for getting things like firewalls run whenever a network
  interface is brought up or down. Log in as root and execute the next two
  commands:

ln -s /etc/rc.firewall /sbin/ifup-local
ln -s /etc/rc.firewall /sbin/ifdown-local

  Now if there is currently no rc.firewall file then execute the next two
  commands to put a dummy/place holder there:

echo "#!/bin/sh" > /etc/rc.firewall
chmod u+x /etc/rc.firewall

  That's all good except there are currently a couple of bugs in the Mandrake
  network scripts at the time of writing. (Mandrake 8 is the current release
  at the time of writing). These bugs stop will stop the firewall from
  working for ppp and dial up modem users. Fortunately we can fix them now.
  
  While logged in as root go to the /etc/ppp directory and execute this list
  of commands:

echo "#!/bin/bash" > ip-up.local
echo "[ -x /etc/rc.firewall ] && /etc/rc.firewall" >> ip-up.local
cp ip-up.local ip-down.local
chmod u+x ip-up.local ip-down.local

  Do that perfectly and you should have to short shell scripts in your
  /etc/ppp directory, one called ip-up.local and the other called
  ip-down.local.

  These instructions look like they should also work for Redhat because
  Redhat and Mandrake use the same (or very similar) networking scripts.
  But I have not tested this out first hand.

I only know how to do this on one Linux distribution at the moment.


Menus
-----
That's the easy part done. make install should have installed an entry for
the Debian menu system. If your system uses the Debian menu system (Debian,
and Mandrake do, possibly others too), then you should update your system's
menus with a command like (as root user):

/usr/bin/update-menus

Tips
----
This is a development version which means that it's a work in progress and is
in no ways complete. The documentation is also not complete either. But here
are a couple to tips to explain the basics:

* In the Protocols page, just to make things clearer here an example of how
  to read the checkboxes. If "Protocols Server from Zone:" is set to
  "internet" and on line "DNS - Domain Name Server" the checkbox in the
  "local" column is set then it just means that machines in the local zone
  are permitted to access DNS services from the machines in the internet
  zone.

  Is this aspect of Guarddog confusing? Email me and let me know what you
  think.  I'm trying to build a tool that is hard to misconfigure, i.e. is
  safe and secure to use.
  
* Make sure you allow DNS for your machine. On the protocols page set
  "Protocols Server from Zone:" to internet and then go to the
  "Network -> DNS - Domain Name Server" part in the section below and turn
  it on for "local".

Any questions or ideas etc, just email me.

Simon Edwards <simon@simonzone.com>
