Using Guarddog

Chapter 2. Using Guarddog

Tutorial: Basic Configuration

In this tutorial I will explain basic networking concepts and how to quickly setup Guarddog to protect a single workstation.

Starting Guarddog

First start up Guarddog. For recent Mandrake and Redhat systems there should be a Guarddog menu entry on the K menu under Configuration/Networking. You will then immediately be asked for the root password. This is needed because Guarddog needs administrator access in order to modify the system's networking sub-system.

Once Guarddog has opened it's window you will see that it the user interface is divided across four tabs. For this tutorial we will ignore the the Zone, Logging and Advanced tabs and concentrate on the Protocol tab.

Basic Networking Concepts

(Skip this section if you understand network protocols and the "Client Server Model".)

Now I must explain what a protocol is. Networks are all about computers talking to other computers. Like when talking to other person in the Real World(tm) it helps if you both agree to speak the same language, be it English, Dutch or Sign Language. Same thing for computers, they need to agree on what language they are going to speak when talking to another computer. The difference between computer protocols and my previous example is that protocols are usually only intended for one particular task like moving files (FTP), fetching web pages (HTTP) or chatting with other computer users (IRC, ICQ).

Attacks against computer systems across the network are performed by using and abusing protocols and the software used to implement them. All too often the software used to implement a protocol contains flaws that can be exploited by malicious people to gain access to a system or to disrupt it.

One more important concept to understand network protocols is the "Client Server Model". All network protocols involve at least two different parties communicating. Although each party is using the same protocol quite often they will have different roles to play in that protocol. The most common model is where one party acts as a "client" while the other acts as a "server" who responds to requests from the "client". A very close analogy in the real world would be buying fries down at the local fast food restaurant. You and the person behind the counter would both be using English as the protocol but you both have different roles. You would have the role of "client" while the person serving you would be acting as the "server". HTTP, the protocol used on the World Wide Web uses a the "Client Server Model". Your web browser acts as the client while the big web server at Slashdot or CNN acts as the server, delivering pages back to your browser when it asks for them.

Permitting DNS

(Skip the next paragraph is you know what DNS is.)

The Protocol tab is where you specify which protocols are permitted to be used between your computer and the internet. The "Domain Name System" protocol, commonly known as DNS, is a very important protocol. All machines on the internet have what is known as an IP address which is just a number. You may have some before. They are often written as a "dotted quad" like "195.231.34.5" for example. An IP address is sort of like a telephone number, except that it's for identifying computers on the internet and not telephones. One problem with using IP addresses to identify machines is that it's not very human friendly. This is why "Domain Names" were invented. A "Domain Name" is just a human friendly name for a machine. Some examples of domain names are www.simonzone.com, www.cnn.com and dot.kde.org. But to use the internet your computer still needs to know and use IP addresses. This is where DNS comes in. It is a system for turning human friendly names like www.simonzone.com into computer friendly IP addresses. Machines on the internet known as DNS Servers do nothing except answer queries from other machine about what IP address belong to which domain name. By using DNS servers your computer knows what you are talking about when you ask for www.slashdot.org. Without DNS your web browser won't know where www.cnn.com is, and ICQ chat client won't be able to connect to the chat network at icq.com either. Without DNS most other protocols won't work.

Lets go through the steps involved for permitting our computer to use the DNS protocol to communicate with DNS servers on the internet.

  • First make sure that Internet is selected in the Defined Network Zones: list. (It's at the top left corner on the window.) The listbox should have two entries, Internet and Local.

  • Open the Network part of the list view widget in the center of the window. It should expand to show more options and checkboxes with entries like ICMP Redirect and DNS - Domain Name Server .

  • To the right of the list of protocols should be a black box in the Local column. The box is just a checkbox and you should click on it until it shows a check mark (tick). The box has three states, unchecked, checked and crossed. Just repetively click on it to cycle through the states.

Done. That's all you need to do say that your local machine is permitted to use DNS to access servers on the Internet. Your screen should look something like the picture below.

Reading the protocol tab

This illustration also summarises how to read all of the information presented on the Protocol tab. There is a lot of information packed into this one tab, but it is vital that you understand what it means so that you can avoid misconfiguration.

Protocol Organisation

Once we have DNS permitted we can move on to permitting other common protocols that we might want to use.

Guarddog supports many different network protocols. To help organise them all and make it easier to find what you want, they are divided into categories. The different categories are:

  • Chat - Protocols used by chat programs like IRC and ICQ.

  • Data Serve - Protocols used by databases and other data sources like time servers.

  • File Transfer - Protocols used to transfers files like HTTP for the Web and FTP.

  • Game - Protocols used by games for online multiplayer gaming.

  • Interactive Session - Protocols used for working on or performing actions on a remote system. SSH Secure Shell, telnet and also RPC protocols are here.

  • Mail - Protocols associated with delivering and moving email. SMTP and POP3 are here.

  • Media - Protocols used for delivering multimedia across the internet in real time.

  • Miscellaneous - Other protocols that really didn't fit under the other categories.

  • Network - Protocols related to the direct operation of the network itself.

  • User Defined - Protocols defined by the user on the Advanced tab appear here.

Naturally there is some overlap and some protocols could easily also be placed under a different category than the end they are currently in.

Tip

To quickly get information about a protocol, click on its name. A description of the protocol will appear in the area to the right side of the window.

Permitting Common Protocols

Here is a quick list of the most common protocols that you will probably want to permit.

  • HTTP - Used on the World Wide Web to move web pages around. If want to browse the web you will need this. It's in the File Transfer category.

  • FTP - File Transfer Protocol. Used for uploading and downloading files. Also commonly used on the web too. If you have seen something like "ftp://" in the location bar on your web browser, then FTP is being used. FTP is in the File Transfer category.

  • SMTP - Simple Mail Transport Protocol. Used for sending email around the internet. It's in the Mail category.

  • POP3 - Post Office Protocol version 3. Commonly used for picking up and downloading email from a mailbox located at an ISP. It's in the Mail category.

Warning

Resist any temptation to permit all protocols. The more protocols you permit the weaker your firewall will be. The idea is to only permit the protocols you really need, and no more. Don't permit something just in case you might need it in the future. If you need to permit another protocol in the future then you can just come back to Guarddog and turn it on.

Applying your new Firewall

Changes made in Guarddog don't take effect instantly. To start your new firewall need to hit the Apply button or the Ok button (which will also exit the program once the firewall is in place). This will cause Guarddog to set up the networking subsystem on your machine with your new firewall rules. Once you click on the Ok or Apply button a warning message will appear to tell you that changing the system's firewall may disrupt existing network connections. Basically, it not a good idea to be doing anything important on your network, like an FTP download for example, when you go to Apply the firewall. Ok the warning and there will be a few seconds delay and then you will see a konsole window appear. Once the firewall has been put in place the message Press return to continue will appear. If there were errors running the script they will be present in the konsole window. Press the return key to close the konsole window.

Done! Your new firewall should now be in place and working. From now on whenever your system boots it will automatically be set up to use your firewall. Guarddog does not have to be constantly running to protect your computer. As your firewall needs evolve you can just run Guarddog again and tweak it's settings.

Tip

To see if your firewall is doing its job you can put it too a bit of a test. Go over to Gibson Research Corporation and head towards the "Shields Up!" area and ask it to "Test My Shields!" or "Probe My Ports!". It will then scan your machine and give you a report on what it found. Hopefully it should give you a very positive report.

KDE Logo