Building a Bastion Host (Building Internet Firewalls, 2nd Edition)

10.8. Building a Bastion Host

Now that you've figured out what you want your bastion host to do, you need to actually build the bastion host. This process of configuring a machine to be especially secure and resistant to attack is generally known as hardening. The basic hardening process is as follows:

Secure the machine.
Disable all nonrequired services.
Install or modify the services you want to provide.
Reconfigure the machine from a configuration suitable for development into its final running state.
Run a security audit to establish a baseline.
Connect the machine to the network it will be used on.

You should be very careful to make sure the machine is not accessible from the Internet until the last step. If your site isn't yet connected to the Internet, you can simply avoid turning on the Internet connection until the bastion host is fully configured. If you are adding a firewall to a site that's already connected to the Internet, you need to configure the bastion host as a standalone machine, unconnected to your network.

If the bastion host is vulnerable to the Internet while it is being built, it may become an attack mechanism instead of a defense mechanism. An intruder who gets in before you've run the baseline audit will be difficult to detect and will be well positioned to read all of your traffic to and from the Internet. Cases have been reported where machines have been broken into within minutes of first being connected to the Internet; while rare, it can happen.

Take copious notes on every stage of building the system. Assume that sometime in the future, a compromise will occur that causes the machine to burst into flames and be destroyed. In order to rebuild your system, you will need to be able to follow all of the steps you took previously.

You will also need all of the software that you used, so you should be sure to securely store all of the things you need to do the installation, including:

The disks, CDs, or tapes you install software from
The source code for any software you build from source
The environment you used to build software from source, if it's different from the one you're installing; this includes the operating system, compiler, and header files (and a machine they run on)
The manuals and documents you were working from

The following sections briefly describe each of the main steps involved in building a bastion host; these steps will be covered in more detail in the following separate chapters for Unix and Windows NT. They also touch briefly on ongoing maintenance and protection of the bastion host; note, though, that maintenance issues are discussed primarily in Chapter 26, "Maintaining Firewalls".


10.7. Disabling User Accounts on Bastion Hosts		10.9. Securing the Machine