You are helping the user check if a firewall is running, analyze open ports, and suggest potential hardening.
Analyzes firewall status, open ports, and security vulnerabilities, then recommends specific hardening measures.
/plugin marketplace add danielrosehill/security-checkup-plugin/plugin install linux-server-mgmt@danielrosehillfirewall/You are helping the user check if a firewall is running, analyze open ports, and suggest potential hardening.
Check if a firewall is active:
UFW (Uncomplicated Firewall):
sudo ufw status verbose
iptables (lower level):
sudo iptables -L -n -v
sudo ip6tables -L -n -v
firewalld (if used):
sudo firewall-cmd --state
sudo firewall-cmd --list-all
nftables (modern replacement for iptables):
sudo nft list ruleset
If no firewall is active, recommend enabling UFW:
sudo apt install ufw
sudo ufw enable
sudo ufw status
Check currently listening services:
sudo ss -tulpn
# Or
sudo netstat -tulpn
This shows what services are listening on which ports.
Check for open ports from external perspective:
sudo nmap -sT -O localhost
Or install nmap if not available:
sudo apt install nmap
Analyze each open port: For each listening port, identify:
Common ports to check:
Check UFW rules in detail:
sudo ufw status numbered
sudo ufw show added
Check iptables rules in detail:
sudo iptables -S
sudo iptables -L INPUT -v -n
sudo iptables -L OUTPUT -v -n
sudo iptables -L FORWARD -v -n
Identify potential security issues:
Services listening on 0.0.0.0 (all interfaces): These are accessible from network. Should they be?
sudo ss -tulpn | grep "0.0.0.0"
Services that should only be local: Databases, Redis, etc. should typically only listen on 127.0.0.1:
sudo ss -tulpn | grep -v "127.0.0.1"
Unnecessary services: Check for services that shouldn't be running:
sudo systemctl list-units --type=service --state=running | grep -E "telnet|ftp|rsh"
Analyze by service type:
SSH (port 22):
cat /etc/ssh/sshd_config | grep -v "^#" | grep -v "^$"sudo systemctl status fail2banWeb services (80, 443):
Databases (3306, 5432, 27017, etc.):
Check for common attack vectors:
# Check for services with known vulnerabilities
sudo ss -tulpn | grep -E "telnet|ftp|rlogin|rsh|rexec"
# Check for uncommon high ports
sudo ss -tulpn | awk '{print $5}' | cut -d: -f2 | sort -n | uniq
Suggest hardening measures:
Enable UFW if not active:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
For SSH access:
sudo ufw allow 22/tcp comment 'SSH'
# Or from specific IP:
sudo ufw allow from <IP-address> to any port 22 comment 'SSH from specific IP'
For web server:
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
For local network only:
sudo ufw allow from 192.168.1.0/24 comment 'Local network'
Install and configure fail2ban (recommended):
sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd
Check for IPv6 exposure:
sudo ss -tulpn6
sudo ufw status
Ensure IPv6 is also protected:
sudo ufw default deny incoming
# UFW handles both IPv4 and IPv6
Advanced iptables hardening (if using iptables):
Drop invalid packets:
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
Rate limit SSH:
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
Log dropped packets:
sudo iptables -A INPUT -j LOG --log-prefix "iptables-dropped: "
Check for Docker interference: Docker manipulates iptables directly, which can bypass UFW:
sudo iptables -L DOCKER -n
To prevent Docker from bypassing UFW, edit /etc/docker/daemon.json:
{
"iptables": false
}
Or use firewalld instead for better Docker integration.
Check connection tracking:
sudo conntrack -L
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max
Review logging:
sudo grep UFW /var/log/syslog | tail -20
sudo tail -20 /var/log/ufw.log
Generate hardening recommendations: Based on findings, suggest:
Provide firewall management commands:
UFW:
sudo ufw status - Check statussudo ufw enable - Enable firewallsudo ufw disable - Disable firewallsudo ufw allow <port> - Allow portsudo ufw deny <port> - Deny portsudo ufw delete <rule> - Delete rulesudo ufw reset - Reset to defaultsudo ufw logging on - Enable loggingiptables:
sudo iptables -L - List rulessudo iptables -A INPUT -p tcp --dport <port> -j ACCEPT - Allow portsudo iptables -D INPUT <rule-number> - Delete rulesudo iptables-save > /etc/iptables/rules.v4 - Save rulessudo iptables-restore < /etc/iptables/rules.v4 - Restore rulesReport findings: Summarize: