At 07:39 AM 1/31/2004, Matthew Seaman wrote:
On Sat, Jan 31, 2004 at 07:32:36AM -0600, J.D. Bronson wrote: > I have a question. I setup the following in sysctl.conf: > > net.inet.tcp.blackhole=2 > net.inet.udp.blackhole=1 > > ..Well this works, but now I have a new issue. > I run sendmail and as such, need to allow TCP 113 into this machine > and yet get CONNECTION REFUSED. - I dont want to run IDENT, but > need to still get the CONNECTION REFUSED...
Run ipfw(8) or a similar firewall and set up a rule that sends an ICMP reject whenever it detects an incoming connection on port 113 as part of your firewall configuration. Eg. something like:
01600 reset tcp from any to me dst-port 113 setup
Thanks...but I have quite a robust Cisco firewall in place ahead of the freebsd machines...so I dont -need- to run ipfw...Hmmm...
You can achieve this rejection on the application level as well. Here's how:
1. Run inetd with command line options '-wW' to enable libwrap support.
2. Enable inetd's internal auth service with
auth stream tcp nowait root internal3. Deny auth connections in libwrap's /etc/hosts.allow, like so:
auth : ALL : severity debug : deny
ALL : ALL : allowNow you have something (inetd) bound to port 113, so a connection can be established, but it gets dropped immediately due to the libwrap setup. This is sufficient to prevent timeouts on the remote end but at the same time leaks as little information as possible for an application level solution.
Uwe -- Uwe Doering | EscapeBox - Managed On-Demand UNIX Servers [EMAIL PROTECTED] | http://www.escapebox.net _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
