I think I must contribute with theses that (i think) didn't saw mailed to the list:
- configure /etc/lilo.conf with password and restricted - partition and configure /etc/fstab with nodev,nosuid,noexec - protect spoofing in: - /etc/hosts.conf adding 'nospoof on' - addind '1' to /proc/sys/net/ipv4/conf/*/rm_filter - using PARANOID in wrapers (someone has told yet) - patching kernel with openwall+lids - adjust /proc with: - Enable TCP SYN Cookie protection in /proc/sys/net/ipv4/tcp_syncookies - Enable always defragging protection in /proc/sys/net/ipv4/ip_always_defrag - Enable broadcast echo protection in /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts - Enable bad error message protection in /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses - Enable IP spoofing protection turn in Source Address Verification on /proc/sys/net/ipv4/conf/*/rp_filter - Disable ICMP Redirect Acceptance in /proc/sys/net/ipv4/conf/*/accept_redirects and /proc/sys/net/ipv4/conf/*/send_redirects - Disable Source Routed Packets in /proc/sys/net/ipv4/conf/*/accept_source_route - Log Spoofed Packets, Source Routed Packets, Redirect Packets in /proc/sys/net/ipv4/conf/*/log_martians I think I saw some of these lines in a default install, but ... []'s -- mailto:[EMAIL PROTECTED] || http://www.nortenet.pt/~guilherme "All bits used in this post are recycled !"