> > > > I like the ability at secure level 3 to only reset the counters forward..
> > > > It fits in with such things as the "append only" flag.
> > >
> > > Then we'd have to implement per-rule counters that default to
> > > IPFW_VERBOSE_LIMIT but that could be changed to anything. That's a very
> > > different setup than what we currently have.
> > >
> > > (Another thing I just thought of is that this could cause DoS attacks on
> > > the system if a user compromised root and then set the limit to a very
> > > high number.)
> >
> > This is already possible via sysctl, the VERBOSE_LIMIT variable may be
> > altered.
>
> Can this be altered in securelevel==3?
# sysctl -a|grep secur
kern.securelevel: 3
# sysctl -a|grep verbo
net.inet.ip.fw.verbose: 1
net.inet.ip.fw.verbose_limit: 0
# sysctl -w net.inet.ip.fw.verbose_limit=999
net.inet.ip.fw.verbose_limit: 0 -> 999
"Any more questions?" :-)
... Joe
-------------------------------------------------------------------------------
Joe Greco - Systems Administrator [EMAIL PROTECTED]
Solaria Public Access UNIX - Milwaukee, WI 414/342-4847
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message
