Hi Allen,
Download the newest version of iptables and make patch-o-matic.
This patch is experimental, i had to modify the source code of ipt_string.c to get
this feature.
After patching, activate the "string match support" in the kernel.
Cheers,
Annette
-------------------------------------------------------------------------------------------------------------------------------
Cablecom GmbH
Security Team
Zollstrasse 42
CH-8021 Z�rich
Voice: +41 1 277 99 21
Fax: +41 1 277 93 22
E-Mail: [EMAIL PROTECTED]
>>> Allen Wayne Best <[EMAIL PROTECTED]> 11.06.02 18.12 Uhr >>>
hello:
i read in the linux journal the article "A NATural Progression" about a rule
which twinked my interest:
iptables -t filter -I FORWARD -m string \
--string=root.exe -j DROP
this set me to thinking, "ahhhh, a way to stop all those microcosm virii.
they have the commonality of the string 'cmd.exe.'" so off i go to build a
rule of similar bent, that is:
iptables -A INPUT -i $EXTERNAL -p tcp --dport 80 \
-m string --string=cmd.exe -j DROP
when i try to use this rule, i get the following error:
iptables v1.1.1: Couldn't load match `string'
have i missed something, or do i need to recompile the kernel (please say it
ain't so.....) fyi, i am using rh 7.0 and rh 7.2 on the servers.
--
regards,
allen wayne best, esq
"your friendly neighborhood rambler owner"
"my rambler will go from 0 to 105"
Current date: 20:54:8::161:2002
"Gort, klaatu nikto barada."
-- The Day the Earth Stood Still
