Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-23 Thread Adrian Chung
On Sat, Sep 22, 2001 at 12:12:06AM +0200, Yann wrote: > > This also blocks outbound proxy traffic. :) > > And what about inbound http traffic ? > > { > $OUT .= <<'HERE'; > # Deny any requests for web traffic > /sbin/ipchains --append input -p tcp -d 0/0 80 -j REJECT > HERE > } T

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Des Dougan
Graeme, Many thanks. At 19:31 21/9/2001, Graeme Robinson wrote: >squid is active by default under 4.1.2, but not transparent - ie you need >to point the browsers to it to use it. Des -- Please report bugs to [EMAIL PROTECTED] Please mail [EMAIL PROTECTED] (only) to discuss security issues

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Graeme Robinson
On Fri, 21 Sep 2001, Des Dougan wrote: > Pardon my ignorance, Adrian, but does your contrib require squid to be > active? I have a default (well, almost :) ) e-smith setup, with no squid, squid is active by default under 4.1.2, but not transparent - ie you need to point the browsers to it to us

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Tom Carroll
Has anyone installed the LaBrea tar-pit on essg 4.1.2 yet? Tom -- Please report bugs to [EMAIL PROTECTED] Please mail [EMAIL PROTECTED] (only) to discuss security issues Support for registered customers and partners to [EMAIL PROTECTED] To unsubscribe, e-mail: [EMAIL PROTECTED] For additional

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Des Dougan
Pardon my ignorance, Adrian, but does your contrib require squid to be active? I have a default (well, almost :) ) e-smith setup, with no squid, but am interested in your work. Thanks, At 14:37 21/9/2001, Adrian Chung wrote: >Apparently the RPMS reject *any* attempts at outbound web traffic, >

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Adrian Chung
On Sat, Sep 22, 2001 at 12:12:06AM +0200, Yann wrote: > > Apparently the RPMS reject *any* attempts at outbound web traffic, > > since the packets are filtered in the OUTPUT chain, instead of the > > INPUT chain. > > > > This also blocks outbound proxy traffic. :) > > And what about inbound http

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Yann
- Original Message - From: "Adrian Chung" <[EMAIL PROTECTED]> To: "e-smith-devinfo" <[EMAIL PROTECTED]> Sent: Friday, September 21, 2001 11:37 PM Subject: Re: [e-smith-devinfo] AntiNimda contrib RPMS. > Apparently the RPMS reject *any* attempts a

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Adrian Chung
On Fri, Sep 21, 2001 at 02:14:46PM -0400, Adrian Chung wrote: > To uninstall the RPMS and return your server to it's previous state, > take the following actions. > > For SMEServer v5.0, simply remove the RPM, and re-run the above > commands: > >rpm -e Mitel-ProxyDenyReadmeEML-1.1.0-04.noarc

Re: [e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Adrian Chung
On Fri, Sep 21, 2001 at 02:14:46PM -0400, Adrian Chung wrote: > 2) They reject any attempts at outbound web traffic (TCP port 80) via >the e-smith/SMEServer v5.0 without configuring web browsers to use >the proxy. Apparently the RPMS reject *any* attempts at outbound web traffic, since th

[e-smith-devinfo] AntiNimda contrib RPMS.

2001-09-21 Thread Adrian Chung
I've released a couple of contrib RPMS to help counter propagation of the Nimda worm at least via IE5/5.5 vulnerabilities. The RPMS do two things: 1) They block any attempts to access "readme.eml" files via any browser using the proxy server on e-smith/SMEServer v5.0. 2) They reject any atte