On Tue, Apr 04, 2000 at 05:52:02AM +1000, Alexander Else wrote:
> At 03:12 PM 4/3/00 +1000, John Clarke wrote:
> >1. Default policy is to deny all packets. Then rules are added to allow
> > certain packets through the firewall. Note that we use DENY rather
> > than REJECT so that the originator doesn't know that their packets are
> > being discarded until they time out.
>
> I'll dispute this advice. If i were going to write a serious scanner I'd
> take a dropped packet on a known port as sign of firewalling. If i get
What's the difference between a dropped packet and an unreachable address?
What's the difference between a dropped packet and a lost packet? None.
The point is that you can't be certain the packet has been dropped by the
recipient, just that you haven't received a response. A reject tells you
immediately that there's no point in continuing on that port, so you don't
need to waste any more time on it. The more energy an attacker wastes
beating against your firewall, the more of their time they waste, and the
more evidence you have to present to their ISP. Sometimes the ISP will
enforce their AUP ...
> rejects from everything but 21 and 80 I'm going to start thinking something
> is up.
I don't care what you think, I just don't want you getting access to any
of my machines. If your packets don't get to the target machine, there's
no way you're going to be able to break in.
> In this situation we're not just trying to block access to servers,
> we're trying to hide even their existence.
No we're not. I'm not suggesting that people hide servers. I'm
suggesting that people make their machine more secure against any form of
attack from outside. Optus's port scan is no different to any other
attacker's port scan. It's still an attack on your network, and you
should take maximum precautions against it. If this has the advantage of
hiding servers which are only for use within your local network, then
fine. If anyone wants to run a server for external use, then they're
violating their AUP and deserve to lose their account.
> The more you make it look like a windows box, the better.
Complete with security holes? I know, lets make it crash randomly,
that'll fool them :-)
> If they run fingerprinting against the machine
> they'll still pick it up as linux, but the more luserfied it seems, the
> less likely they're going to suspect that something's up. You could set a
Not true. The discussion on Friday night which started all this orginated
with a letter and email from Optus claiming that someone was running a
server because it accepted a connection on port 111. How much more
"luserfied" can you get? Optus have taken the lazy way out, with a simple
but flawed rule that if a machine accepts a connection on any port, then
it must be a server.
> default DENY policy, but they may take that to mean that you're trying to
> stop them scanning :)
Almost. You're not trying to stop their scans, you're trying to stop
*everyone's* scans and other attacks. It's called security.
> >2. Allow all packets on the loopback interface and any local ethernets.
> >3. Allow any packet in from ppp0 with the ACK bit set.
>
> Doesn't Optus@Home rely on you using ethernet to connect to the cable modem?
I don't know, I don't use it. I'm just trying to help those who do.
It's easy enough to change the rules to suit whatever interface it uses.
Cheers,
John
--
whois [EMAIL PROTECTED]
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
