Re: ipfirewall(4)) cannot be changed
From: Giorgos Keramidas (keramida_at_ceid.upatras.gr)
Date: 05/25/03
- Previous message: Santos: "ipfirewall(4)) cannot be changed"
- In reply to: Santos: "ipfirewall(4)) cannot be changed"
- Next in thread: Santos: "Re: ipfirewall(4)) cannot be changed"
- Reply: Santos: "Re: ipfirewall(4)) cannot be changed"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 25 May 2003 23:51:15 +0300 (EEST) To: Santos <sansan@cas.port995.com>
On 2003-05-25 07:57, Santos wrote:
> root@vigilante /root cuaa1# man init |tail -n 130 |head -n 5
>
> 3 Network secure mode - same as highly secure mode, plus IP packet
> filter rules (see ipfw(8) and ipfirewall(4)) cannot be changed and
> dummynet(4) configuration cannot be adjusted.
>
> root@vigilante /root cuaa1# sysctl -a |grep secure
> kern.securelevel: 3
> [...]
> root@vigilante /root cuaa1# sysctl net.inet.ip.fw.enable=0
> net.inet.ip.fw.enable: 1 -> 0
>
> root@vigilante /root cuaa1# ping 216.136.204.21
> PING 216.136.204.21 (216.136.204.21): 56 data bytes
> 64 bytes from 216.136.204.21: icmp_seq=0 ttl=50 time=338.878 ms
> ^C
Try this patch. Unless of course, you're not using IPFW version 1,
in which case someone more knowledgeable will hopefully correct me :)
<<<<<<<
Index: ip_fw.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_fw.c,v
retrieving revision 1.192
diff -u -r1.192 ip_fw.c
--- sys/netinet/ip_fw.c 19 Feb 2003 05:47:33 -0000 1.192
+++ sys/netinet/ip_fw.c 25 May 2003 20:46:37 -0000
@@ -95,7 +95,7 @@
#ifdef SYSCTL_NODE
SYSCTL_NODE(_net_inet_ip, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
-SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, enable, CTLFLAG_RW,
+SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, enable, CTLFLAG_RW|CTLFLAG_SECURE3,
&fw_enable, 0, "Enable ipfw");
SYSCTL_INT(_net_inet_ip_fw, OID_AUTO,one_pass,CTLFLAG_RW,
&fw_one_pass, 0,
>>>>>>>
- Giorgos
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
- Previous message: Santos: "ipfirewall(4)) cannot be changed"
- In reply to: Santos: "ipfirewall(4)) cannot be changed"
- Next in thread: Santos: "Re: ipfirewall(4)) cannot be changed"
- Reply: Santos: "Re: ipfirewall(4)) cannot be changed"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
