Re: iptables anti-nimda anyone?

From: Tim Haynes (secfoc@stirfried.vegetable.org.uk)
Date: 09/21/01 

To: Sven Michels <smichels@intradat.com>
Subject: Re: iptables anti-nimda anyone?
From: Tim Haynes <secfoc@stirfried.vegetable.org.uk>
Date: 21 Sep 2001 16:33:14 +0100
Message-ID: <86elp05zk5.fsf@potato.vegetable.org.uk>

Sven Michels <smichels@intradat.com> writes:

> if you've patched the kernel with string match support: yes: $IPTABLES -I
> INPUT -p tcp --dport 80 -m string --string .exe? -m state \ --state
> ESTABLISHED -j REJECT --reject-with tcp-reset (same works wizh .ida for
> the old one)

One word of caution here. This only sends a reject/RST to the packet
containing the .exe, *not* to the connection; you've already had the
SYN/handshaking stuff before that, so you'll be left with a connection
dangling open. You'd better have tuned your sysctls to reap dead
connections pretty quickly, if you're going to do this.

~Tim 

-- 
Tim Haynes
<http://spodzone.org.uk/>

Relevant Pages

  • Re: peer to peer messaging
    ... attempts to open a connection to port 80 of the server at that IP address. ... For example a packet from my machine might have source IP ... Packets from the sever to my laptop would have those reversed. ...
    (comp.lang.java.programmer)
  • Re: IPFW Dynamic Rules
    ... > So if the dynamic rule has the same behaviour as the origination ... > rule on the same port with the same protocol, ... If client sends UDP query to DNS on your machine, you get the packet: ... is deleted after connection is inactive for some time. ...
    (FreeBSD-Security)
  • [NEWS] Cisco PIX TCP Connection DoS
    ... Get your security news from a reliable source. ... By crafting a special TCP packet and sending it to a vulnerable Cisco PIX, ... embryonic connection open until the embryonic connection timeout which is ...
    (Securiteam)
  • Re: Nmap questions concering my router
    ... that may have to be fetched) is downloaded as one connection. ... >> all addresses (and may listen using just one interface to receive all ... sends packets to the correct protocol driver ... wire to an IP packet, and hands this to the IP driver which strips off ...
    (comp.security.firewalls)
  • Re: Port "triggering"
    ... The reason you should specify the -d above is if you have two internal nets ... If you are connecting to some outside server your connection will never make ... Again, the rule you had takes every single packet going to port 3783, no ... At the end of each chain I do a: ...
    (comp.os.linux.security)