Re: Security for Desktop

From: Yan Seiner (yan@oberon.cardinal.lan)
Date: 04/12/02 

From: "Yan Seiner" <yan@oberon.cardinal.lan>
Date: Thu, 11 Apr 2002 18:37:32 -0400

In article <Mk1t8.165249$y26.25039549@typhoon.tampabay.rr.com>, "Joe
Potter" <jmp@home.org> wrote:

>
> Yan, how does one use iptables to block outgoing stuff --- stuff you
> would be unaware of?

Well, I set up a chain called LOGACCEPT, which logs and accepts a packet.

Then you figure out which services your internal hosts would reasonably
need access to. So I'd say don't worry about SSH, FTP, HTTP, DNS, SMTP,
and so on. Set up a rule for the OUTPUT chain, and the outinterface, that
ACCEPTS those. Send everything else to the LOGACCEPT. For sanity, the
LOGACCEPT should only log every x'th packet, but accept all of them.

That way, when you look at your logs, you can see any strange packets.

--Yan

Relevant Pages

  • Re: [Full-Disclosure] write events log to CD?
    ... IMHO even using packet writing this is not a good solution for log ... The principle of using WORM media for storing logs is an interesting ... 20mb overhead, about as efficient as drinking water to increase your ... Some googled details on packet writing support on CDR's: ...
    (Full-Disclosure)
  • Re: Another PEAP Authentication problem
    ... Packet type 5 stands for "ACCOUNTING_RESPONSE". ... > Okay, I previously posted some tracing logs and nobody responded, so I ... > As far as my event logs on the IAS server, I do not see anything about ... > out-bound RADIUS packet ...
    (microsoft.public.internet.radius)
  • Re: strange firewall log
    ... Oh,I found that the packet sent to the destination IP is not my IP, it sent ... Please help me with the understanding of logs. ... >> I didn't use any outgoing program to access the internet. ...
    (microsoft.public.security)
  • Re: Strange ICMP packets
    ... >>doing Stateful Packet Inspection that should be preventing IP ... > I would check for the same addresses cropping up in both logs. ... > What I have been doing is having the firewall send me the log each day ... all blocked unsolicted inbound connection. ...
    (comp.security.firewalls)