Re: lighting---hacked!
From: Tim Haynes (usenet@stirfried.vegetable.org.uk)Date: 05/14/02
- Next message: Erik: "Re: lighting---hacked!"
- Previous message: Matt Shelton: "Re: Q : run apache"
- In reply to: Alan W. Frame: "Re: lighting---hacked!"
- Next in thread: Simon Matthews: "Re: lighting---hacked!"
- Reply: Simon Matthews: "Re: lighting---hacked!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Tim Haynes <usenet@stirfried.vegetable.org.uk> Date: 14 May 2002 22:08:54 +0100
alan.frame@acm.org (Alan W. Frame) writes:
> Iptables is for *every* box that's connected to *anything* else.
Well said.
> > and, as I have mentioned before, you should not run a web server on
> > your firewall.
>
> True, but you should also have a firewall on your webserver - iptables
> *only* allowing new port 80 connections in, related traffic out on the
> public interface; and *only* ssh in (from specified IP addresses) on the
> private interface (if you must do remote admin rather than on the
> console)
Yes yes yes yes YES.
> > In other words, don't rely on IPCHAINS to stop a web server from being
> > hacked.
>
> You rely on ipchains/iptables to stop inappropriate packets from
> reaching network sockets.
>
> You relay on an IDS to monitor and alert you to this.
>
> You rely on tcpwrappers to stop inappropriate packets reaching
> user-space applications.
>
> You relay on your logging to monitor and alert you to this.
>
> You rely on chroot to stop inappropriate applications reaching the
> filesystem.
>
> You relay on your logging to monitor and alert you to this.
>
> You rely on LIDS to stop inappropriate actions on your filesystem.
>
> You relay on your integrity checker to monitor and alert you to this.
>
> Tim/Ian/Luke/Eirik/anyone else: Am I paranoid enough? - Is this
> FAQ'able?
FAQ! FAQ! Such a well thought-out progression is self-explanatory. Want FAQ
entry *now* please! :8)
~Tim
-- Too fast to live, |piglet@stirfried.vegetable.org.uk too young to die |http://spodzone.org.uk/ bye bye. |
- Next message: Erik: "Re: lighting---hacked!"
- Previous message: Matt Shelton: "Re: Q : run apache"
- In reply to: Alan W. Frame: "Re: lighting---hacked!"
- Next in thread: Simon Matthews: "Re: lighting---hacked!"
- Reply: Simon Matthews: "Re: lighting---hacked!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
