Re: Linux Firewall

On Tue, 23 May 2006 14:47:04 +0100, Mark wrote:

Hi all,

I run a stand-alone Linux workstation connected to broadband via a
nat-enabled router.

Does the following firewall script make sense to you guys(it seems to
work)? Any suggestions and comments would be much appreciated.

Also, I have only recently migrated to Linux (Suse) from M$ XP Pro. In
XP I could see and stop unnecessary services and I would like to do the
same in Suse. Which services are considered a potential security risk in
Linux/ Suse and how can they be stopped?

Regards,

Mark


Hello Mark,

I'm not an iptables expert so I have no opinion there. I use Guarddog to
write a script for me. You tell it what services you want to access from
the outside world (http, https, pop, smtp, usenet) and what services you
want to offer to the outside world (none) and it writes the script for
you. (Yes, I know real men write their own iptables scripts).

I think the correct answer about what services to run is *none*. Shut
them off by making their startup scripts non executable. You should
really disconnect the internet connection until you get this accomplished.

use this command to see if you have anything listening:

netstat -taun [enter]

if you see the word "listen" you have a risk factor, which may be
exploitable depending on the existence of weaknesses in the software that
is doing the listening. It is best if you don't see the word "listen" at
all.

hth.

John






.

Relevant Pages

  • Re: assigning multiple ip addresses to NIC on bootupm, how?
    ... rc.local is the last script run and ... he doesnt need the logical interfaces active before httpd runs ... "Listen" options in httpd.conf - which means that Apache is listening on ... [root@tregonwell root]# ifconfig eth0:1 192.168.0.140 ...
    (Fedora)
  • Re: Britishisms
    ... That is, I'm listening to each series in the normal order, but ... series by series in reverse order, ... Graeme Garden wanted to get paid for a radio programme without all that tedious script writing which took weeks of effort. ... Do you want a copy of the Christmas 2007 special, "Humph in Wonderland"? ...
    (alt.usage.english)
  • Re: openldap slapd startup delay
    ... and it's listening on hosts that are name-resolvable via ... a script, it starts straight away. ...
    (freebsd-current)
  • Re: SSH Tunneling of X protocol from non-interactive session
    ... > Mihai Osian wrote: ... you have to prepare script on ... It should be listening. ... I can go to another machine, point display to M:0.0 and open a terminal. ...
    (comp.os.linux.x)
  • Re: SSH Tunneling of X protocol from non-interactive session
    ... > Mihai Osian wrote: ... you have to prepare script on ... It should be listening. ... I can go to another machine, point display to M:0.0 and open a terminal. ...
    (comp.os.linux.misc)