[bittorrent] BT, Nats, and hackers at the door...

Olaf van der Spek olafvdspek at gmail.com
Mon May 30 07:41:52 EDT 2005


On 5/30/05, Bill Cox <bill at viasic.com> wrote:
> On Mon, 2005-05-30 at 11:20 +0200, Olaf van der Spek wrote:
> > On 5/30/05, Bill Cox <bill at viasic.com> wrote:
> > > Hi, Olaf.
> > >
> > Why would hardware be harder to hack than software?
> 
> Dedicated hardware has software installed and tested at the factory.  We
> Linux hackers install a lot of software ourselves.  Getting it exactly
> right isn't our job (for most of us).  It is their job.  It's what they
> do.
> 
> That's why I buy LinkSys router/firewall/NATs, rather than using my
> server to do the job.  I trust Cisco's solution more than the open-
> source solution that I could install and configure myself.  Not that I'm
> worried about the open-source solution's quality, but I make too many
> mistakes to be trusted to install a firewall/router/NAT.
> 
> I might put more effort into it.  I took a quick look at SmoothWall at
> sf.net.  What stateless firewall software would you suggest?

I'd suggest a stateful firewall. But I don't have much experience with
firewalls. I use Windows XP Internet Connection Sharing and Firewall.
On my Linux servers, I have iptables but without any rules, so it's
basically without firewall.
 
> > Would that guarantee the security of your p2p app?
> 
> Not completely.  You need the kernel to get involved to properly police
> an app.  However, you could police the app's internet traffic, which is
> one of the scariest avenues for abuse.

But if you look for example at HTTP servers. Most exploits use
perfectly valid HTTP 'traffic', so what would such a traffic filter
do?

> > >  The kernel
> > > could restrict such access, and report attempted violations.
> >
> > I think SELinux does things like this.
> > Additional restrictions (and kernel-level configuration) would indeed
> > be a good thing.
> 
> Agreed.  I just did some googling, and found setfacl and getfacl in
> Linux, which seem to exist as commands, but don't yet do anything in
> Fedora Core 3.  These will give administrators the ability to assign
> various groups access to various files and directories.  That may be
> enough to secure access to the disk and devices reasonably well on a per
> application basis.  For example, BT could be a user executing the
> bittorrent application, and belong to eth0.  Then, if the ethernet
> device had an "ACL" entry like group:eth0:rw, only eth0 group processes
> could use it.  However, it seems like we're a long way off from having
> most applications install with solid user configurable restrictions.

That's more like user-based access while you need process-based access.
 
> > > It's possible that when IPv6 is well established, average mom will be
> > > buying a stateful router rather than a NAT, but I'm not so sure.
> >
> > Why not?
> > You *will* need a router to connect multiple hosts to one internet line.
> 
> The stateful part implies a more sophisticated router, and the average

Not more sophisticated than NAT.

> > > Dynamic IPs and NATs are two more levels to help protect the end-user
> > > from hackers, and I'm concerned that ISPs will keep them in place even
> > > with IPv6.
> >
> modem account gave me an IP address for two months at a time, so I doubt
> that they were trying to conserve IP addresses by only handing them out
> when needed.  I think it was dynamic only for security reasons, and so

What security? Your back door would 'only' work for two months?

> Another reason that ISPs may like dynamic IPs is that it makes it hard
> for home users to have servers.  Servers at home are probably a major

Servers at home?
Are simply compromised desktops?

> source of spam and other internet PITAs.  In fact, AOL wont accept mail
> from my mail server, because they detect that it comes from a home-based
> Bell South server (which makes my mail server close to useless).
> 
> > The reason to close all ports by default is that most apps listen on
> > all interfaces by default while they should only be listening on
> > localhost.
> 
> That's why I keep my Linux firewall on.  If I can still ssh in, I can do
> anything else once I'm logged in.

Why didn't you configure your apps to bind to localhost instead of all
interfaces?



More information about the BitTorrent mailing list