Baslinux mailing list

[Karolis Lyvens <karolisl AT gmail.com>]

On Sun, Jan 28, 2007 at 02:35:06PM +0000, Lee Forrest wrote:
-snip-
> Which my box responded to in kind: Going to have to do something
> about that. I've installed ipchains from SW4.0 and rebuilt my
> 2.4.31 kernel to include the NETFILTER code (it was IP_FILTER
> when 4.0 was current), but don't know whether ipchains and
> netfilter are compatible yet.

Ipchains and netfilter are compatible;

Netfilter handles the actual firewall. It has three frontends (AFAIK, depends
which one it was compiled with/insmodded): ipfwadm (resembling 2.0
kernel), ipchains (resembling 2.2), iptables (kind-of-compatible to
ipchains, appeared in 2.4).

I am not sure how to use ipchains with netfilter, but a quick search
revealed this:

http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-4.html

> > On nmap, if you use "-P0", ie, omit ping test, you'll get ALL
> > ports "filtered", although the host isn't even up.
> 
> Doesn't look like they were pinging  me. That's ICMP, is it not?

ICMP echo request / ICMP type 8

> > These "filtered" ports tend to confuse this mailing list :)
> 
> Worked with me! :-)
> 
> Unless, of course, you are wrong, and they were scanning simple.net AKA
> 1dial.com AKA IPSWITCH INC.

I doubt that, but... As i said, it might be scanning your ISP's router
if you're behind it. But my results seem to be correct (In this excerpt,
I masked my IP by converting decimal numbers to hexadecimal... An easy
measure, but it may be effective against unauthorized people or web
spidering/searching):

-----
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Machine 52.87.A2.69 MIGHT actually be listening on probe port 80
Host (52.87.A2.69) appears to be up ... good.
Initiating Connect() Scan against (52.87.A2.69)
Adding open port 80/tcp
Adding open port 22/tcp
The Connect() Scan took 242 seconds to scan 1024 ports.
Interesting ports on (52.87.A2.69):
(The 1022 ports scanned but not shown below are in state: filtered)
Port State Service
22/tcp open ssh
80/tcp open http

Nmap run completed -- 1 IP address (1 host up) scanned in 243 seconds
-----

As you can see, on my box all but two ports are filtered. Ie, they're
unused and port scanner doesn't get a reply from them. Only ports that
matter are "open" ones.

> That's what they _say_. Anyone can _say_ anything. I don't trust
> the security freaks. They see crackers under every inode. And
> like the get-in-your-face spam haters, they often turn out to be
> the very thing they claim to be fighting.

Heh, true. In fact, whole computer security theory and practice is
founded on paranoia.

But, if you want to fight crackers, then knowing ways of
entry/flaws/security holes is appropriate and useful in this task:
"Know your enemy". You cannot effectively fight them without knowing
how do they work.

But when you get a grasp over these concepts, these security-related
things become not-so-hard.

Karolis