Baslinux mailing list

[Lee Forrest <lforrestster AT gmail.com>]

On Mon, Jan 29, 2007 at 06:51:58PM +0200, Karolis Lyvens wrote:
> On Sun, Jan 28, 2007 at 02:35:06PM +0000, Lee Forrest wrote:
> -snip-
> > Which my box responded to in kind: Going to have to do something
> > about that. I've installed ipchains from SW4.0 and rebuilt my
> > 2.4.31 kernel to include the NETFILTER code (it was IP_FILTER
> > when 4.0 was current), but don't know whether ipchains and
> > netfilter are compatible yet.
> 
> Ipchains and netfilter are compatible;
> 
> Netfilter handles the actual firewall. It has three frontends (AFAIK, 
> depends
> which one it was compiled with/insmodded): ipfwadm (resembling 2.0
> kernel), ipchains (resembling 2.2), iptables (kind-of-compatible to
> ipchains, appeared in 2.4).
> 
> I am not sure how to use ipchains with netfilter, but a quick search
> revealed this:
> 
> http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-4.html

Many thanks.

[delete]
> > > These "filtered" ports tend to confuse this mailing list :)
> > 
> > Worked with me! :-)
> > 
> > Unless, of course, you are wrong, and they were scanning simple.net AKA
> > 1dial.com AKA IPSWITCH INC.
> 
> I doubt that,

For good reason. I went over the tcpdump save-file carefully, and
my box was indeed responding from each of those ports.

>  but... As i said, it might be scanning your ISP's router
> if you're behind it.

Apparently I am not.

> But my results seem to be correct (In this excerpt,
> I masked my IP by converting decimal numbers to hexadecimal... An easy
> measure, but it may be effective against unauthorized people or web
> spidering/searching):
> 
> -----
> Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
> Machine 52.87.A2.69 MIGHT actually be listening on probe port 80
> Host (52.87.A2.69) appears to be up ... good.
> Initiating Connect() Scan against (52.87.A2.69)
> Adding open port 80/tcp
> Adding open port 22/tcp
> The Connect() Scan took 242 seconds to scan 1024 ports.
> Interesting ports on (52.87.A2.69):
> (The 1022 ports scanned but not shown below are in state: filtered)
> Port State Service
> 22/tcp open ssh
> 80/tcp open http
> 
> Nmap run completed -- 1 IP address (1 host up) scanned in 243 seconds
> -----
> 
> As you can see, on my box all but two ports are filtered. Ie, they're
> unused and port scanner doesn't get a reply from them. Only ports that
> matter are "open" ones.

Never-the-less, I don't want my box responding to external probes. I'll
find a way to stop that.

> > That's what they _say_. Anyone can _say_ anything. I don't trust
> > the security freaks. They see crackers under every inode. And
> > like the get-in-your-face spam haters, they often turn out to be
> > the very thing they claim to be fighting.
> 
> Heh, true. In fact, whole computer security theory and practice is
> founded on paranoia.

Big time.

> But, if you want to fight crackers, then knowing ways of
> entry/flaws/security holes is appropriate and useful in this task:
> "Know your enemy". You cannot effectively fight them without knowing
> how do they work.

Within reason: You don't have to learn how to fight with swords to
learn to block the doors that would let the swordsmen in....

> But when you get a grasp over these concepts, these security-related
> things become not-so-hard.

Good to hear,

Lee

-- 
BasicLinux: Small is Beautiful
http://www.basiclinux.com.ru