From owner-freebsd-ipfw Tue Jul 27 9:38: 3 1999 Delivered-To: freebsd-ipfw@freebsd.org Received: from apollo.backplane.com (apollo.backplane.com [209.157.86.2]) by hub.freebsd.org (Postfix) with ESMTP id 62BB314DB7; Tue, 27 Jul 1999 09:37:57 -0700 (PDT) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.3/8.9.1) id JAA54522; Tue, 27 Jul 1999 09:37:09 -0700 (PDT) (envelope-from dillon) Date: Tue, 27 Jul 1999 09:37:09 -0700 (PDT) From: Matthew Dillon Message-Id: <199907271637.JAA54522@apollo.backplane.com> To: Mike Pritchard Cc: green@FreeBSD.ORG (Brian F. Feldman), jgreco@ns.sol.net (Joe Greco), hackers@FreeBSD.ORG, freebsd-ipfw@FreeBSD.ORG Subject: Re: securelevel and ipfw zero References: <199907271151.GAA02583@mpp.pro-ns.net> Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG :But it might be hiding a real security threat/attack or a real breakin. :Say I've spent all night trying to hack into your machine and finally get in. :If I can reset all of ipfw's counters back to zero, and this is :something your security checking scripts are checking, you might not :think that anyone has even been trying to break into your machine, much :less made it into the machine. If I have some inside information, :I could probably even get the counters back into the range where you :might expect them to be at. : :Hopefully if this were to happen, you might see some other console/syslog :messages or something else that catches your eye, but then again, :maybe not. : :Just to help out people running at higher security levels, you could :always implement something that lets you reset the values to some :... :Mike Pritchard I find this scenario highly unlikely. I can think of a thousand things. Well, a dozen anyway, that said hacker could do to the machine that are far more serious then clearing ipfw counters. And for that reason, I don't really consider it a realistic scenario. The hacker isn't going to give a damn about the ipfw counters. -Matt Matthew Dillon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message