From owner-freebsd-questions@FreeBSD.ORG Thu Nov 30 19:11:07 2006 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 64E8416A47B for ; Thu, 30 Nov 2006 19:11:07 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from smtpout.mac.com (smtpout.mac.com [17.250.248.181]) by mx1.FreeBSD.org (Postfix) with ESMTP id D691043CBE for ; Thu, 30 Nov 2006 19:10:48 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from mac.com (smtpin05-en2 [10.13.10.150]) by smtpout.mac.com (Xserve/8.12.11/smtpout11/MantshX 4.0) with ESMTP id kAUJAvO1012283; Thu, 30 Nov 2006 11:10:57 -0800 (PST) Received: from [17.214.13.96] (a17-214-13-96.apple.com [17.214.13.96]) (authenticated bits=0) by mac.com (Xserve/smtpin05/MantshX 4.0) with ESMTP id kAUJAsiJ002581; Thu, 30 Nov 2006 11:10:56 -0800 (PST) In-Reply-To: <365084.23607.qm@web37213.mail.mud.yahoo.com> References: <365084.23607.qm@web37213.mail.mud.yahoo.com> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Chuck Swiger Date: Thu, 30 Nov 2006 11:10:54 -0800 To: Wasp King X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAA== X-Brightmail-scanned: yes Cc: questions@freebsd.org Subject: Re: stop a freebsd server from responding to pinging? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Nov 2006 19:11:07 -0000 On Nov 30, 2006, at 10:55 AM, Wasp King wrote: > 1. How do I stop others from port scanning a server? Marcus Ranum suggests using wirecutters on the ethernet cable. If the server is internet-reachable, then it can be port-scanned. Less drastic measures than removing it from the network entirely would including configuring a firewall to block all ports except those absolutely required for the necessary functions which the machine needs to perform, and "hardening" the OS to reduce the potential exposure. > 2. is stopping the response to pinging enough? No. > 3. how to do I stop the server from responding to pinging? Use a firewall like ipfw or ipf to block ICMP traffic types 0 & 8: ipfw add 1 deny icmp from any to any icmptype 0,8 -- -Chuck