Date: Sun, 25 Mar 2001 19:55:32 -0500 (EST) From: Jim Freeze <jim@freeze.org> To: <cjclark@alum.mit.edu> Cc: "Andrew C. Hornback" <hornback@wireco.net>, FreeBSD Questions <questions@FreeBSD.ORG> Subject: Re: Meaging of Security Check? Message-ID: <Pine.BSF.4.32.0103251837560.44160-100000@www.stelesys.com> In-Reply-To: <20010325151642.C5425@rfx-216-196-73-168.users.reflex>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 25 Mar 2001, Crist J. Clark wrote:
> On Sat, Mar 24, 2001 at 11:43:32AM -0500, Andrew C. Hornback wrote:
> > > -----Original Message-----
> > > From: owner-freebsd-questions@FreeBSD.ORG
> > > [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Jim Freeze
> > > Sent: Saturday, March 24, 2001 7:50 AM
> > > To: questions@freebsd.org
> > > Subject: Meaging of Security Check?
> > >
> > >
> > > Hi:
> > >
> > > I received the following security check and was wondering what it means:
> > >
> > > eeyore1 security check output
> > >
> > > eeyore1 kernel log messages:
> > > > x3f8-0x3ff irq 4 flags 0x10 on isa
> > > > ipfw: 40 Accept TCP 157.95.47.65:776 24.9.218.175:22 in via vx0
> > > > ipfw: 65000 Deny UDP 24.9.218.175:68 24.2.7.70:67 out via vx0
> > > > ipfw: 65000 Deny UDP 24.9.218.175:68 24.2.7.70:67 out via vx0
> > > > ...where the above is repeated for about 100 lines
> > >
> > > I looked up port 67 in /etc/services and it says:
> > >
> > > bootps 67/tcp dhcps #Bootstrap Protocol Server
> > > bootps 67/udp dhcps #Bootstrap Protocol Server
> > >
> > > nslookup says:
> > >
> > > % nslookup 24.2.7.70
> > > Server: proxy1.lxintn1.ky.home.com
> > > Address: 24.5.116.15
> > >
> > > Name: lh1.rdc1.tn.home.com
> > > Address: 24.2.7.70
> > >
> > > Can someone explain what is happening here?
> >
> > To my (semi)trained eye... you're subject to a new form of a DoS attack.
>
> [snip]
>
> Guys, guys. You're hurting me.
>
> It looks like Jim has broken his own DHCP setup. 24.9.218.175 looks
> like the address of the machine generating these logs, correct? It is
> blocking its own outgoing packets to lh1.rdc1.tn.home.com which is
> your DHCP server, right?
Hmmm.. My dns machines are 24.5.116.15 and 24.5.116.17. My ip has not
changed (thankfully) and is still 24.9.218.175.
My firewall is basic 'simple' with additions as given at mostgraveconcern.
>
> Your machine is trying to renew its lease. You probably want to pass
> that traffic.
What would the ipfw rule look like?
${fwcmd} add pass udp from any to ${dns1} 67
${fwcmd} add pass udp from any to ${dns2} 67
=========================================================
Jim Freeze
jim@freeze.org
---------------------------------------------------------
No comment at this time.
http://www.freeze.org
=========================================================
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.32.0103251837560.44160-100000>