From owner-freebsd-security Tue Jan 30 1:28:55 2001 Delivered-To: freebsd-security@freebsd.org Received: from sonar.noops.org (adsl-63-195-97-84.dsl.snfc21.pacbell.net [63.195.97.84]) by hub.freebsd.org (Postfix) with ESMTP id 94C7237B6A3 for ; Tue, 30 Jan 2001 01:26:40 -0800 (PST) Received: from localhost (root@localhost) by sonar.noops.org (8.9.3/8.9.3) with ESMTP id BAA39146; Tue, 30 Jan 2001 01:26:46 -0800 (PST) (envelope-from root@noops.org) Date: Tue, 30 Jan 2001 01:26:46 -0800 (PST) From: Thomas Cannon To: Kris Kennaway Cc: FBSDSecure@aol.com, freebsd-security@FreeBSD.ORG Subject: Re: (no subject) In-Reply-To: <20010130011533.A43910@xor.obsecurity.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > > critical IPs are placed in the ignore file. The DNS and email > > servers I did not consider, but they will be added. Thanks for the > > tip. > > "It's too difficult", etc. Firewall policy has a simple rule: Deny all not allowed When setting up something that will auto-ban hosts or networks, you need the opposite of the firewall rule -- namely, to allow tings you don't want banned. Surely you can see where I'm going. It's an obvious conclusion, I'd think. It might be okay for a desktop machine, but nothing more advanced.... Lest I sound like I'm picking on some vendor/writer of code... logcheck rocks. -tcannon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message