Date: Sun, 30 Nov 2003 16:49:52 +0100 From: Roman Neuhauser <neuhauser@bellavista.cz> To: freebsd-questions@freebsd.org Subject: Re: adaptive stealth in ipfw? Message-ID: <20031130154952.GE3867@freepuppy.bellavista.cz> In-Reply-To: <20031128175832.GB44168@keyslapper.org> References: <20031128165951.GA44168@keyslapper.org> <86brqws9jn.fsf@borg.borderworlds.dk> <20031128175832.GB44168@keyslapper.org>
next in thread | previous in thread | raw e-mail | index | archive | help
# freebsd@keyslapper.org / 2003-11-28 12:58:33 -0500: > On 11/28/03 06:11 PM, Christian Laursen sat at the `puter and typed: > > Louis LeBlanc <freebsd@keyslapper.org> writes: > > > > > I was introduced to a fantastic web site, http://www.grc.com/ which > > > has some impressive information about security and a number of other > > > things. Steve Gibsons 'Shields Up' web service will scan your system > > > and tell you where your vulnerabilities lie, and explain the ports in > > > pretty good detail. > > > > http://www.grcsucks.com/ > > Hmm. Interesting site. I'm sure I'll find some interesting stuff > there too, but it looks like the person running the site has no > greater pupose in life than character assassination. Not that he's > altogether wrong. I'd have to read more and decide myself what I > really think. I'm no security expert - I'm only going on what I *do* > know (or think I know), so I'd just as soon not get into a flame war > over who the idiot really is - I haven't much defense for myself in > the security arena :). > > Still, if anyone *does* know the facts, I'd like to know what the case > really is with the IDENT port and adaptive stealth. don't get carried away by the nonsense at grc.com. the marketroid-speak term "adaptive stealth" can be normally described as stateful filtering (and dropping the packets instead of rejecting them), and it means that (in case of TCP), the target machine throws away packets that: * don't have the SYN bit set (and the ACK bit unset) * are not part of an established "conversation" you can completely "stealth" a machine if it runs no publically available servers. the problem with ident is similar to FTP: the first connection goes from you out, the other party then tries to connect to you (as far as the stack is concerned, this is a completely unrelated connection). but, the question is: what is your problem? why do you need to have identd(8) running? will anything you need break without it? if not, the correct solution to your problem is IMO to *reject* connection attempts to your port 113. -- If you cc me or remove the list(s) completely I'll most likely ignore your message. see http://www.eyrie.org./~eagle/faqs/questions.html
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031130154952.GE3867>