From owner-freebsd-net@FreeBSD.ORG Sun Oct 5 20:22:30 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 95AEEC76 for ; Sun, 5 Oct 2014 20:22:30 +0000 (UTC) Received: from mail-wg0-f46.google.com (mail-wg0-f46.google.com [74.125.82.46]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 241FF668 for ; Sun, 5 Oct 2014 20:22:29 +0000 (UTC) Received: by mail-wg0-f46.google.com with SMTP id l18so5094128wgh.5 for ; Sun, 05 Oct 2014 13:22:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=CuYTVZCEY3nuAypXPh48UTpdngNh3a/NuY+IXOhhb8s=; b=BPjsU/m51osu6YkMhUwxgjthd0FYnV8kqdopiFdtj85ziV4iolEKjbZGuq4btT2lD/ 0UNt/A6s2J7DUeZao1cEqdiG8xOB3KYoURy25OkNOwJLcYMu1ENXhimfkLfYFV/vRa3F Y4dhZv6bB87X9WvymTFwb4CuPnGKHw4YD6yZw3Eve40qwqF7O040nLIyyn2oyOvDqWSL 6CU3+4d3mzrxYTbgSRE++eZI3fz9f7XINo4sDpGbEbimXVRQLROmkibvaU/WsoiVQkE8 OQIBAqsJ9FzXBU/wwGIHaYVSOXb/hAsEgO6Cj6WnpXuYcCIgiqcN4TSE4RhI/rxcpNL5 TJtg== X-Gm-Message-State: ALoCoQmNIdi36Y6Q4GjdZEt7NG0Ye/6DvqbBlqnquKIabpsh7BiFbEMfIY1wD/zSKYwJbvwwBMcL MIME-Version: 1.0 X-Received: by 10.180.76.37 with SMTP id h5mr14766054wiw.22.1412540542072; Sun, 05 Oct 2014 13:22:22 -0700 (PDT) Received: by 10.27.94.16 with HTTP; Sun, 5 Oct 2014 13:22:22 -0700 (PDT) In-Reply-To: References: Date: Sun, 5 Oct 2014 16:22:22 -0400 Message-ID: Subject: Re: remote host accepts loose source routed IP packets From: el kalin To: Brandon Vincent , Colin Percival Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: freebsd-net , freebsd-users@freebsd.org, freebsd-security@freebsd.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Oct 2014 20:22:30 -0000 hmmm=E2=80=A6 could it be openvas?! just installed netbsd 6.1.4 aim i found on the aws community aims list=E2= =80=A6 same thing.. just the possibility of both openvas and the hackarguardian service being both wrong is a bit too much of a coincidence for me=E2=80=A6 any thoughts? On Sun, Oct 5, 2014 at 3:21 PM, el kalin wrote: > ok.. this is getting a bit ridiculous=E2=80=A6 > > just did a brand new install of the freebsd 9.3 aim on amazon=E2=80=A6 > > with nothing installed on it and only ssh open i get the same result when > scanning with openvas: > > "Summary: > The remote host accepts loose source routed IP packets. > The feature was designed for testing purpose. > An attacker may use it to circumvent poorly designed IP filtering > and exploit another flaw. However, it is not dangerous by itself. > Solution: > drop source routed packets on this host or on other ingress > routers or firewalls.' > > and by default: > # sysctl -a | grep accept_sourceroute > net.inet.ip.accept_sourceroute: 0 > > thing is the other machine - the bsd 10 - was scanned with the sameopen > vas setup and with a service called hackerguardian offered by a compony > called comodo. they sell that service as a pci compliance scan. both > machines are non compliant according to both the openvas scan and the > hackerguardian one=E2=80=A6 > > i can't be done with this job if i can't pass the pci scan=E2=80=A6 > > i'd appreciate any help=E2=80=A6 > > thanks... > > > now what? > > > > > > > On Sun, Oct 5, 2014 at 1:09 PM, el kalin wrote: > >> thanks brandon=E2=80=A6 but that didn't help=E2=80=A6. >> >> i still get the same result=E2=80=A6 >> >> i guess i'd report this as a bug=E2=80=A6 >> >> >> On Sun, Oct 5, 2014 at 11:58 AM, Brandon Vincent > > wrote: >> >>> On Sun, Oct 5, 2014 at 8:33 AM, el kalin wrote: >>> > should is submit this as a bug? >>> >>> Can you first try adding "set block-policy return" to pf.conf? OpenVAS >>> might be assuming that a lack of response from your system to source >>> routed packets is an acknowledgement that it is accepting them. >>> >>> Brandon Vincent >>> >> >> >