Date: Mon, 14 Jul 2003 23:15:18 +0200 From: Pawel Jakub Dawidek <nick@garage.freebsd.pl> To: "V. Jones" <vjones62@earthlink.net> Cc: freebsd-security@freebsd.org Subject: Re: Re: jails, ipfilter & stunnel Message-ID: <20030714211518.GD4973@garage.freebsd.pl> In-Reply-To: <8213881.1058211676830.JavaMail.nobody@beaker.psp.pas.earthlink.net> References: <8213881.1058211676830.JavaMail.nobody@beaker.psp.pas.earthlink.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Mon, Jul 14, 2003 at 12:39:50PM -0400, V. Jones wrote: +> >You can check my patch for multiple ips in jails which also fix +> >sockets ordering behaviour. +> +> > For FreeBSD 4.x: +> > http://garage.freebsd.pl/mijail.tbz +> > http://garage.freebsd.pl/mijail.README +> > For FreeBSD 5.1-CURRENT: +> > http://garage.freebsd.pl/mijail5.tbz +> > http://garage.freebsd.pl/mijail5.README +> > http://garage.freebsd.pl/patches/mijail5.patch +> +> I have a feeling you're trying to tell me something important +> but I'm not understanding. Is this a problem only with ssh or +> with any server listening on a port? Does this problem occur +> when you share an ip address between two jailed servers or does +> it happen any time you use a jail? Would having ssh on a +> different port on each jail avoid the problem? No, because an attacker is able to spoof your daemons from main host or other jails. Even if you're binded to a valid IP (not INADDR_ANY) there could be always a chance to DoS existing daemon and reuse its port. My advice is simple: every jail and main host should have its own IP address. -- Pawel Jakub Dawidek pawel@dawidek.net UNIX Systems Programmer/Administrator http://garage.freebsd.pl Am I Evil? Yes, I Am! http://cerber.sourceforge.net [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iQCVAwUBPxMdZj/PhmMH/Mf1AQE4EQP9H1Q1ylhKJ+lPi8S7kZcI9jE1jK8Hneb0 4+MsrM/QEV0oKTnITtSqPwTGAJZsZrqDyWyeUAiErUeVJ8/m+KmfmCKvPq0c/B+T w/aEs2lLIA/jfZJfHbLr5vbD5RDTMV5jpkDdq4TDCJLYAlOs21OgEmpuyKocihtE WvAunBmJ3pY= =V02Q -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030714211518.GD4973>