Date: Tue, 25 Aug 2009 15:04:08 +0000 From: Paul Schmehl <pschmehl_lists@tx.rr.com> To: Colin Brace <cb@lim.nl>, freebsd-questions@freebsd.org Subject: Re: what www perl script is running? Message-ID: <E668BECE594402B585544841@utd65257.utdallas.edu> In-Reply-To: <25134277.post@talk.nabble.com> References: <4A924601.3000507@lim.nl> <200908240807.n7O87o3U092052@banyan.cs.ait.ac.th> <200908241026.55693.j.mckeown@ru.ac.za> <25130058.post@talk.nabble.com> <20090825091937.GA53416@cheddar.urgle.com> <25131646.post@talk.nabble.com> <200908251027.n7PARZBt009994@banyan.cs.ait.ac.th> <25132123.post@talk.nabble.com> <20090825082604.41cad357.wmoran@potentialtech.com> <25134277.post@talk.nabble.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--On Tuesday, August 25, 2009 08:30:17 -0500 Colin Brace <cb@lim.nl> wrote: > > > Bill, one more thing: > > > Bill Moran wrote: >> >> You can add an ipfw rule to prevent the script from calling home, which >> will effectively render it neutered until you can track down and actually >> _fix_ the problem. > > Mike Bristow above wrote: "The script is talking to 94.102.51.57 on port > 7000". OK, so I how do I know what port the script is using for outgoing > traffic on MY box? 7000 is the remote host port, right? > > FWIW, here are my core PF lines: > > pass out quick on $ext_if proto 41 > pass out quick on gif0 inet6 > pass in quick on gif0 inet6 proto icmp6 > block in log > > That is to say: nothing is allowed in unless explicitly allowed > Everything allowed out. > (plus some ipv6 stuff I was testing with a tunnel) > The problem with blocking outbound ports is that it breaks things in odd ways. For example, your mail server listens on port 25 (and possibly 465 as well) but it communicates with connecting clients on whatever ethereal port the client decided to use. If the port the client selects happens to be in a range that you are blocking, communication will be impossible and the client will report that your mail server is non-responsive. It's much easier to block outgoing ports for services you *don't* want to offer, but, if the service isn't running anyway, blocking the port is non-productive. -- Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E668BECE594402B585544841>