[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Ports to block?


It's better to do it this way:

ipchains -P input DENY

ipchains -A input -s (source add./port) -d (dest. add./port) -j ACCEPT

. . . (acceptance rules)

ipchains -A input -j DENY -l (logs all stuff not ACCEPTed above).
I also put other DENY statements on top of the last logging DENY for things I don't care to log. The syslog will fill up rapidly with insignificant crap if you don't (I had my colo fill /var with sputter from a misconfigured router once).
The reason you start out with a DENY is so that there is no chance of a packet coming through before all of the chains are parsed. Also a good idea is to build the chains before bringing up the interface(s). 

Haphazard security is marginally second to no security at all.

At 12:09 AM 4/6/2001 +0200, Cherubini Enrico wrote:

Ciao,
 Thu, Apr 05, 2001 at 09:38:46PM +0100, Steve Ball wrote:

> It is most secure to block everything and only open the ports that are
> absolutely necessary.
ok, this is clear. What's the way you ppl do that throught ipchains/iptables
? Is it better to use the ACCEPT policy and then DENY all or use the DENY
policy and ACCEPT only ports needed ? I use the first 'cause so I can log
all packet that are denied...

# Start
ipchains -P input ACCEPT
....
ipchains -A input -j DENY -l
# End

--


Bye
                            +--------+ Maybe you are searching for freedom
                            | Enrico |    Maybe you can't find it anywhere
                            +--------+          I found it in linux.......
``I think he has a Napoleonic concept of himself and his company, an arrogance 
    that derives from power and unalloyed success, with no leavening hard
 experience, no reverses,'' Judge Thomas Penfield Jackson says of Bill Gates.


--
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


--
Eric N. Valor
Webmeister/Inetservices
Lutris Technologies
eric.valor@lutris.com

- This Space Intentionally Left Blank -
Reply to: