Re: netbase 3.16-10 and TCP SYN cookies being enabled by default
On Sat, 12 Feb 2000, David Starner wrote:
> On Sat, Feb 12, 2000 at 11:29:03AM -0200, Henrique M Holschuh wrote:
> > The new netbase package (3.16-10) enables syncookies by default if they're
> > compiled in the kernel. No warnings, and the only documentation for this is
> > in the changelog.Debian file...
>
> Maybe I don't understand here. If you enable syncookies in the kernel,
> why would not want to use them? Or are they compiled into the default
> kernels?
Well, I compile them into the kernel so that I can enable during a SYN
attack, and disable them otherwise... And as I said, *AFAIK* syncookies are
like very strong medicine: you hope it kills the illness before either (the
medicine or the illness) kills you.
It's a good thing to have compiled into the kernel (so that you can readly
enable it if needed, maybe even use automated tools to enable it), but I
certainly don't need it enabled all the time.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: