Re: hurd does NOT need /hurd
On Mon, May 20, 2002 at 03:48:16PM -0400, Michael Stone wrote:
> On Mon, May 20, 2002 at 01:25:31PM -0600, Joel Baker wrote:
>
> > Rule #1: attackers cannot attack what they cannot reach. Firewalls are not
> > perfect; they can be misconfigured, disabled, and in some cases (which do
> > apply to Debian), machine-based firewalls can have bugs in the firewalling
> > code which expose parts of the machine despite the firewall, or machines
> > behind the firewall. But I'll take a 99% reduction in attack vectors any
> > day of the week, thanks.
>
> For a host based firewall, the firewall is certainly less effective than
> simply not listening on any ports. You're right--attackers can't attack
> what they cannot reach (in this case, what you're not running.)
However, a firewall can help in this scenario as well. I've seen people
who have gained access to the user Apache runs as due to web applications
poorly designed. Most of then tried to spawn a shell which listened on
some random port (using netcat). Filtering closed ports will definetively
help in such cases.
(Michael: please forgive me for replying directly to you first, I hit the
wrong button, sorry.)
--
Tore Anderson
--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: