Re: IT Survival on Linux.

From: Nils Petter Vaskinn (no_at_spam.for.me.invalid)
Date: 03/10/04

  • Next message: Nils Petter Vaskinn: "[OT] 42 (was: Re: What is the best Linux flavor out right now)" 
    Date: Wed, 10 Mar 2004 07:32:21 GMT

    On Tue, 09 Mar 2004 19:34:55 +0000, Sybren Stuvel wrote:

    > 1) Only run the services you need to run. 2) Firewall all incoming
    > connections instead of those you approve. 3) Update your distribution
    > regularly. 4) Get a brain.

    Don't install anything from z0m3.1337.cr4k3r.zi73.com or any other
    untrusted source. But that may be a part of point 4

    > Generally, people should be able to live without a firewall. A regular
    > box doesn't need to run any services, and thus have no open listening
    > ports anyway. Viruses aren't of any issue either.

    How is this from a performance viewpoint? The internet is full of junk
    traffic that may affect your machine (especially when the MS worm de jour
    is wreaking havoc). How much overhead does an iptables "this is from the
    outside, drop it" rule have compared to processing the package and looking
    for listening ports?

    Anyway I don't think a firewall can hurt, its kind of the same thing that
    most people don't _need_ an airbag in their car, but once you suddenly do
    it's too late to get one and having one would be _really_ nice.

    Making a program that listens on a port is easy (anything I have ever done
    is by definition easy :D ). Easier than knowing when it's appropriate to
    use "local" sockets. So we could assume that there are a lot of programs
    out there that listen on some port without needing to, and since it's not
    obvious to the user (since that program doesn't use the internet) that
    it's listening the user may not take precautions.

    Those users with linux machines are frequently past the one single machine
    stage. And may want to run some services between the machines (such as
    nfs, samba, ssh, nis).

    When it comes to firewalling for home users (that doesn't want to mess
    with iptables, forwarding and NAT) is to buy one of those combined
    router/fw thingies. The firewalls are "primitive" but putting one of these
    at the network border gives you NAT and blocking of all incoming
    connections without any work. 

    -- 
NPV
"the large print giveth, and the small print taketh away"
                                Tom Waits - Step right up
  • Next message: Nils Petter Vaskinn: "[OT] 42 (was: Re: What is the best Linux flavor out right now)"

    Relevant Pages

    • Re: Port 135
      ... The patch doesn't disable DCOM / RPC, so connections can still be made. ... That's why you need a firewall. ... the patch is not the thing to control ... control over your TCP/IP ports and services, ...
      (microsoft.public.security)
    • Re: Got Active Ports, now what?
      ... have services running and ports open does not in ANY way shape or form mean ... vulnerabilities and links to plenty of other ... Why do I need 23 connections to the ... > You should get a 'Application' Filtering Firewall for your XP box. ...
      (comp.security.firewalls)
    • Re: File sharing
      ... Instead of creating exceptions for individual ports for FPS I suggest that you try Group Policy and configuring the exemption for file and print sharing and probably the remote administration exemption. ... If there are do domain level Group Policies being applied to these computers currently for Windows Firewall, which you could verify by running rsop.msc on the client computer, you could try using local Group Policy to see if it does what you want. ... So then I went back and put in a custom setting to accept connections on the local subnet plus connections from my subnet, ...
      (microsoft.public.windowsxp.security_admin)
    • Re: On passwords, securtiy and real -sweat, blook and tears- life
      ... given that all ports are closed to external contact through a physical allbeit consumer oriented firewall, just means I am safe for port-scanners. ... connections reduces the risk a lot. ... you can boot in single user mode and change the password. ...
      (Fedora)
    • Re: Open Ports on a hardware firewall
      ... If you have the ports open, e.g. people are allowed to initiate connections ... isn't about detecting queso, but more about tracking past data ... you're telling the firewall that every incoming packet ...
      (comp.security.misc)