Cristiano Soares wrote:
Hi All. Im desperate to get my network back working fine. Here is my situation.
I have a FC2 server that has two NICs. The first one is connect to my ADSL router, and the other one is connected to a network that receive IPs from that server through DHCPD service, and then the FC2 do the firewall/masquerade. All the 30 machines can browse nice until 2 or maybe more machines that has virus/worms get online. Ive seeing that W32.MsBlast is the cause of most of these link down problems, but now, it looks to be more than just w32.msblast. My queston is: IS THAT POSSIBLE TO INSTALL A SOFTWARE OR SOMETHING LIKE THAT IN THE FC2 SERVER TO PREVENT OR AT LEAST TO DETECT (by IP number) THE MACHINES THAT HAS THE VIRUS, SO IT DOENST KILL MY CONNECTION. Thanks in advance.
Cristiano
Besides removing the virus , the only things you can do are:
1 - installing a AV software on all windows machines and keep it updated.
2 - install all the updates.
3 - block every unwanted incoming connection on your firewall. Only open the necessary ports.
I do only #3 here (using a linksys cable router) and never had problems with worms like Blaster (which spreads through network shares and a few other ways). If you block all the unnecessary incoming trafic , you'll be almost safe. Just ensure that your users never have unnecessary privileges on the windows machines (never give poweruser or admin privileges , unless they really need it and revoke them as soon as the need finishes) , that they dont close the AV (kinda tricky.. dont know if this can be done) and teach them to use a mail client that isnt vulnerable to all those worms (which means , goodbye Outlook and Outlook Express).
-- Pedro Macedo
