Re: Follow-up on Adaptive Firewalling w/Swatch

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 17 Aug 2006 12:34:51 -0400, "Amadeus W. M."
<amadeus84@xxxxxxxxxxxxxx> opined:
> On Thu, 17 Aug 2006 11:13:32 -0400, David Cary Hart wrote:
> 
> 
> And your point is?

I just wanted to provide a configuration example because a number of
people have had some difficulty in configuring or running swatch.
> 
> I'm not saying dynamic firewalls do not do their jobs. Of course
> they do. 
> 
> I'm saying that you have to be careful with them, because they 
> can do more than intended. 
> 
Indeed. A few years ago, I managed to lock myself out of a local
server. Since I now have no physical access to the machine (it's a
hosted dedicated server) I have to be excruciatingly careful. 

> Let alone the fact, that by inserting a firewall rule each time
> someone knocks on your door, you'll end up with a mile long
> firewall. Do you think that list will ever be long enough?

Well, I am not adding IPs gratuitously. This was the result of a
widely distributed virus. It has a unique request "signature" in the
logs so the firewalling yields NO false positives. Yes, the list is
long. As soon as I secure some CGI, I can safely remove these IPs.
> 
> The better way is to build a minimal firewall that drops 
> EVERYTHING by default, then punch holes in it ONLY for the
> machines/domains that are supposed to connect to your host.
> (Although even this policy is not fool proof: any of the legit
> clients could be compromised).
> 
I must provide wide web access to service blacklist removal requests.
Everything is a compromise.

That said, I DID manage to saw off the limb I was standing on by
over-tweaking the firewall this morning. For an hour or so NOBODY
could connect to the web server. Oh what a nitwit I can be when I
try real hard -;)

-- 
      Do NOT Send Email to <spam trap> Fedora@TQMcube,com
Our DNSRBL - Eliminate Spam at The Source: http://www.TQMcube.com
               Don't Subsidize Criminals: http://boulderpledge.org


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux