April 2004 - WLUG - wlug.mailman3.com

RE: [Wlug] Verizon DSL on SuSE

by Martin, Eric

I have 0 visible services, but I still don't want people doing port scans. Why pose a target when I don't have to. There is no reason why anybody should be pinging my house. Therefore, I don't let them. Why would I enable anything to let people see me? Stardard security practice: Only allow what is *needed*, and I don't *need* anybody pinging me. If I do, I'll turn it on. Eric -----Original Message----- From: Josh Huber [mailto:huber@alum.wpi.edu] Sent: Friday, April 09, 2004 10:50 AM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] Verizon DSL on SuSE "Martin, Eric" <MartinE(a)worc.k12.ma.us> writes: > I personally have my firewall configured to drop pings. If they don't > know you're there, you aren't a target. Granted it doesn't keep > seasoned hackers off your box, but it's one more piece of security. I don't buy that argument. Two situations: 1) You have no other internet-visible services: * What's the harm in allowing icmp echo? Who cares, unless there happens to be some vulnerable ICMP code in the kernel. I suppose that's a risk I'd be willing to take. :) 2) You have other internet-visible services: * A port scan will reveal you, regardless of ICMP responses. -- Josh Huber _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 9, 2004

Re: [Wlug] Verizon DSL on SuSE

by Frank Sweetser

On Fri, Apr 09, 2004 at 10:50:18AM -0400, Josh Huber wrote: > "Martin, Eric" <MartinE(a)worc.k12.ma.us> writes: > > > I personally have my firewall configured to drop pings. If they > > don't know you're there, you aren't a target. Granted it doesn't > > keep seasoned hackers off your box, but it's one more piece of > > security. > > I don't buy that argument. Two situations: How about the fact that if you don't, you're open to acting as an unwitting participant in a smurf/fraggle amplification DoS? -- Frank Sweetser fs at wpi.edu WPI Network Engineer GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

April 9, 2004

Re: [Wlug] Verizon DSL on SuSE

by Josh Huber

"Martin, Eric" <MartinE(a)worc.k12.ma.us> writes: > I personally have my firewall configured to drop pings. If they > don't know you're there, you aren't a target. Granted it doesn't > keep seasoned hackers off your box, but it's one more piece of > security. I don't buy that argument. Two situations: 1) You have no other internet-visible services: * What's the harm in allowing icmp echo? Who cares, unless there happens to be some vulnerable ICMP code in the kernel. I suppose that's a risk I'd be willing to take. :) 2) You have other internet-visible services: * A port scan will reveal you, regardless of ICMP responses. -- Josh Huber

April 9, 2004

Re: [Wlug] Verizon DSL on SuSE

by doug waud

Hi again Gregory Avedissian wrote: > Well, I needed to do something, because it was acting weird. The screen > was stalling for a couple seconds at a time, every few seconds. It was > too annoying to proceed. Yes, I see that occasionally with KDE. But again, that is not Linux per se. I suspect KDE is not quite ready for prime time. :-) When this happens to me, I just CTRL/ALT/Fn to a plain terminal, init 3 (to kill the Xwindow mess) and then init 5 to restart it. Unless KDE is so screwed up that it has trashed to keyboard, this should work without rebooting. > This seems to happen after doing NIC setup in yast. Maybe I'll try it > again to see if restarting the network helps. I admit that Yast strikes me as slso a bit dodgy. But again, the rcnetwork restart and/or init 3 then 5 should bail you out. doug

April 9, 2004

RE: [Wlug] Verizon DSL on SuSE

by Martin, Eric

I personally have my firewall configured to drop pings. If they don't know you're there, you aren't a target. Granted it doesn't keep seasoned hackers off your box, but it's one more piece of security. -----Original Message----- From: Josh Huber [mailto:huber@alum.wpi.edu] Sent: Thursday, April 08, 2004 10:50 AM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] Verizon DSL on SuSE avedis(a)rcn.com writes: > [...] > then could surf, with download speeds up to 1.7M/s. Just curious, is that bytes or bits? (I wasn't aware of verizon offering such a fast link) > I even got my firewall working with the new connection, but two things > seems to have changed. SuSEfirewall2 was set not to accept pings, and > it looks like it's still set that way, but Gibson Research's port > scanning utility can ping me. The other thing is that before, I had to > manually enter commands > (iptables) to drop packets to port 119 to put it into "stealth" mode. > Now, I don't have to do that, as it already appears stealthed. Can > anyone explain either of these phenomena? I'm not sure why you would want to drop all pings. You'll probably find that the default firewalling rules drop some kinds of ICMP packets, but there are some which are useful to keep around. (personally, I think dropping all inbound ICMP is pretty annoying when trying to diagnose network issues...) As for port 119, this appears to be the NNTP (net news) port -- why would you be running a news server I'm not sure :) -- Josh Huber _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 9, 2004

Re: [Wlug] Verizon DSL on SuSE

by Gregory Avedissian

Well, I needed to do something, because it was acting weird. The screen was stalling for a couple seconds at a time, every few seconds. It was too annoying to proceed. This seems to happen after doing NIC setup in yast. Maybe I'll try it again to see if restarting the network helps. Thanks. Greg doug waud wrote: > Hi greg > > avedis(a)rcn.com wrote: > > (snip,snip) > > I only had to make one file edit, > >> to designate eth0 in pppoe.conf, rebooted the computer and >> then could surf, > > > That "rebooted the computer" caught my eye. This is Linux, not Windows, > you don't need to reboot. In SuSE you can just shutdown and restart the > network with > rcnetwork restart > (rcnetwork is just a script in /sbin. You can browse it with less if you > want to see the gory details.) > > doug > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

April 8, 2004

Re: [Wlug] Verizon DSL on SuSE

by doug waud

Hi greg avedis(a)rcn.com wrote: (snip,snip) I only had to make one file edit, > to designate eth0 in pppoe.conf, rebooted the computer and > then could surf, That "rebooted the computer" caught my eye. This is Linux, not Windows, you don't need to reboot. In SuSE you can just shutdown and restart the network with rcnetwork restart (rcnetwork is just a script in /sbin. You can browse it with less if you want to see the gory details.) doug

April 8, 2004

Re: [Wlug] Verizon DSL on SuSE

by Josh Huber

avedis(a)rcn.com writes: > Bits, I think. Whatever they advertise as supplying 1.5meg down and > 128k up. I'm at the bottom of the hill from the phone company, so > maybe that helps. I downloaded knoppix (700MB) in a little more than > an hour. Okay, that makes more sense :) > I don't know enough to have an answer. How many kinds of ICMP are > there? The firewall config file gives three choices - > > # Allow (or don't) ICMP echo pings on either the firewall or the dmz > # from the internet? The internet option is for allowing the DMZ and > # the internal network to ping the internet. > FW_ALLOW_PING_FW="no" > FW_ALLOW_PING_DMZ="no" > FW_ALLOW_PING_EXT="no" > > I understand that the first two determine whether the firewall > or the dmz respond to pings from the internet, but I'm not > sure what the third option does. I am able to ping out to the > internet, even though it's set to 'no', so I don't understand > the last comment. I'm not sure why you would want to block outbound pings, but that sounds like the intended behavior of the last option in the list. You probably don't use a DMZ configuration, so the first should just disallow inbound pings. Can you test if incoming pings are replied to? What's you IP address? > Woops. I meant port 113, identd/auth. Ah, I'm sure they don't run/firewall idend by default... -- Josh Huber

April 8, 2004

Re: [Wlug] Verizon DSL on SuSE

by avedis＠rcn.com

Josh Huber wrote: > avedis(a)rcn.com writes: > > >>[...] >>then could surf, with download speeds up to 1.7M/s. > > Just curious, is that bytes or bits? (I wasn't aware of verizon > offering such a fast link)> Bits, I think. Whatever they advertise as supplying 1.5meg down and 128k up. I'm at the bottom of the hill from the phone company, so maybe that helps. I downloaded knoppix (700MB) in a little more than an hour. > > I'm not sure why you would want to drop all pings. You'll probably > find that the default firewalling rules drop some kinds of ICMP > packets, but there are some which are useful to keep > around. (personally, I think dropping all inbound ICMP is pretty > annoying when trying to diagnose network issues...) > I don't know enough to have an answer. How many kinds of ICMP are there? The firewall config file gives three choices - # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? The internet option is for allowing the DMZ and the internal # network to ping the internet. FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" I understand that the first two determine whether the firewall or the dmz respond to pings from the internet, but I'm not sure what the third option does. I am able to ping out to the internet, even though it's set to 'no', so I don't understand the last comment. > As for port 119, this appears to be the NNTP (net news) port -- why > would you be running a news server I'm not sure :) > Woops. I meant port 113, identd/auth. Thanks, Greg

April 8, 2004

Re: [Wlug] Verizon DSL on SuSE

by Josh Huber

avedis(a)rcn.com writes: > [...] > then could surf, with download speeds up to 1.7M/s. Just curious, is that bytes or bits? (I wasn't aware of verizon offering such a fast link) > I even got my firewall working with the new connection, but > two things seems to have changed. SuSEfirewall2 was set not to > accept pings, and it looks like it's still set that way, but > Gibson Research's port scanning utility can ping me. The other > thing is that before, I had to manually enter commands > (iptables) to drop packets to port 119 to put it into > "stealth" mode. Now, I don't have to do that, as it already > appears stealthed. Can anyone explain either of these phenomena? I'm not sure why you would want to drop all pings. You'll probably find that the default firewalling rules drop some kinds of ICMP packets, but there are some which are useful to keep around. (personally, I think dropping all inbound ICMP is pretty annoying when trying to diagnose network issues...) As for port 119, this appears to be the NNTP (net news) port -- why would you be running a news server I'm not sure :) -- Josh Huber

April 8, 2004