From a5add6efc6b920106a785e16f725bdebd13c5cb1 Mon Sep 17 00:00:00 2001 From: dillon Date: Sun, 20 Dec 1998 20:05:44 +0000 Subject: Add quick overview of basic firewalling practices --- share/man/man1/security.1 | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/share/man/man1/security.1 b/share/man/man1/security.1 index 0417c98..9bca730 100644 --- a/share/man/man1/security.1 +++ b/share/man/man1/security.1 @@ -30,7 +30,7 @@ .\" SUCH DAMAGE. .\" .\" @(#)security.1 8.2 (Berkeley) 12/30/93 -.\" $Id: security.1,v 1.1 1998/12/19 09:33:03 dillon Exp $ +.\" $Id: security.1,v 1.2 1998/12/20 19:49:43 dillon Exp $ .\" .Dd December 30, 1993 .Dt SECURITY 1 @@ -381,11 +381,35 @@ and to run the daemon (sendmail -bd) separate from the queue-runs at a much lower interval, such as -q1m, but be sure to specify a reasonable MaxDaemonChildren option for that sendmail to prevent cascade failures. .Pp +Syslogd can be attacked directly and it is strongly recommended that you use +the -s option whenever possible, and the -a option otherwise. +.Pp You should also be fairly careful with connect-back services such as tcpwrapper's reverse-identd, which can be attacked directly. You generally do not want to use the reverse-ident feature of tcpwrappers for this reason. .Pp +It is a very good idea to protect internal services from external access +by firewalling them off at your border routers. The idea here is to prevent +saturation attacks from outside your LAN, not so much to protect internal +services from root network-based root hacks. Always configure an exclusive +firewall, i.e. 'firewall everything *except* ports A, B, C, D, and M-Z'. This +way you can firewall off all of your low ports except for certain specific +services such as named (if you are primary for a zone), ntalkd, sendmail, +and other internet-accessible services. +If you try to configure the firewall the other +way - as an inclusive or permissive firewall, there is a good chance that you +will forget to 'close' a couple of services or that you will add a new internal +service and forget to update the firewall. You can still open up the +high-numbered port range on the firewall to allow permissive-like operation +without compromising your low ports. Also take note that FreeBSD allows you to +control the range of port numbers used for dynamic binding via the various +net.inet.ip.portrange sysctl's (sysctl -a | fgrep portrange), which can also +ease the complexity of your firewall's configuration. I usually use a normal +first/last range of 4000 to 5000, and a hiport range of 49152 to 65535, then +block everything under 4000 off in my firewall ( except for certain specific +internet-accessible ports, of course ). +.Pp Another common DOS attack is called a springboard attack - to attack a server in a manner that causes the server to generate responses which then overload the server, the local network, or some other machine. The most common attack -- cgit v1.1