TLUG Forums

[nephila]

I noticed that all email from one of our servers to addresses like hotmail and gmail were bouncing. First thimg I did was check that those servers were actually up and running, then I checked the mail server, everything seemed fine. Then I tried to ping those machines from the server and got network destination unreachable. I pinged the gateway and could get out so figured it had to be something with the DNS Server. Pinging the DNS server yielded the same result: destination unreachable.

I decided to check all network settings and finally found that the portscanner detected port scans from the DNS servers and blocked them. This is interesting, either somebody hacked the DNS servers and was running scans from them [possible but unlikely] or they were spoofing the DNS addresses [more likely], thereby getting the portscanner to block those addresses causing a loss of mail services!!
_________________
Real programmers use Linux!

[Bejorgen]

There have been several reports lately of DNS poisoning. Perhaps it's linked to that?
_________________
Why is it that, as a culture, we are more comfortable seeing two men holding guns than holding hands? -- Ernest Gaines

[jkroon]

Which just once more shows that blocking portscans is a bad thing to do. Whilst you are possibly prevent some script kiddie from figuring out what services you are running you are opening yourself to DoS attacks.

I'm of the opinion that I can effectively make portscans close to impossible _and_ maintain availability without going to these measures. Perhaps block incoming SYN or other INVALID packets (like SYN,ACK without an outgoing SYN) and unrelated UDP packets, but don't just drop everything.

[derick]

Yup, security through obscurity is just lazy and cowardly . I say, let the world see what ports are open and what services are listening on them -- those services should be able to handle anything you throw at them.

That's why I don't run a firewall on my desktop machines, and don't ever expect to need one either. I trust all my public-facing services, and if an exploit is found I trust them to be fixed soon enough so I don't have to worry. So far so good.

Firewalling up a rotten core is just dumb. If you can't trust the network services themselves, then why trust anything in the OS?
_________________
All men die. Not all men truly live. -- William Wallace

[jkroon]

A firewall is just another layer though. It is usefull, so don't think we are saying firewalls should not be used. Just firewall an already secure system, that's all. Security is like an onion, it has many layers. A firewall can be one of these layers, but don't trust all your worth in it. Simply taking out ping is actually a good move since a lot of scanners performs a ping-scan before scanning individual hosts, not responding to the ping will in many cases make the scanner skip over your host.

My ruleset usually consists of about 5 or 6 rules, for those who care, read my iptables howto on http://www.kroon.co.za or http://nix.cs.up.ac.za - it's all there. If you are going to try to do more than what is there you are more likely going to do damage than good. That ruleset is _very_ restrictive, whilst at the same time being usable. A port scan against my machine takes about 72 minutes and tells you that a few services are running - so what?

Although - I really need to re-iterate this (as derick already mentioned): If you really need a personal firewall, you are already doing something wrong.

[derick]

[beam]

[jkroon]

Let's put it to you this way - before we managed to create a combined WinXP+SP2 installation CD we litterally had to unplug the network cable before installing. Why? Because the system got infected by some virus before you are even through the installation! I think my record is about something like 30 seconds after the network initialised for the first time! The longest - I actually rebooted once. With no network cable they usually survive at least untill most of the software is installed.

Why would you want network during install? Well, to get around some really fscked up installation stuff - like being forced to create a second administrator account unless you join the machine to a domain! Hmm, I'm just going to delete that user in 10 minutes, why force me to create it?

Beign owned? That simply means you are no longer the boss of your system. Some other program/person now has control over your system and how it functions. When someone hacked your box and now has control over it. When some virus took control of it and is now doing it's master's bidding on your machine.

How did we get this off topic?

[derick]

In April last year, shortly after Sasser hit and IT had done some disaster recovery, I had to fix up some of the Windows machines at Physics that had been infected by Sasser while I was on leave. I used McAfee's Stinger to get rid of the worm and after rebooting I immediately installed the Windows hotfix. A week later, I realised that there was an insane amount of network activity coming from that lab. Some network sniffing revealed that two of the machines were connecting to random IPs -- Sasser. In the time between booting and being able to install the hotfix, those two machines had already been infected. And this was after most of the Sasser outbreak had (supposedly) been contained.

[espeer]

[derick]

From M$'s "Top 10 Reasons to Deploy Windows XP Service Pack 2" page:

[derick]

[bertvl]

One nice thing about windows' personal firewalls is that they associate an app with a connection, this is very useful to prevent apps doing stuff behind your back. e.g. I DLed Acrobat reader 7 for windows and linux, and installed on both. In windows, my Kerio popped up warning me that Areader was trying to "phone home" on port 80, in linux I see nothing since I allow outgoing connections to port 80...

Methinks iptables should be re-architectured to sit at a layer where it can access (if not already) which process a socket belongs to (for connections originating/terminating at your box anyway), much like netstat -p. OTOH, iptables is more or less just what it says (perhaps layer4tables would have been slightly more accurate)... Anyway, whatever/however, it would be nice if one could block IP/port access per process/application too.

[jkroon]

Ah but you can. Take a look at the owner module in iptables. Specifically the --cmd-owner . You can even restrict based on the actual user who the process is running as, so user jkroon + acroread7 may connect, but derick + acroread7 may not .

[derick]

[bertvl]

Well, well, well... cool! I sortof assumed it couldn't be done 'cause I haven't seen any of the iptable wrapper gui things offer this feature before... thanks!

[derick]

Concurrent post

[bertvl]

[derick]

[ByronMolloy]

Really you need a good ddos protection provider that is ready to do upstream filtering to stop a DDoS in case you have one.