Text 11338, 66 rader
Skriven 2008-01-19 06:15:41 av Russell Tiedt (5:7105/1)
  Kommentar till text 11337 av mark lewis (1:3634/12.0)
Ärende: a BBS for all
=====================
Hello mark.

18 Jan 08 20:46, you wrote to me:


 RT>> Hmmm ... , thought smoothwall was a firewall script, or was that
 RT>> shorewall ...

 ml> i dunno about shorewall but smoothwall is a complete linux OS designed
 ml> specifically for firewall usage... it completely replaces whatever is
 ml> on the HD you install it on ;)

Haven't checked, but if memory serves me well, shorewall is smoothwall, 
without the operating system part ... , so smoothwall is like IP-Cop in that 
regard, install it on a HDD, and everything else that was there is gone, and 
all you have left is Smoothwall/IP-Cop ... <grin>

 ml>> stop by and drop wkitty42 a li'l 'ello! ;)

 RT>> Will drop by sometime ...

Have registered there, if you see anything posted by  "java" i.e. the stuff 
one drinks, as sung about by Manhattan Transfer in "Java Jive", not what one 
programs in, then I am guilty ...

 ml> we (a friend in WA state and myself) are this || close to releasing a
 ml> major update to the Guardian Active Response mod for SW3... this
 ml> update is a huge rewrite of the previous guardian.pl script that
 ml> monitors the snort alert log and adds violating machines to the
 ml> ipblock table based on certain time limits you set... the old version
 ml> simply added violators for 24 hours no matter what priority the alert
 ml> carried... the new version now allows you to select blocking time
 ml> limits per priority as well as being able to ignore certain other
 ml> violations... without the new ignoring capabilities, my binkp stuff
 ml> would be blocked as well as my automated FTP pulls of certain data
 ml> files from other systems...

Hmmm ... , now that alone would make it worthwhile checking out, if I 
understand you description ...

 ml> this is a big rewrite and actually helps to make smoothwall very
 ml> intelligent as to what it blocks ;)

A sys-admin here that I talked to awhile back has a rule of thumb, he checks 
his squid logs daily and when his "regulars" go online trying to access URL's 
that he has already blocked, usually porn, games, cracks, patches etc. he 
simply adds the next 3 URL's the guy surfed to, to his black-list, and it 
seems to work, a lot of other sys-admins here get regular updates from him for 
their networks, and they are all happy ...

Intelligent, you say, can it block say my nntp port (example) from 08:00 to 
18:00, then open the port for 2 hours, then block it again from 20:00 till 
06:00, open it till 08:00 ... or similar ... for a 24/48 hour period.

Reason for such is I like having all ports except binkp, closed, but on 
occasion some one needs ftp/nntp/telnet access, and then I can arrange to open 
the required port, tell him those ports will be available for say the periods 
above, and that he has 2 grace periods, if he misses both time slots, he'll 
have to wait till I can setup another.

or doees this fall outside the ability/defined scope of this utility ...

Russell

--- GoldED+/LNX 1.1.5
 * Origin: Rusty's BBS - Bloemfontein, Free State, South Africa (5:7105/1)