Text 7135, 53 rader
Skriven 2006-08-16 01:13:34 av Maurice Kinal (1:140/13.1)
   Kommentar till text 7134 av Paul Rogers (1:105/360.0)
Ärende: more dd and compactflash
================================
Hey Paul!

Aug 15 16:53 06, Paul Rogers wrote to Maurice Kinal:

 PR> That's why I've taken the time to learn as much as I can.
 PR> But for any non-standalone system a good firewall is a
 PR> necessity, unless one want's to be in Wayne's boat.

So how would that happen if nothing is acting upon the outside request?

 PR> The firewall I posted tries to allow the user/client to
 PR> do all the common things while retaining good protection
 PR> from the outside world.

Understood.

 PR> FTP should be redesigned to
 PR> allow it to cooperate better with firewalls--it is the
 PR> hardest to integrate.

The server here is anonymous, read only, no logins not even local ones, so I am
not sure how anyone could upload anything let alone malware and if they did
there is nothing that would act upon the uploaded anything.  Heck I can't even
do that as root on that machine (ftp client login) and have to copy across
files to the ftp directory by hand from a local root login only (no remote even
on the LAN) without ftp helping any.  How would iptables improve that
situation?

Also I don't use browsers here that require any special addons.  Also I can
only download to my home account and again there isn't anything running to
automagically do anything about those.  No uploads there either.

I do have a firewall running but it is very basic since I can't think of
anything else it really needs to do unless I put something listening and acting
without me checking it first.  Robotization is almost nonexistant here and for
inbound from a remote robotization IS nonexistant here.  I am not a very
trusting person even when I do trust.

 PR> But if you just want one service it's pretty easy.  Just
 PR> make your default DROP, and only ACCEPT the one you want.

Or not allow ANY logins other then anonymous with read only access.  You, or I
for that matter, can only download what is there and do absolutely nothing
more.  If I change that and allow uploads it would have to be from a chroot
jailed account only to a user's home account, such as for an offline messaging
thingy.  I already got a few people to test the idea and it seems to work
great.

Life is good,
Maurice

--- Msged/LNX 6.2.0
 * Origin: The Pointy Stick Society XXII - A two bit outfit (1:140/13.1)