Text 7397, 57 rader
Skriven 2006-09-07 20:48:02 av Paul Rogers (1:105/360.0)
     Kommentar till en text av Wayne Chirnside
Ärende: Just checking
=====================
When I bought this 486DX33 system 15 years ago, I paid for components
that would give me "room for growth".  I got Micronics EISA motherboard,
because it was the first one that really worked, and gave me 4x the ISA
buss speed.  I had intentions of by-passing DOS and installing BSD/386,
which I was told would require 200MB or so, if I wanted sources.  Got
the best Sony 14" monitor.  The whole kit was ~$6K, not cheap.

It HAS been upgraded.  32MB, because there is a flaw in the full-AT,
TTL/PAL MoBo that has an addressing problem with more--I tried when 4MB
30-pin SIMMS got cheap enough.  Adaptec EISA SCSI & 3COM EISA NIC.  1GB
internal SCSI drive, still running DOS/Win3.1, but one SCSI drive tray I
can use for other things, /NT4 WS for a while.  Last year it got a 2GB
drive, partially for backup storage of the internal drive, but with a
1GB partition running RHL6.1--FINALLY!  Last year also the Dallas
Semiconductor battery/clock module finally gave up the ghost, but I
salvaged another newer one, so it's good to go another 10 years!

Because RHL6.1 uses kernel-2.2.10-20, it only has ipchains and can't do
connection tracking and stateful inspection as iptables does with 2.4+
kernels.  But the past few days I've been reworking the chains because
it was MUCH too loose.  I like to restrict output to just the well-known
ports I will use, lest something try to phone home as apparently
happened to you.  I don't want any intrusion recruiting reinforcements.

Last night I gave it a try.  Active mode FTP requires my client accept a
new connection from the internet/server--not a chance!  Even passive
mode means I have to open the "ephemeral" ports above 1024, enabling
some little ET to phone home and start a connection for its own FTP
download.  I don't like it at all, but that's all ipchains can do!  I
did it for a few minutes to make sure it works, and it does.  The
authors of books I have that "try" to explain firewalls, have it wrong
for FTP.  When I proved it, I commented out the FTP acceptance rules.
Then I tried Navigator-4.7, and it worked too, except on sites with
modern Java scripts, like Yahoo!.  I suppose I might use a proxy, but
that also introduces another source of possible vulnerability.

Sure, some might consider this an effort without a payback.  This 486 is
at best a "deep backup".  After all, I've got an identical pair of
Pentiums I use everyday, and three different more powerful systems than
them!  The thing is, if you're going to have a computer connected to the
internet, take responsibility for learning what your firewall does, what
it doesn't do, and what you can do to make yourself more secure.  This
is all about my learning what my firewalls can do, what they don't do,
and what exposures I have.  I learned ipchains might still pass a
spoofed packet that claims to be from an existing connection.  Now what?
It isn't about access from the 486 at all!  My network security is in my
own hands.

Paul Rogers, paulgrogers@yahoo.com                       -o)
http://www.angelfire.com/or/paulrogers                   /\\
Rogers' Second Law: Everything you do communicates.     _\_V

... Therefore seek not to know for whom the bell tolls...
___ MultiMail/MS-DOS v0.35

---
 * Origin: The Bare Bones BBS (1:105/360)