Re: [PATCH] Set default policy of chains in filter tables to DROP/ACCEPT

[Patrick McHardy <kaber@trash.net>]

Laszlo Attila Toth wrote:
> Patrick McHardy írta:
>> Laszlo Attila Toth wrote:
>>> Set the default policy of INPUT/FORWARD/OUTPUT chains of IPv4/IPv6 
>>> filter
>>> tables to DROP or ACCEPT in kernel configuration. It can be override by
>>> a module parameter (defaultdrop for IPv4 and defaultdropv6 for IPv6).
>>
>>
>> Whats the point of this? You can simply execute the corresponding
>> iptables commands early during boot ...
> 
> Yes, that's right. But in case of a security audit unfortunatelly it is 
> not enough, the only acceptable way is to set the policy to DROP. In our 
> kernel the default policy is DROP because of it.


Frankly, any "audit" that insists on this while ignoring that the
policy can be set before any network interface is up or even
drivers loaded deserves to go to the trash. Thats just as stupid
as "icmp is bad" dogma and similar crap.

So I'm not going to apply this, sorry.

-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html