Antw: -m string --string cmd.exe

["Annette Meriste" <annette.meriste@cablecom.ch>]

Hi Allen,

Download the newest version of iptables and make patch-o-matic.
This patch is experimental, i had to modify the source code of ipt_string.c to get this feature.
After patching, activate the "string match support" in the kernel.

Cheers,
Annette

-------------------------------------------------------------------------------------------------------------------------------
Cablecom GmbH
Security Team
Zollstrasse 42
CH-8021 Zürich
Voice: +41 1 277 99 21
Fax: +41 1 277 93 22
E-Mail: annette.meriste@cablecom.ch
>>> Allen Wayne Best <iptables@atoka-software.com> 11.06.02 18.12 Uhr >>>
hello:

i read in the linux journal the article "A NATural Progression" about a rule 
which twinked my interest:

iptables -t filter -I FORWARD -m string \
   --string=root.exe -j DROP

this set me to thinking, "ahhhh, a way to stop all those microcosm virii. 
they have the commonality of the string 'cmd.exe.'" so off i go to build a 
rule of similar bent, that is:

iptables -A  INPUT -i $EXTERNAL -p tcp --dport 80 \
    -m string --string=cmd.exe -j DROP

when i try to use this rule, i get the following error:

iptables v1.1.1: Couldn't load match `string'

have i missed something, or do i need to recompile the kernel (please say it 
ain't so.....) fyi, i am using rh 7.0 and rh 7.2 on the servers.

-- 
regards,
allen wayne best, esq
"your friendly neighborhood rambler owner"
"my rambler will go from 0 to 105"
Current date: 20:54:8::161:2002

"Gort, klaatu nikto barada."
-- The Day the Earth Stood Still