Re: Enable syn cookies by default

[Olaf van der Spek <olafvdspek@gmail.com>]

On Wed, Oct 21, 2009 at 8:36 PM, William Allen Simpson
<william.allen.simpson@gmail.com> wrote:
> Olaf van der Spek wrote:
>>
>> How and when do they interfere?
>> If syn cookies are enabled and the queue isn't full, they're not used
>> so they don't interfere.
>> If the queue is full, they do interfere, but the alternative would be
>> no connection at all.
>
> You just answered your own question, both "how" and "when"....

No, I didn't.

>> So I really don't see the disadvantage of enabling cookies by default.
>>
> On systems with long delay paths, it represents turning back the clock
> more than a decade or so.

How's that? Are you saying no connection is better than a connection
with timestamps and SACK?
I don't believe you.

Wasn't there recently a patch to enable these things even when syn
cookies are actually being used?

> A better solution is usually a firewall/IDS.

Why's that?

> The best solution: I'm working on it.

Hmm, got any link to those cookies? I can only find docs on SYN cookies.

> As I'm sure you're aware, Timestamps and Sack options are fairly crucial.

Of course. I'm not saying you should disable them.

>
>>> As Ubuntu is debian based, perhaps they can back-port the Ubuntu changes?
>>
>> Actually changing the value isn't the problem, but the Debian
>> maintainer isn't sure it's a good idea (but he doesn't know why).
>>
> Well, that depends.  For a client, it's a good idea, as the defense is
> mostly local and rare.  For a server run by a small underfunded ISP, it's
> still a good idea as a last ditch defense.  But for a full-fledged ISP,
> especially running in a satellite environment or with a lot of dial-up
> customers, it's terrible!

Why?

> That's a reason the Ubuntu configuration approach works for me.
>
> A caveat: I've not run debian directly in many, many years (IIRC, since
> Red Hat Colgate), and more recently via Unbuntu (since Badger).  I don't
> know whether debian has evolved different installation procedures for
> different environments.

I'm not aware of any differences.

> My comments are based on fairly extensive experience with deployment of
> Yellow Dog Linux servers at an ISP (as a co-founder), and Ubuntu clients
> for the past 2 (US) election cycles.

Olaf