From: George Georgalis <georgw@galis.org>
To: Matthew Hellman <mhellman@raccoon.com>
Cc: George Georgalis <georgw@galis.org>, netfilter@lists.samba.org
Subject: Re: ssh connecting to wrong machine....
Date: Mon, 3 Jun 2002 16:57:37 -0400 [thread overview]
Message-ID: <20020603165737.A1199@trot.haven.dom> (raw)
In-Reply-To: <001901c20af8$0b8bbe70$020aa8c0@matttm9svd8lrh>; from mhellman@raccoon.com on Mon, Jun 03, 2002 at 07:13:17AM -0500
On Mon, Jun 03, 2002 at 07:13:17AM -0500, Matthew Hellman wrote:
>
>Looks good. The only other thing I'd do is change your default OUTPUT
>policy to DROP and add this:
>iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>
>There was a recent bug in the iptables code that had some security
>implications (information disclosure), but I don't recall the details at the
>moment. The suggestion was to drop INVALID output, which this does.
I think I heard about that, disclosing LAN IPs? I didn't really pay
attention at the time, thanks, it's fixed now.
// George
--
GEORGE GEORGALIS, System Admin/Architect cell: 347-451-8229
Security Services, Web, Mail, mailto:george@galis.org
File, Print, DB and DNS Servers. http://www.galis.org/george
next prev parent reply other threads:[~2002-06-03 20:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-02 23:21 ssh connecting to wrong machine George Georgalis
2002-06-03 2:58 ` Matthew Hellman
2002-06-03 5:05 ` George Georgalis
2002-06-03 12:13 ` Matthew Hellman
2002-06-03 20:57 ` George Georgalis [this message]
2002-06-03 3:04 ` George Georgalis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020603165737.A1199@trot.haven.dom \
--to=georgw@galis.org \
--cc=mhellman@raccoon.com \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox