-m string --string cmd.exe

-m string --string cmd.exe

[Allen Wayne Best]

hello:

i read in the linux journal the article "A NATural Progression" about a rule 
which twinked my interest:

iptables -t filter -I FORWARD -m string \
   --string=root.exe -j DROP

this set me to thinking, "ahhhh, a way to stop all those microcosm virii. 
they have the commonality of the string 'cmd.exe.'" so off i go to build a 
rule of similar bent, that is:

iptables -A  INPUT -i $EXTERNAL -p tcp --dport 80 \
    -m string --string=cmd.exe -j DROP

when i try to use this rule, i get the following error:

iptables v1.1.1: Couldn't load match `string'

have i missed something, or do i need to recompile the kernel (please say it 
ain't so.....) fyi, i am using rh 7.0 and rh 7.2 on the servers.

-- 
regards,
allen wayne best, esq
"your friendly neighborhood rambler owner"
"my rambler will go from 0 to 105"
Current date: 20:54:8::161:2002

"Gort, klaatu nikto barada."
-- The Day the Earth Stood Still

Re: -m string --string cmd.exe

[Maciej Soltysiak]

> when i try to use this rule, i get the following error:
> 
> iptables v1.1.1: Couldn't load match `string'
You need to run:
make patch-o-matic from the netfilter tree and patch your kernel with
the string module.

and then load the module :)

But please, search the archives on discussion about the string match.
It is not advised to use this match agains cmd.exe, etc.

Best Regards,
Maciej Soltysiak

Re: -m string --string cmd.exe

[Allen Wayne Best]

maciej, annette:

thanks for your input. after looking back at the prior discussion, i should 
have never ask the question, it appears.  8<{) i really don't want a bunch of 
open connections hanging around.  nor do i relish recompiling the kernel, as 
it has been impossible for me to recompile a kernel that would correctly do a 
power down as the precompiled kernel does. 

(slowly sinking into the lurk mode.....)

On Tuesday 11 June 2002 09:15 am, Maciej Soltysiak pronounced:
> > when i try to use this rule, i get the following error:
> > 
> > iptables v1.1.1: Couldn't load match `string'
> You need to run:
> make patch-o-matic from the netfilter tree and patch your kernel with
> the string module.
> 
> and then load the module :)
> 
> But please, search the archives on discussion about the string match.
> It is not advised to use this match agains cmd.exe, etc.
> 
> Best Regards,
> Maciej Soltysiak

-- 
regards,
allen wayne best, esq
"your friendly neighborhood rambler owner"
"my rambler will go from 0 to 105"
Current date: 57:46:9::161:2002

When we jumped into Sicily, the units became separated, and I couldn't find
anyone.  Eventually I stumbled across two colonels, a major, three captains,
two lieutenants, and one rifleman, and we secured the bridge.  Never in the
history of war have so few been led by so many.
- General James Gavin

Re: -m string --string cmd.exe

[Maciej Soltysiak]

> it has been impossible for me to recompile a kernel that would correctly do a 
Compile as modules, no massive kernel recompile or reboot necesary.