Re: fwknop: use with Fedora?

[Michael Rash <mbr@cipherdyne.org>]

On Sep 23, 2007, Gerry Reno wrote:

> Mike,
> I'm going to try building the RPM on my system.
> 
> Here are a few things that I think the RPM should take care of though:
> 
> in a %post rule:
> set permissions: (I notice that 'other' has too much access in 1.8.2)
> /etc/fwknop/*

Agreed for /etc/fwknop/*, I will fix this.

> /usr/lib/fwknop/*

The fwknop script (as opposed to the fwknopd daemon) uses modules
installed in /usr/lib/fwknop, and normal users need to be able to
execute fwknop.  Only fwknopd and knoptm needs access to the
IPTables::ChainMgr and IPTables::Parse modules, so perhaps more
restrictive permissions makes sense for them, but standard execute
permission on the iptables binary still applies...

> /usr/bin/fwknop*

Normal users should be able to execute /usr/bin/fwknop.  The other
programs such as /usr/sbin/fwknopd, /usr/sbin/knoptm, etc. already have
minimal permissions.

> =======================================
> 
> And a question about SPA. If I switch to this mode will I still be able 
> to keep this system completely stealthy? That is no ports open anywhere? 

Yes, SPA is completely stealthy..  SPA never uses open ports (unless
you want to run the SPA packet over the Tor network, in which case a
real TCP server must be used because Tor uses TCP for transport).

--Mike


> I know I can do this with port knocking. I didn't know whether this was 
> possible with SPA mode.
> 
> Thanks,
> Gerry
> 
> -
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html