Re: [Cerowrt-users] firewalling suggestion

[Marc MERLIN <marc@merlins.org>]

On Sun, Nov 25, 2012 at 11:41:55PM +0100, Dave Taht wrote:
> 1) I wanted sensors to actively "do something" when someone was up to
> fishy stuff. So, for example, an attempt to telnet or ftp to the
> router disables all xinetd run services, notably ssh. I'd like it if
> instead of firewalling off port 53, attempts to use it as an amplifier
> were logged and reported back to a home base. Similarly, email
> attempts when no email server is configured, and participating in
> rbls....
 
I do that with iptables log parsing, although I'm not sure how you get
iptables deny logs on cerowrt, maybe readlog would get them?

> I'm aware (now) that there exist tools that will do a better job of inserting
> appropo firewall rules on demand but haven't got around to evaluating them.

Gotcha.

> 2) Save on memory. It was my hope to eventually fire off the local and
> configuration web servers from xinetd (and by doing so, protect them
> also
>  from attacks from within and without the network) - but more importantly
> not waste the ram they use.

I'm not against xinetd. I think on demand starting is a good idea, keep
that.

> 3) While it is "so 90s", there are a multitude of other useful services that can
> run on demand out of xinetd. For example, rsync, and leafnode and jabber.
 
Sorry I was unclear. xinetd is not "so 90s". Firewalling with it is :)

> I'm ambivalent about this feature in present day cerowrt, both using
> it in xinetd and iptables is unessessarily difficult, however I would
> have approached your problem by adding in the allowed hosts into the
> xinetd ssh file.

I could, as an admin I just don't like the multiple layers of incompatible
and independently configured firewalling.
I did keep xinetd and ssh run from there, it's a good idea like you said, I
just moved the firewalling to iptables where it belongs IMO.

Thanks for explaining, at least now I know I didn't miss something stupid :)

Cheers,
Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/