Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

See title for the question.

This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED and RELATED packets One of the rules has NEW in it, and I'm concerned packets will slip through because I'm accepting ssh traffic once it passes the rule. I think I need to ad ESTABLISHED to the rule as well. And maybe even RELATED if it's possible to spoof both. So that's the question. Is it possible ?

share|improve this question
    
ssh would defeat any hijack because the man in the middle would not be able to decrypt the payload, peek at the auth details. –  Tom H Mar 20 '12 at 19:00
add comment

1 Answer

up vote 3 down vote accepted

No.

(at least, not without some vulnerability or bizarre naughtiness involving sequence prediction or boring naughtiness such as man in the middle.)

ssh would protect against those types of attack. even if your attacker managed to convince netfilter to not drop the packets, the ssh server and client would both puke at the random unencrypted traffic and close the connection themselves.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.