Tag Info

Hot answers tagged

208

In today's internet this is quite normal sadly. There are hordes of botnets trying to login to each server they find in whole IP networks. Typically, they use simple dictionary attacks on well-known accounts (like root or certain applications accounts). The attack targets are not found via Google or DNS entries, but the attackers just try every IP address ...


72

ICMP is way, way more than "traceroute" and "ping." It is used for feedback when you run a DNS server (port unreachable) which, in a modern DNS server, may actually help select a different machine to query faster. ICMP is also, as was mentioned above, used for path MTU discovery. Chances are your OS sets "DF" (don't fragment) on TCP packets it sends. It ...


70

I note that you've done a great job tying down several different daemons, and from what you've said I think it unlikely that you'll expose yourself to trouble through those services you have already secured. This still leaves you in a "everything is permitted except that which I have forbidden" state, and you can't get out of that state by hunting down ...


69

You basically have three options here. Disconnect your office/users from the internet If they can't get to "the public cloud," they can't upload anything to it. Compile a blacklist of specific services you're worried about users accessing. This is going to be absolutely massive if it's meant to be even remotely effective. Tech-savvy users will always ...


53

IPv6 gets rid of NAT, which has certainly been a large part of avoiding accidental exposure of services to the internet from internal hosts.. so in that way, yes, it's a change to how most everyone is doing things. However, it doesn't at all mean that you won't still have a central firewall at the network edge - the change is simply that it'll be acting as ...


52

Since you are on the Windows machine, these things can be done, Execute the following command and look for a ":3306" listener (you did not mention UDP/TCP). This will confirm there is something running on the port. netstat -a -n After this, if you are expecting incoming connections on this port and feel that the firewall may be blocking them, you could ...


36

I think you acknowledge an interesting sys-admin truth there, which is that unless you can reduce the probability of being hacked to zero then eventually, at some point, you are going to get hacked. This is just a basic truth of maths and probability, that for any non-zero probability of an event. The event eventually happens... So the 2 golden ...


29

I for one use a "tarpit" in addition to only allowing public key authentication and disallowing root logins. In netfilter there is a recent module, which you can use with (INPUT chain): iptables -A INPUT -i if0 -p tcp --dport 22 -m state --state NEW -m recent --set --name tarpit --rsource iptables -A INPUT -i if0 -p tcp --dport 22 -m state --state NEW -m ...


28

There is no way to block it completely, of course, unless the corporate network were to be disconnected from the Internet. If you really want something that should work most of the time while being mostly transparent, you'll need to deep-sniff packets. Set up a man-in-the-middle SSL/TLS proxy, as well as one for unencrypted communication, and block all ...


27

TCP Wrappers could be arguably called a host-based firewall implementation; you're filtering network traffic. For the point on an attacker making outbound connections on an arbitrary port, a firewall would provide a means of controlling outgoing traffic as well; a properly configured firewall manages ingress and egress in a way which is appropriate to the ...


25

Hardware firewalls are running software too, the only real difference is that the device is purpose built and dedicated to the task. Software firewalls on servers can be just as secure as hardware firewalls when properly configured (note that hardware firewalls are generally 'easier' to get to that level, and software firewalls are 'easier' to screw up). ...


25

There's nothing wrong with creating access mechanisms for hosts in the DMZ to access hosts in the protected network when this is necessary to accomplish your intended result. It's, perhaps, not preferable to do so, but sometimes it's the only way to get the job done. The key things to consider are: Limit the access to the most specific firewall rule you ...


24

Advantages of firewall: You can filter outbound traffic. Layer 7 firewalls (IPS) can protect against known application vulnerabilities. You can block certain IP range and/or port centrally rather than trying to ensure that there is no service listening on that port on each individual machine or denying access using TCP/Wrappers. Firewalls can help if you ...


23

As a general rule, use REJECT when you want the other end to know the port is unreachable' use DROP for connections to hosts you don't want people to see. Usually, all rules for connections inside your LAN should use REJECT. For the Internet, With the exception of ident on certain servers, connections from the Internet are usually DROPPED. Using DROP ...


23

What HopelessN00b said. I just wanted to add that: I have a friend with a job at a government agency where she isn't allowed to bring a cellphone with a camera to the office. She usually phrases that as, "I'm not allowed to own a cellphone with a camera," because, well. If she can't take her cell with her, why own one? She has trouble finding cellphones ...


21

Who do you use as your DNS provider? If you can switch to someone like OpenDNS (it's free) they provide automatic (& very configurable) blocking of social networking sites, webmail, adult content etc. EDIT: You don't have to change anything with your ISP either.


20

By default Windows 2008 does not respond to pings. To enable: Administrative Tools Windows Firewall with Advanced Security Inbound Rules File and Printer Sharing (Echo Request - ICMPv4-IN) Enable Rule You should now be able to ping your server from the LAN.


20

A DDOS (or even a DOS), in its essence, is a resource exhaustion. You will never be able to eliminate bottlenecks, as you can only push them farther away. On AWS, you are lucky because the network component is very strong - it would be very surprising to learn that the upstream link was saturated. However, the CPU, as well as disks I/O, are way easier to ...


19

Actually, there is a simple solution provided you don't also expect your internal network to be exposed to the Internet at the same time. Your PCs simply need to be completely blocked from accessing the Internet. All USB ports blocked, etc. To get on the Internet, people then need to either use a different computer - connected to a different network - or ...


19

One way would be with the netsh command: netsh firewall (deprecated after XP and 2003) netsh advfirewall (Vista, 7, and 2008)


18

Usually what I do is just upload my files somewhere where they can download stuff from a server. That way, it also doesn't clog up their inbox. If you're short on space, Dropbox is a great service that gives you 2GB of publicly-available space for free (great syncing tools, too!). UPDATE: It seems that I misread your question initially; you were in fact ...


18

Cisco firewall or not, if I cross-connected two corporate networks without the knowledge and explicit permission of the network owners, I'd be in seriously hot water. So what you need to do is to get those parties involved. If it's going across their networks, then they need to talk: Step 1. Establish the owners of both said corporate networks. I mean, ...


18

First, this kind of attack is not (mainly) targeting DNS itself as your title suggests. It will of course create some additional load on DNS servers but the main purpose is to DDoS someone else. Bad server configuration might make it worse but in the end this issue is inherent in the design of DNS and UDP and, in fact, any stateless communication protocol. ...


16

IP Addresses are issued from a central authority, the Internet Assigned Numbers Authority. This organization handles centralized numbering for many internet resources, including registering port numbers for services and also keeping track of internet-related numbers such as ISN/ITADs for Telephony routing over IP (Current List of registered ITADs.) Various ...


16

You can fix this sort of thing via technology - basically firewall off the sources and/or ports - but I'm a big believer in not turning a HR problem into a game of cat'n'mouse with your users. Simply speak to HR, explain the problem and ask them to make a policy regarding this issue and have them communicate it to your users. Then simply agree with HR to do ...


16

Do other companies blocking social sites? Yes, but that doesn't mean it is a good idea. The book Predictably Irrational has an interesting discussion and links to several studies that basically suggests that if you block minor personal usage, it can actually cost you in productivity. If people think their work place is friendly and home-like, they ...


16

Source NAT changes the source address in IP header of a packet. It may also change the source port in the TCP/UDP headers. The typical usage is to change the a private (rfc1918) address/port into a public address/port for packets leaving your network. Destination NAT changes the destination address in IP header of a packet. It may also change the ...


15

It is absolutely possible to do that. I work for a university that was lucky enough to get a Class B network (a /16 network in CIDR notation) back when they were passing them out (very roughly 20-25 years ago). Right this very moment my workstation, a workstation mind, is parked on a publicly routeable IP address. In fact, we have relatively few RFC1918 ...


15

Whitelist, don't blacklist You're describing a blacklist approach. A whitelist approach would be much safer. An exclusive club will never try to list everyone who can't come in; they will list everyone who can come in and exclude those not on the list. Similarly, trying to list everything that shouldn't access a machine is doomed. Restricting access to a ...


14

!X means "communication administratively prohibited" and !Z "communication with destination host administratively prohibited" As far as I remember, you get !X on ipv4 and !Z on ipv6 and it should be documented in the man (8) pages. Since Linux uses UDP for trace-routes, this can originate from a --reject-with icmp-host-prohibited rule at the destination. ...



Only top voted, non community-wiki answers of a minimum length are eligible