0

See title for the question.

This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED and RELATED packets One of the rules has NEW in it, and I'm concerned packets will slip through because I'm accepting ssh traffic once it passes the rule. I think I need to ad ESTABLISHED to the rule as well. And maybe even RELATED if it's possible to spoof both. So that's the question. Is it possible ?

Improve this question
1
  • ssh would defeat any hijack because the man in the middle would not be able to decrypt the payload, peek at the auth details.
    – Tom
    Mar 20, 2012 at 19:00

1 Answer 1

Reset to default
3

No.

(at least, not without some vulnerability or bizarre naughtiness involving sequence prediction or boring naughtiness such as man in the middle.)

ssh would protect against those types of attack. even if your attacker managed to convince netfilter to not drop the packets, the ssh server and client would both puke at the random unencrypted traffic and close the connection themselves.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .