Re: Anyone studying for Cisco certs?

[greg <frog@intertek.net>]

What does the for f do?

On Fri, 2003-05-16 at 11:05, Richard Fifarek wrote:
> On Fri, 16 May 2003 fiaid@quasi-sane.com wrote:
> 
> > That was a massively simplified explaination of the need for IP Spoof
> > checking.
> 
> 	So that leads to the obvious question, how does one do this with 
> Linux/IPTables/IPChains?
> 
> Direct quote from IPChains Howto (applies to IPTables as well):
> 
> "The best way to protect from IP spoofing is called Source Address
> Verification, and it is done by the routing code, and not firewalling at
> all. Look for a file called /proc/sys/net/ipv4/conf/all/rp_filter. If this
> exists, then turning on Source Address Verification at every boot is the
> right solution for you. To do that, insert the following lines somewhere
> in your init scripts, before any network interfaces are initialized:
> 
> 
> 
> # This is the best method: turn on Source Address Verification and get 
> # spoof protection on all current and future interfaces. 
> 
> if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
>   echo -n "Setting up IP spoofing protection..."
>   for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
>       echo 1 > $f
>   done
>   echo "done."
> else
>   echo PROBLEMS SETTING UP IP SPOOFING PROTECTION.  BE WORRIED.
>   echo "CONTROL-D will exit from this shell and continue system startup."
>   echo
>   # Start a single user shell on the console
>   /sbin/sulogin $CONSOLE
> fi
> 
> 
> 
> If you cannot do this, you can manually insert rules to protect every 
> interface. This requires knowledge of each interface. The 2.1 kernels 
> automatically reject packets claiming to come from the 127.* addresses 
> (reserved for the local loopback interface, lo).
> 
> For example, say we have three interfaces, eth0, eth1 and ppp0. We can use 
> ifconfig to tell us the address and netmask of the interfaces. Say eth0 
> was attached to a network 192.168.1.0 with netmask 255.255.255.0, eth1 was 
> attached to a network 10.0.0.0 with netmask 255.0.0.0, and ppp0 connected 
> to the Internet (where any address except the reserved private IP 
> addresses are allowed), we would insert the following rules:
> 
> 
> 
> # ipchains -A input -i eth0 -s ! 192.168.1.0/255.255.255.0 -j DENY
> # ipchains -A input -i ! eth0 -s 192.168.1.0/255.255.255.0 -j DENY
> # ipchains -A input -i eth1 -s ! 10.0.0.0/255.0.0.0 -j DENY
> # ipchains -A input -i ! eth1 -s 10.0.0.0/255.0.0.0 -j DENY
> # 
> 
> This approach is not as good as the Source Address Verification approach, 
> because if your network changes, you have to change your firewalling rules 
> to keep up.
> 
> If you are running a 2.0 series kernel, you might want to protect the 
> loopback interface as well, using a rule like this:
> 
> 
> 
> # ipchains -A input -i ! lo -s 127.0.0.0/255.0.0.0 -j DENY
> #
> "
> 
> 
> -- 
> Richard H. Fifarek
> rfifarek@silug.org
> 
> 
> 
> -
> To unsubscribe, send email to majordomo@silug.org with
> "unsubscribe silug-discuss" in the body.



-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.