Re: [cobalt-security] Portsentry, ipchains and pmfirewall

["E.B. Dreger" <eddy+public+spam@xxxxxxxxxxxxxxxxx>]

> Date: Mon, 21 Jan 2002 21:12:28 +0100
> From: "[iso-8859-1] Francisco Sánchez" <lists@xxxxxxxxxxxxx>

> Yes, this is a very important safety measure for a remote
> server.  I will set this delay.  Thanks for the idea.

Problem:  That leaves you open for five minutes after a reboot.

What I suggest is writing a quick shell script that flushes the
firewall rules, loads the new rules, then sleeps for a minute or
two.  If not killed, it then flushes the ipchains and reloads
your old ruleset.

Once you've tested to your satisfaction, commit the new ruleset
to startup script.

Portmaster 2's are cheap nowadays.  Buy one and give yourself
serial console access to all your boxen.


Eddy

---------------------------------------------------------------------------
Brotsman & Dreger, Inc. - EverQuick Internet Division
Phone: +1 (316) 794-8922 Wichita/(Inter)national
Phone: +1 (785) 865-5885 Lawrence
---------------------------------------------------------------------------

Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@xxxxxxxxx>
To: blacklist@xxxxxxxxx
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots.  Do NOT
send mail to <blacklist@xxxxxxxxx>, or you are likely to be blocked.