| Javascript Feeds RSS Feed Security Dashboard | SearchSecurity.com |
|
IPFilter: A Unix Host-Based Firewall With the advent of TCP wrappers and dedicated firewalling hardware, host-based firewall packages for unix operating systems have fallen by the wayside. Daemons such as inetd, xinetd, and tcpd allow hosts to effectively limit outside connections to an out-of-the-box unix distribution, and as such, many users seldom consider using a third party firewall package. IPFilter is one such hostbased firewall. It provides several useful security features which are lacking in stock unix installs, such as the ability to filter egressing traffic, protocol/packet state filtering, and true stateful firewalling. This paper will explain the benefits of using IPFilter on a unix host by detailing its configuration and implementation on a Solaris 8 SPARC box, and providing examples users can follow to safeguard their machines against some of the more popular remote exploits.
By Dana Price, 04/05/2004
|
|
Introduction to IP Filter Part 2 IP NAT is the portion of the IP Filter package that performs Network Address Translation. A major feature of most firewalls and routers these days is the ability to map an entire network to a smaller set of IP addresses. Those in the Linux work may know this as IP Masquerading. It allows a simple way to place an entire network behind a firewall, and have all outbound connections appear to come from a single point (or, possibly, a set or points). It can also make it possible for us to transparently proxy certain types of connections. We're going to set up NAT initially on our firewall. Our first configuration will simply map connections from one IP range to another. Then, we will set up the internal FTP proxy, so active mode ftp will work, as well as configure a transparent Squid web proxy.
By Jeremy Rauch , 02/21/2004
|
|
Introduction to IP Filter Part 1 A good first line of defense is to install IP level packet filtering. If we can determine exactly what packets should travel up our stack, and what appropriate destinations for these packets are, we can seriously cut down on the number of exposure points on a machine, both intentional and accidental. IP Filter, by Darren Reed, is one of the most popular pieces of packet filtering software for Unix systems, and its free.
By Jeremy Rauch, 02/21/2004
|
