From mboxrd@z Thu Jan 1 00:00:00 1970
Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org)
by nuthatch.gentoo.org with esmtp (Exim 4.62)
(envelope-from <gentoo-user+bounces-60624-garchives=archives.gentoo.org@gentoo.org>)
id 1HLszU-00051C-0G
for garchives@archives.gentoo.org; Tue, 27 Feb 2007 03:27:00 +0000
Received: from robin.gentoo.org (localhost [127.0.0.1])
by robin.gentoo.org (8.14.0/8.14.0) with SMTP id l1R3Pl19030754;
Tue, 27 Feb 2007 03:25:47 GMT
Received: from ik-out-1112.google.com (ik-out-1112.google.com [66.249.90.180])
by robin.gentoo.org (8.14.0/8.14.0) with ESMTP id l1R3LaTB026198
for <gentoo-user@lists.gentoo.org>; Tue, 27 Feb 2007 03:21:36 GMT
Received: by ik-out-1112.google.com with SMTP id c30so618141ika
for <gentoo-user@lists.gentoo.org>; Mon, 26 Feb 2007 19:21:36 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed;
d=gmail.com; s=beta;
h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
b=KByHdQdQKe1LrpZkC+r0qWMD4amd4eXyXWVtGAD+mfkoViFTzlaA3so1vr9/PuJxYpx4zy/PtIaCNvikG1EKvNfKKNDu7JlUp0L+TdlxcP4qg9tBAp1caafNgVdWckT7gzi6FGWGEljQ3Lkrm6qyXRjg1aAYV2jgAGHywTCNwZE=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=beta;
h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
b=TJgchmjW7BvdVgx/nykyeFMxSgTbH2gvAjm/fXwAuJyyB7MD+bf8D6N4HZab+uYRF2laaJUwBflmtayMGDSWPkQo5HCNbNzA0pkH88bgJD2ioHbIzkt+BIUiqBtGW1tI7ZatcHUym46oaGyt8po6hWW19SLXcQytz4gzMCSeXLg=
Received: by 10.114.185.8 with SMTP id i8mr2407009waf.1172546494976;
Mon, 26 Feb 2007 19:21:34 -0800 (PST)
Received: by 10.114.176.15 with HTTP; Mon, 26 Feb 2007 19:21:34 -0800 (PST)
Message-ID: <49bf44f10702261921k76a9f2f6pbb36585bcd73f61b@mail.gmail.com>
Date: Mon, 26 Feb 2007 19:21:34 -0800
From: Grant <emailgrant@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] What if the firewall doesn't start?
In-Reply-To: <200702262129.52581.alan@linuxholdings.co.za>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <49bf44f10702251158n2ab9c587y9563d6ad4fa3a4b3@mail.gmail.com>
<200702252247.43130.michaelkintzios@gmail.com>
<49bf44f10702251628k6f9261eepaeba900d7751aa9f@mail.gmail.com>
<200702262129.52581.alan@linuxholdings.co.za>
X-Archives-Salt: 109fb34e-b8bc-4be3-826b-9bbf9e2e774a
X-Archives-Hash: 7d409b61bfea2bb9f7c2ec34b03c2066
> > > Anyway, a closed port remains closed whether a firewall is running,
> > > or not.
> >
> > I thought the firewall specified which ports to open/close.
>
> Not quite, but we might be running into terminology here.
>
> The app that is listening a port opens the port. This has nothing to do
> with the firewall. The firewall is simply an extra level of checks
> applied before the packet is allowed thorugh the firewall to be
> received by the kernel, in the same way that a bouncer allows or
> disallows the public to enter a club. If the bouncer is off sick, the
> public gets to walk through the door up to reception, assuming the club
> is open for business.
>
> What Mick was referring to is that if a service is running, it's still
> going to listen on it's port whether iptables is running or not. So, in
> the absense of iptables (i.e. your bouncer is off sick), you hopefully
> have a decent password strategy in use by whatever is actually
> listening on the box.
So as far as incoming connections are concerned, if there are no
listening applications, there is no need for a firewall?
- Grant
--
gentoo-user@gentoo.org mailing list