From mboxrd@z Thu Jan 1 00:00:00 1970
Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org)
by nuthatch.gentoo.org with esmtp (Exim 4.62)
(envelope-from <gentoo-user+bounces-60665-garchives=archives.gentoo.org@gentoo.org>)
id 1HM5zn-0007YQ-CV
for garchives@archives.gentoo.org; Tue, 27 Feb 2007 17:20:12 +0000
Received: from robin.gentoo.org (localhost [127.0.0.1])
by robin.gentoo.org (8.14.0/8.14.0) with SMTP id l1RHIupT019284;
Tue, 27 Feb 2007 17:18:56 GMT
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.236])
by robin.gentoo.org (8.14.0/8.14.0) with ESMTP id l1RHBboR010873
for <gentoo-user@lists.gentoo.org>; Tue, 27 Feb 2007 17:11:38 GMT
Received: by nz-out-0506.google.com with SMTP id s1so1520511nze
for <gentoo-user@lists.gentoo.org>; Tue, 27 Feb 2007 09:11:36 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed;
d=gmail.com; s=beta;
h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
b=UHQckroVi18N4QVCMG5lyxvx6MX3tkXpaoLLE1ZcoFFQsLqv8FxE0Cd1h5DTlmERf+rt6J2GRFTAXVjFxDXUCJahyqRgq7G/BlKhdiLQNuDwCPIH+jNh8PepMZCOoV0ba8JUX5OynOQkZ/8UsBf4RXYBHRP30y+hYhSYVacKCUA=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=beta;
h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
b=UOc/Q0QcQnPPDKeBqrGEgaIb9o1X3BKDvvz15tXglNkoSc21kHLGyRgJt2XTtRBBQXZ7UDc+21BtifI1PtoueSXFihfvJuy5NjZPr/qi+6JbmV0BcHmbF6m2ZRN3cIBwtXwFeZDm1NqwldGxq9Wsngcr86Q9MdO41uO0A8WzqU8=
Received: by 10.114.151.13 with SMTP id y13mr482412wad.1172596293117;
Tue, 27 Feb 2007 09:11:33 -0800 (PST)
Received: by 10.114.176.15 with HTTP; Tue, 27 Feb 2007 09:11:33 -0800 (PST)
Message-ID: <49bf44f10702270911u690b4b58nc8bc4c9429f1f892@mail.gmail.com>
Date: Tue, 27 Feb 2007 09:11:33 -0800
From: Grant <emailgrant@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] What if the firewall doesn't start?
In-Reply-To: <200702271726.47096.alan@linuxholdings.co.za>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <49bf44f10702251158n2ab9c587y9563d6ad4fa3a4b3@mail.gmail.com>
<200702262129.52581.alan@linuxholdings.co.za>
<49bf44f10702261921k76a9f2f6pbb36585bcd73f61b@mail.gmail.com>
<200702271726.47096.alan@linuxholdings.co.za>
X-Archives-Salt: 88bdf313-e248-47b3-b3ee-321763a536df
X-Archives-Hash: 9b07f7684d84276018d8baaba5c141df
> > > > > Anyway, a closed port remains closed whether a firewall is
> > > > > running, or not.
> > > >
> > > > I thought the firewall specified which ports to open/close.
> > >
> > > Not quite, but we might be running into terminology here.
> > >
> > > The app that is listening a port opens the port. This has nothing
> > > to do with the firewall. The firewall is simply an extra level of
> > > checks applied before the packet is allowed thorugh the firewall to
> > > be received by the kernel, in the same way that a bouncer allows or
> > > disallows the public to enter a club. If the bouncer is off sick,
> > > the public gets to walk through the door up to reception, assuming
> > > the club is open for business.
> > >
> > > What Mick was referring to is that if a service is running, it's
> > > still going to listen on it's port whether iptables is running or
> > > not. So, in the absense of iptables (i.e. your bouncer is off
> > > sick), you hopefully have a decent password strategy in use by
> > > whatever is actually listening on the box.
> >
> > So as far as incoming connections are concerned, if there are no
> > listening applications, there is no need for a firewall?
>
> Technically yes. In the real world, it depends. The theory will work if
> and only if you can absolutely guarantee that no listening service will
> ever be running behind that firewall, and that this will always be true
> from here on out till the end of time regardless of who has access to
> the machine.
>
> That's a tall order, and leaves human nature out of it. You might
> install a listening app and leave it running in error without realising
> the impact of not having a firewall. Someone else might do the same.
>
> Ubuntu takes the approach you just asked about and it mostly works well,
> especially for notebooks on a LAN behind a NATing gateway. If you are
> running a network with valuable private information on it, you might
> well prefer a belts and braces approach of having a mostly-closed
> firewall as well.
>
> As always, the best solution will vary according to what *you* need
On more question, is default the right runlevel in which to run
shorewall? It looks like it's one of the last services to start that
way.
- Grant
--
gentoo-user@gentoo.org mailing list