Re: [gentoo-user] Re: Linux ephemeral port range defaults to "broken".

[Javier Martinez <tazok.id0@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 785 bytes --]

El 10/8/25 a las 23:39, Grant Edwards escribió:
> On 2025-08-10, Javier Martinez <tazok.id0@gmail.com> wrote:
> 
>> PD: nc -l myip myultracriticalport breaks your countermeasure of
>> using proc to avoid port use (ip_local_reserved_ports)
> 
> You can not run "nc -l myip myultracriticalport" on the system in
> question.
> 
>> is part of the solution, not the solution itself. You need iptables
>> in all cases.
> 
> No, I do not.
> 
> --
> Grant
> 
> 
> 
> 
> 
> 
> 
> 
Any user with access to python or any socket interface in any 
programming language can put things to listen in ports above 1024 as are 
unprivilege ports.

The only solution is to use iptables to restrict it and killing the 
process that tried to use it triggered by iptables log.

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3145 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]