Re: [gentoo-user] Re: Linux ephemeral port range defaults to "broken".

[Javier Martinez <tazok.id0@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 952 bytes --]

El 10/8/25 a las 23:39, Grant Edwards escribió:
> On 2025-08-10, Javier Martinez <tazok.id0@gmail.com> wrote:
> 
>> PD: nc -l myip myultracriticalport breaks your countermeasure of
>> using proc to avoid port use (ip_local_reserved_ports)
> 
> You can not run "nc -l myip myultracriticalport" on the system in
> question.
> 
>> is part of the solution, not the solution itself. You need iptables
>> in all cases.
> 
> No, I do not.
> 
> --
> Grant
> 
> 
> 
> 
> 
> 
> 
> 
You can do this:

Create iptable rule that allows using this port for one user with -m owner
If it's not this user who is trying to use the port, use  LOG with a 
concrete string with a DROP default policy.
Instruct syslog-ng with a rule using the "concrete string" to write a 
file monitored by inotify that execs one script that locates the 
offending command and kills it.

If not any troll with access to anything can use any port over 1024

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3145 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]