Re: Stealthing Ports in system-config-securitylevel was: SSH brute force attack

[Steve G]

> If we were talking about usability, why not discussing an application
> level 
> gateway-firewall for fedora like eg.
> zonealarm? This is well known by most of all users... 
Take a look at firewall builder in extras.

-Steve

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

Stealthing Ports in system-config-securitylevel was: SSH brute force attack

[Roger Grosswiler]

> >If we were talking about usability, why not discussing an
> application level
> >gateway-firewall for fedora like eg.
> >zonealarm? This is well known by most of all users...
>
>  Take a look at firewall builder in extras.
>
>  -Steve
>  
i do know that fwbuilder as firestarter are in extras, but i still think, that
fwbuiler is not really for newbs...

Roger

Stealthing Ports in system-config-securitylevel was: SSH brute force attack

[John Morris]

On Thu, 2005-04-28 at 08:35, Roger Grosswiler wrote:

>  i do know that fwbuilder as firestarter are in extras, but i still
> think, that fwbuiler is not really for newbs... 
Firewalls aren't for newbs.  Anything more than checking a few boxes for
the basic options and newbs shouldn't be doing it.  If it looks really
user friendly and stuff that just encourages them to think they can do
it.  And that is the absolute worst thing you could do.

Ok, so that makes me an elitist bastard.  So be it.

-- 
John M.      http://www.beau.org/~jmorris     This post is 100% M$Free!
Geekcode 3.1:GCS C+++ UL++++$ P++ L+++ W++ w--- Y++ b++ 5+++ R tv- e* r

Stealthing Ports in system-config-securitylevel was: SSH brute force attack

[Roger Grosswiler]

John Morris schrieb:
>  On Thu, 2005-04-28 at 08:35, Roger Grosswiler wrote:
>  
>  
> >i do know that fwbuilder as firestarter are in extras, but i still think, that
> fwbuiler is not really for newbs...
>  
>  
>  Firewalls aren't for newbs.  Anything more than checking a few boxes for
>  the basic options and newbs shouldn't be doing it.  If it looks really
>  user friendly and stuff that just encourages them to think they can do
>  it.  And that is the absolute worst thing you could do.
>  
>  Ok, so that makes me an elitist bastard.  So be it.
>   
You might be right, how you call yourself is your thing ;-) But i can 
tell you in a bit a philosophical way, that the firewall should be done 
for newbs - they connect to the internet, no firewall (i still see this 
now...) and they often never remark, that their computer is captured. 
And who has to resolve it??? Not themselves, as it is easier to install 
a simple firewall than removing trojans, worms and alle the rest of this 
*#%& - they trust on tools and experts and experts writing those tools :-)

I deleted on a friends machine 7 trojans and 3 dialers, nevermind where 
he was surfing :-)

At least, i just installed him zonealarm (yes, his a windozer...), 
closed everything and explained him, how to handle that part, if a 
windows comes up and tries accessing to internet. Since then, he was clean.

I do not expect putting system-config-securitylevel in this way, but the 
stealthing option would really be a nice thing.

At least, 3-5 lines for an ip/ip-range/hostname, the portnumber and a 
clickbox (open port for this ip/range/hostname), and the tool would be 
basically able to write a rule. Or even, like open special ports one 
whole line called "Stealthing Ports) in the format IP:PORT:Proto would 
make system-config-securitylevel to a even more powerful tool.

or not?
Roger

Stealthing Ports in system-config-securitylevel was: SSH brute force attack

Roger Grosswiler wrote:

>  But i can tell you in a bit a philosophical way, that the firewall 
>  should be done for newbs - they connect to the internet, no firewall 
>  (i still see this now...) and they often never remark, that their 
>  computer is captured. 

you mean here linux machines ?

>  And who has to resolve it??? Not themselves, as it is easier to 
>  install a simple firewall than removing trojans, worms and alle the 
>  rest of this *#%& - they trust on tools and experts and experts 
>  writing those tools :-)
>
>  I deleted on a friends machine 7 trojans and 3 dialers, nevermind 
>  where he was surfing :-) 

i assume he had no on-access scanner.

was this a linux machine
or a windowzer behind an older linux-pc with a firewall or 
squid/danguardian ?
see eg $ vi /usr/share/doc/rp-pppoe-*/configs/firewall-*

>  At least, i just installed him zonealarm (yes, his a windozer...),

zonealarm for linux ? no thanks, i prefer iptables.

>  closed everything and explained him, how to handle that part, if a 
>  windows comes up and tries accessing to internet. Since then, he was 
>  clean. 

OT:
hahaha :-)
if you close all eg. "generic host bla" he will run in trouble.
i have seen zonealarms allowed everything because the "newbies" allow 
after a short time all applications.
result: i have a firewall, why do i have trojans/worms/etc ?

-- 
shrek-m

Stealthing Ports in system-config-securitylevel was: SSH brute force attack

[Roger Grosswiler]

shrek-m(a)gmx.de schrieb:
>  Roger Grosswiler wrote:
>  
> > But i can tell you in a bit a philosophical way, that the firewall 
> > should be done for newbs - they connect to the internet, no firewall 
> > (i still see this now...) and they often never remark, that their 
> > computer is captured.
>  you mean here linux machines ? 
No sir, windows-machines
>  
> > And who has to resolve it??? Not themselves, as it is easier to 
> > install a simple firewall than removing trojans, worms and alle the 
> > rest of this *#%& - they trust on tools and experts and experts 
> > writing those tools :-)
> >
> > I deleted on a friends machine 7 trojans and 3 dialers, nevermind 
> > where he was surfing :-)
>  i assume he had no on-access scanner. 
No sir, in fact he had. But let's not talk about the age of his 
signatures ;-)
>  
>  was this a linux machine 
a windowzer

>  or a windowzer behind an older linux-pc with a firewall or 
>  squid/danguardian ?
>  see eg $ vi /usr/share/doc/rp-pppoe-*/configs/firewall-*
>  
> > At least, i just installed him zonealarm (yes, his a windozer...),
>  
>  
>  
>  zonealarm for linux ? no thanks, i prefer iptables. 
i fact, zonealarm is for windows, i'd never run it on linux, as i have 
my iptables too :-) ...but shouldn't we think about lots of users to 
change from windows to linux? Shall linux always stay for "gurus"???
>  
> > closed everything and explained him, how to handle that part, if a 
> > windows comes up and tries accessing to internet. Since then, he was 
> > clean.
>  
>  
>  
>  OT:
>  hahaha :-)
>  if you close all eg. "generic host bla" he will run in trouble.
>  i have seen zonealarms allowed everything because the "newbies" allow 
>  after a short time all applications.
>  result: i have a firewall, why do i have trojans/worms/etc ?
>   
[OT reply]
i closed everything, started the apps he needs (browser, email, what 
else does he need really??? -> nothing!). The advantage of the 
application level gateway is, that it remarks traffic, that shouldn't be 
and asks for allowing of the app or disallowing. so he surfs and gets 
his mails and is happy and since then, he never ever got any more that 
stuff, as he also got antivir installed, which asks him each week to 
update! :-) So, hopefully he also has some DISCIPLINE and just doesn't 
open the firewall or equal (according to Will Hoopers reply from yesterday.)

Roger