Tag Info

New answers tagged

1

As a general rule of thumb, running other services on security-related devices such as firewalls should be kept to a minimum. In other words, a firewall should ideally only be a firewall, and nothing else. The more services you run, the more likely one of them will contain a vulnerability that can allow an attacker to take over the machine. If that machine ...


1

Here are some flaws I can think of: SMS spoofing is trivial (e.g. at work I use an online SMS sending service which lets me set any arbitrary alphanumeric sequence as the sending number), meaning the only security that the whitelisting step is providing is that the attacker must know which numbers are on the whitelist. In a typical scenario such ...


4

Maybe you are thinking of: Ingress which indicates inbound flow, for instance flows coming from Internet to your LAN/DMZ, Egress which indicates outbound flow, for instance flow leaving your LAN toward the Internet. These will be handled in quite a different way regarding your firewall policy. If you are just referring to data coming to the firewall ...


0

By looking at the Netfilter documentation, it is said that "Connection tracking is fundamental to NAT", hence you cannot have DNAT without enabling conntrack.


0

Do you think that's possible or are aware of software that's capable of doing this? Or maybe another way to accomplish unrestricted internet access under these cirumstances? If you are in control of a server reachable by the service you mentioned then you could built your own tunnel, because you can send data through the tunnel to the server (via the ...


2

The most simple way to block traffic by IP address is to use pf (man pf.conf). Here's a simple script to help you get started. Warning Be sure to read the manual pages for more information and before running this. # enable: sudo pfctl -e -f pf.rules # disable: sudo pfctl -d set block-policy drop set fingerprints "/etc/pf.os" set ruleset-optimization basic ...


0

These seem like exaggerated claims in the form of "We just protected you from 145 threats, killed 5 aliens, 3 ninjas and one dragon!" The best options are, either: (next time it happens) use a network scanner/sniffer (like WireShark or similar) to see what actually happened ignore it (or use a better HIDS that gives better descriptions) uninstall McAfee ;) ...


1

You could (should ?) also : disable ssh root login (You can still use sudo to do system administration) Disable password authentication and enable key authentication


2

What you're looking for is network data loss prevention. There are some costly solutions from Code Green Networks, Symantec, etc. One free and GNU GPL-licensed ones is MyDLP (specifically you'll want the MyDLP-Network product) that does this.


1

You can use wireshark for sniffing packets and getting every kind of information from that. Wireshark is opensource project Check out its official page: https://www.wireshark.org/


1

First, websocket connections are initialized from javascript which gets executed by the web browser on the client. That means typical websocket connections are outbound connections, not inbound connections. Inbound websocket connections would only be possible when the host runs a websocket server. A normal browser will usually not do this. And even when the ...


0

WebSockets are not plain TCP sockets, but offer a behavior similar to TCP sockets inside a HTTP tunnel. To actually use them to connect to arbitrary ports you have to have some server side backend which will make "real" TCP connections to the requested port from the WebSocket. Apart from that this question is better asked at security.stackexchange.com.


0

A firewall is a device that sits between the Local Area Network (LAN) and Wide Area Network (WAN). I stole this picture from the Firewall wiki page. Rules are setup on the firewall based on IP and port numbers. You can restrict subnets of IPs from using certain ports. Rules for both incoming and outgoing communication is generally necessary. There can ...



Top 50 recent answers are included