lkml.org 
[lkml]   [1999]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[PATCH] IPv4 TCP Security Improvement
Hello!

I can't believe it, but it seems that my first message
never has never arived... strange. So again:

My patch changes the behavior of the IPv4 TCP source if
a TCP packet to an unconnected socket arrives. The unpatched
Linux sends than an ACK+RST - but this is used in scanners
such as nmap to scan your system for open ports.

So my Patch lets you choose via a config-option what you
want. If you say Y to my patch those packets will be dropped
and a logging message with level KERN_DEBUG is created:

127.0.0.1 tried closed TCP socket port 24

This output isn't very usefull, because everybody could
use the decoy option of nmap - but I think it's better to
know if something is going on - rather than hoping that
you've everything in the right way up.

Because this is my first patch - I'll surely have made
mistakes. With this message I send a tgz file with my patch
against 2.1.132. I think you could apply the patch in
/usr/src/linux with tar xzOf patch-2.1.132-jb1.tgz |
patch -p0

I've tested it - it works for me. I hope it will get into
the `real' series...

Bye.
--
Joachim Baran jbaran@hildesheim.sgh-net.de
Breslauerstr.18 http://prinz.hannover.sgh-net.de/~jbaran
31171 Mahlerten Network Administration
Lower Saxony/Germany and Programming

[unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.040 / U:0.176 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site