Messages in this thread | | | Date | Fri, 8 Jan 1999 09:56:32 +0100 | From | Joachim Baran <> | Subject | [PATCH] IPv4 TCP Security Improvement |
| |
Hello!
I can't believe it, but it seems that my first message never has never arived... strange. So again:
My patch changes the behavior of the IPv4 TCP source if a TCP packet to an unconnected socket arrives. The unpatched Linux sends than an ACK+RST - but this is used in scanners such as nmap to scan your system for open ports.
So my Patch lets you choose via a config-option what you want. If you say Y to my patch those packets will be dropped and a logging message with level KERN_DEBUG is created:
127.0.0.1 tried closed TCP socket port 24
This output isn't very usefull, because everybody could use the decoy option of nmap - but I think it's better to know if something is going on - rather than hoping that you've everything in the right way up.
Because this is my first patch - I'll surely have made mistakes. With this message I send a tgz file with my patch against 2.1.132. I think you could apply the patch in /usr/src/linux with tar xzOf patch-2.1.132-jb1.tgz | patch -p0
I've tested it - it works for me. I hope it will get into the `real' series...
Bye. -- Joachim Baran jbaran@hildesheim.sgh-net.de Breslauerstr.18 http://prinz.hannover.sgh-net.de/~jbaran 31171 Mahlerten Network Administration Lower Saxony/Germany and Programming
[unhandled content-type:application/octet-stream] | |