lkml.org 
[lkml]   [1998]   [May]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Disabling Promisc mode,
David Woodhouse wrote:
> > >I dont mean that.
> > >I want sth such that Noone even root cannot take the machine into promisc
> > >mode.
> >
> > >get the idea?
> >
> >
> > Don't give root access to people you can't trust.
>
> That's a fine plan if you can guarantee it. However, if someone _does_ get root
> access to a box on a sensitive subnet, then it's nice to know they can't start
> a packet sniffer without recompiling the kernel and rebooting.

This is impossible through software. If a user gains root
access, and if the NIC has a promiscuous mode which is software
selectable, then that user can put the NIC into promiscuous mode.
Proof is left as an Exercise for the Reader.

If root-enabled packet sniffers are a security concern at
your site, then you'll need to either get a card which doesn't
have p-mode or which can disable p-mode through hardware (e.g.,
a jumper), or you'll have to pull out your soldering iron.

Peace,
* Kurt Starsinic (kstar@isinet.com) ------------------ Technical Specialist *
| ``And you can believe me, because I never lie, and I'm always right.'' |
| -- Firesign Theatre |
Institute for Scientific Information http://www.isinet.com/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:0.147 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site