J.D. Bronson wrote:
At 07:39 AM 1/31/2004, Matthew Seaman wrote:

On Sat, Jan 31, 2004 at 07:32:36AM -0600, J.D. Bronson wrote:
> I have a question. I setup the following in sysctl.conf:
> net.inet.tcp.blackhole=2
> net.inet.udp.blackhole=1
> ..Well this works, but now I have a new issue.
> I run sendmail and as such, need to allow TCP 113 into this machine
> and yet get CONNECTION REFUSED. - I dont want to run IDENT, but
> need to still get the CONNECTION REFUSED...

Run ipfw(8) or a similar firewall and set up a rule that sends an ICMP
reject whenever it detects an incoming connection on port 113 as part
of your firewall configuration.  Eg. something like:

01600 reset tcp from any to me dst-port 113 setup

Thanks...but I have quite a robust Cisco firewall in place ahead of the freebsd machines...so I dont -need- to run ipfw...Hmmm...

You can achieve this rejection on the application level as well. Here's how:

1. Run inetd with command line options '-wW' to enable libwrap support.

2. Enable inetd's internal auth service with
     auth    stream  tcp     nowait  root    internal

3. Deny auth connections in libwrap's /etc/hosts.allow, like so:
     auth : ALL : severity debug : deny
     ALL : ALL : allow

Now you have something (inetd) bound to port 113, so a connection can be established, but it gets dropped immediately due to the libwrap setup. This is sufficient to prevent timeouts on the remote end but at the same time leaks as little information as possible for an application level solution.

Uwe Doering         |  EscapeBox - Managed On-Demand UNIX Servers
[EMAIL PROTECTED]  |  http://www.escapebox.net
[EMAIL PROTECTED] mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to