On Wed, Dec 11, 2002 at 02:52:24PM +0000, Antony Riley wrote: > Wouldn't that make the problem worse, what if someone found a way to cause > immutable connections in the keep state table ?
First and foremost, this suggestion isn't nearly as relevant unless
using a recent incarnation of ipf 4.0. :|. (I neglected to read-up on
3.4.x when posting this earlier today.)
I don't think it'd really be that any worse than before: you could
still flush these with a manual table flush, and while you'd still have
to contend for state space to even log in, at least there wouldn't be a
worry of losing the connection if you were idle for 30 seconds (looking
something up, calling someone's security desk, etc.)
I'd imagine one using such an option would only permit traffic from a
trusted host, and as this would require fully establishing a connection,
I don't believe it's something one would have to worry about in terms of
some 3rd party spoofing connection requests. (Half open connections
aren't deemed immutable.) Rather, you'd have a bigger problem of
worrying about some 3rd party having compromised said trusted host.
> I don't quite understand the second idea :(
Y'know, neither do I. ;).
I have some ideas besides the currently recommended stateless pair of
in/out rules, but I guess it comes down to whether the severity of state
table exhaustion is more like sitting on a thumbtack instead of getting
a rusty nail through the skull. :|.
--
ryan beasley <[EMAIL PROTECTED]>
GPG ID: 0x16EFBD48 http://www.goddamnbastard.org
msg01909/pgp00000.pgp
Description: PGP signature
