Hi everyone, A few days ago I had asked why I had su much scans for port 113 well I kind of find the answer as this happens more when I send emails. I have found the following information as it also slows smtp service. The suggesstion is as follows To solve this problem: 1)reconfigure the e-mail server to stop querying identd info 2)reconfigure the firewall to RST all those connections 3)reconfigure the firewall to allow this protocol, but this would be a BAD IDEA because identd/AUTH reveals a HUGE amount of information about your UNIX machines. Now I do not want to do option 1 since I don't think I am ready to play with sendmail.cf. I do not want to do option three since it is written in captial letters. So I am only left with option 2. If possible to do so; how can I can make it just to accept for SMTP ident requsst but deny or reject (whichever is recommended)for all others ? If not possible then DENY or REJECT which option would be better to increase performance. #IDENTD $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 113 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 113 -j DENY -l TIA -- Togan Muftuoglu
On Mon, Apr 09, 2001 at 19:41 +0300, Togan Muftuoglu wrote:
A few days ago I had asked why I had su much scans for port 113 well I kind of find the answer as this happens more when I send emails.
Have you actually considered looking up the mailing list's archive? This very topic (ident requests) has been discussed several times.
To solve this problem: 1)reconfigure the e-mail server to stop querying identd info 2)reconfigure the firewall to RST all those connections 3)reconfigure the firewall to allow this protocol, but this would be a BAD IDEA because identd/AUTH reveals a HUGE amount of information about your UNIX machines.
While option 2 will be the quickest solution, there _are_ protocols / apps that insist in getting ident answers before allowing access. SMTP is one of those where ident answers are optional and for logging purposes(?) only -- that's why delivery only slows down when facing denial and will work in the usual speed with rejection or acks.
Now I do not want to do option 1 since I don't think I am ready to play with sendmail.cf. I do not want to do option three since it is written in captial letters. So I am only left with option 2.
Regarding the information leak of option 3: The above form is too strict in my eyes. It might apply to the "standard" identd or the inetd builtin functionality. But you're free to install one of the thousand identd replacements. Some of them provide fixed "answers", others "roll their dices" and create random answers, some relay their requests to some other source, etc. As usual in the UNIX world there are multiple solutions at your hands, just choose one! virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.
participants (2)
-
Gerhard Sittig -
Togan Muftuoglu