I dont think the developers know how to implement it and if they can not i am sure i will not be able to..
Don't know how?
Don't view this as a priority, perhaps.
Checking the iptables, they are not the same as in the older versions. 6.5 is new and so is 7.0, way over my head
.
Not very different since 6.0.1:
[root@buffy root]# /sbin/e-smith/db configuration getprop sysconfig ReleaseVersion
6.0.1-01
[root@buffy root]# iptables -V
iptables v1.2.5
--------------------------
[root@slim root]# /sbin/e-smith/db configuration getprop sysconfig ReleaseVersion
7.0alpha3
[root@slim root]# iptables -V
iptables v1.2.8
You can just create your own iptables rules to allow what you like. Try them at the prompt until they work right, and then save them to survive a reboot. You can put them in /etc/rc.d/rc.local, although I suspect that there is a more proper way to accomplish this.
Before you start with iptables, you could disable services that you don't need to have running.
Using iptables, permit what you want, port by port. Use nmap or some equivalent port scanner from a separate machine to determine which ports are open as you go along.
Permit traffic from anywhere to a certain port:
/sbin/iptables -A INPUT -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -p tcp --dport 80
-i eth0 -j ACCEPT
Drop traffic to other ports:
/sbin/iptables -A INPUT -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -p tcp --dport 110
-i eth0 -j DROP
Limit access to a single host or range of hosts, port by port:
/sbin/iptables -A INPUT -s x.x.x.x/255.255.255.255 -d 0.0.0.0/0.0.0.0 -p tcp --dport xxx -i eth0 -j ACCEPT
[/quote]
Using a combination of service control and iptables rules, you should be able to fine tune each server to listen only on the ports you want, and run only the minimum services required pretty quickly.
Kirk
24 Replies
5000 Views