<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on 10 iptables rules to help secure your Linux box ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-302512/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-19T07:03:08-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[good idea for article but (sorry) not well done]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3022922]]></link>
        <description><![CDATA[why so many &quot;syn&quot;s?mostly just not needed - the accept related/established stateful control will handle all that.why no icmp control?you can't go blocking all icmp on input, you'll fsck things over!why no policy? &quot;iptables -P INPUT DROP&quot;sorry, but this is not a particularly impressive &quot;10&quot; list at all. sorry to be the bearer of bad tidings, but whilst the idea was good it was poorly executed.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3022922]]></guid>
        <dc:creator><![CDATA[speculatrix]]></dc:creator>
        <pubDate>Wed, 25 Feb 2009 07:19:28 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[fail2ban]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3021127]]></link>
        <description><![CDATA[Sometimes you have to tweak the default fail2ban frequency downward in order to keep it working. Must be some of the script kiddies are unleashing bots that are aware of the default rate fail2ban ships with.I've seen the poor server spitting out &quot;password incorrect&quot; messages perpetually, despite fail2ban running. Just enough of a pause to avoid triggering the target.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3021127]]></guid>
        <dc:creator><![CDATA[pgit]]></dc:creator>
        <pubDate>Mon, 23 Feb 2009 10:40:14 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Confirmed]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3021056]]></link>
        <description><![CDATA[You are correct.  First rule applicable is applied.  Drop should be after all execptions.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3021056]]></guid>
        <dc:creator><![CDATA[benny@...]]></dc:creator>
        <pubDate>Mon, 23 Feb 2009 09:26:25 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[firehol and fail2ban]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3020932]]></link>
        <description><![CDATA[Rather than manually configure iptables (which is good to know how to do, but prone to errors and omissions), I generally use the firehol and fail2ban scripts to set up basic iptables protection.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3020932]]></guid>
        <dc:creator><![CDATA[bblackmoor@...]]></dc:creator>
        <pubDate>Mon, 23 Feb 2009 07:54:43 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[DROP first?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3020830]]></link>
        <description><![CDATA[I'll admit that it's been a LOOOOONG time since I've hacked together my own iptables ruleset (I usually take the default rules that come with RHEL, and let BFD add rules automagically as needed), but I thought that iptables does a &quot;first match&quot; algorithm?Thus, if you have a DROP rule, specifying the TCP protocol but no ports, it will deny unrelated packets from passing further down the chain.As Jack says, this is a great rule for hosts (particularly workstations) that have no services for external consumption, but it shouldn't be the first rule on a server-class box.Can anyone confirm please?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-302512-3020830]]></guid>
        <dc:creator><![CDATA[sonotsky]]></dc:creator>
        <pubDate>Mon, 23 Feb 2009 06:20:34 -0800</pubDate>
    </item>
    </channel>
</rss>

