bugtraq - Re: 11 years of inetd default insecurity?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 09 Sep 2003 10:07:08 -0400
From: "Jonathan A. Zdziarski" <jonathan@...learelephant.com>
To: Mike Tancsa <mike@...tex.net>
Cc: bugtraq@...urityfocus.com, 3APA3A@...URITY.NNOV.RU,
	strombrg@....nac.uci.edu
Subject: Re: 11 years of inetd default insecurity?

I wonder how difficult it would be to port the Apache DOS Evasive
Maneuvers module to an inetd implementation.  It does an excellent job
of both fending off Dos/DDoS/Brute Force attacks and it also will talk
to other tools on the network (Firewall, Router) to push the attack back
to the borders.

I would love a stab at doing this, but does anyone know where the
original inetd source tree could be found?  You could theoretically do
this to the wrappers instead, but with consequences...so it makes more
sense to code it right into the inetd listener.

For reference the Apache DOS Evasive Maneuvers Module can be found at
http://www.nuclearelephant.com/projects/dosevasive/

The advantage to doing it this way is that nothing goes into 'queue'
mode, and nothing shuts down...you're cutting off the flooding host (or
hosts) and nobody else.  It would be all too easy to detect an inetd
flood.