full-disclosure - Compromised hosts lists

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200602212333.k1LNXC5b006282@turing-police.cc.vt.edu>
Date: Tue Feb 21 23:33:32 2006
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Compromised hosts lists 

On Tue, 21 Feb 2006 13:43:44 CST, Frank Knobbe said:

> Would you apply the same thinking to *outbound* traffic by first denying
> all outbound traffic, and then adding rules for, say eBay, Slashdot,
> etc?

This of course depends on the machine's function.  Chances are that if it's
a corporate server, it shouldn't be talking to either eBay or Slashdot. ;)

But yes, for a corporate server, it would certainly make sense to block
all outbound access, then add an 'iptables -state RELATED' to allow outbound
packets for authorized connections inbound, and perhaps a few other rules to
allow it to contact the NTP server, the machine you download patches/updates
from, and so on.

If your corporate server is making an *outbound* connection that you
don't know about, you probably have a problem and want to deal with it.

Of course, you will probably want to configure corporate desktops a bit
differently (the exact answer being *very* dependent on how fascist the
IT staff is), and another answer entirely for software development machines.
And personal machines are yet another different beast....

But even for personal machines, denying all outbound packets and then adding
rules to pass things you want to allow is a good idea - even if the rule is
"allow outbound to any other box's 25, 53, 80, 123, or 443" or similar.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060221/7a4ca89b/attachment.bin