[1506] in linux-security and linux-alert archive
[linux-security] Re: [LINUX] IP_MASQ / Ethernet Passing Traffic After Halt
daemon@ATHENA.MIT.EDU (Alan Cox)
Mon Apr 14 03:32:41 1997
From: Alan Cox <alan@cymru.net>
To: hamors@LITTERBOX.ORG
Date: Sun, 13 Apr 1997 17:11:42 +0100 (BST)
Cc: linux-security@redhat.com
In-Reply-To: <Pine.LNX.3.96.970411235054.377A-100000@litterbox.org> from "Sean B. Hamor" at Apr 11, 97 11:54:14 pm
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
> Even worse, that connection will stay online even if the IP Masquerade
> gateway machine is rebooted. During a soft reboot, the connection will
> stay online in a fully interactive state. During a cold reboot, the
Actually its a feature. Its called "stateless" - like IP itself is. It
gives you nice fault tolerance.
> During an incoming or outgoing attack, systems administrators may use the
> "kill switch" tactic to stop the attack and shut down the gateway machine
> involved in the attack. This creates a false sense of security with that
> systems administrator thinking that the attack has been successfully
> stopped. In reality, the connection in question is totally unaffected by
> the system shutdown.
Anyone who simply uses shutdown on an attacked machine is a fool. You
have no idea what the cracker has done to your halt program. Use the BRS
or pull out the cables.
If you want the Linux halt in the normal case to shutdown your network
interfaces then ifconfig them down in the rc scripts.
Alan
