[1508] in linux-security and linux-alert archive
[linux-security] Re: [LINUX] IP_MASQ / Ethernet Passing Traffic After Halt
daemon@ATHENA.MIT.EDU (Rogier Wolff)
Mon Apr 14 12:03:31 1997
To: hamors@litterbox.org (Sean B. Hamor)
Date: Mon, 14 Apr 1997 09:03:57 +0200 (MET DST)
Cc: linux-security@redhat.com
In-Reply-To: <Pine.LNX.3.96.970413125916.10010C-100000@litterbox.org> from "Sean B. Hamor" at Apr 13, 97 01:00:51 pm
From: R.E.Wolff@BitWizard.nl (Rogier Wolff)
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
Sean B. Hamor wrote:
>
> On Sun, 13 Apr 1997, Alan Cox wrote:
>
> # Anyone who simply uses shutdown on an attacked machine is a fool. You
> # have no idea what the cracker has done to your halt program. Use the BRS
> # or pull out the cables.
>
> You know that, and I know that, but do you really think that the average
> admin knows that?
On the other hand, a shutdown-ed router is still routing, but you could
just as well have turned it really off.
Anyway, I've known for years, that a router will keep on routing even
when it has been shutdown.
anecdote: "ext2fs panic: cannot read block from disk" was on the
console. The router was still functioning. A reboot killed the
forwarding, and the sysop had to buy and install a new HD on short
notice.
Note: It is not true that a warm reboot will not stop the machine from
routing at all. From the moment that the bios kicks in ("xxx bios
version xxx") to the moment that the routing rules are configured the
router will be "down". (about 30 seconds on a correctly configured
linux-router)
> # If you want the Linux halt in the normal case to shutdown your network
> # interfaces then ifconfig them down in the rc scripts.
>
> Which I have now done. I have also been told that there is a "-i" flag in
> shutdown that will ifconfig down all network interfaces before halt.
This is default on Red Hat.
Roger.
P.S. Subject closed.
