Re: enc0 patch for ipsec

On 6/16/06, Max Laier <max@xxxxxxxxxxxxxx> wrote:
The issue is, if an attacker manages to get root on your box they are
automatically able to read your IPSEC traffic ending at that box. If you
don't have enc(4) compiled in, that would be more difficult to do. Same
reason you don't want SADB_FLUSH on by default.

Okay, this makes sense. But couldn't you also argue that if someone
gets access to the machine they could also use tcpdump to do the same
thing technically on the internal interface? Just playing devils
advocate.. :)
_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: enc0 patch for ipsec
    ... On Friday 16 June 2006 18:09, Scott Ullrich wrote: ... automatically able to read your IPSEC traffic ending at that box. ... thing technically on the internal interface? ... Just playing devils ...
    (freebsd-arch)
  • Re: enc0 patch for ipsec
    ... On Friday 16 June 2006 18:09, Scott Ullrich wrote: ... automatically able to read your IPSEC traffic ending at that box. ... thing technically on the internal interface? ... Just playing devils ...
    (freebsd-net)
  • Re: enc0 patch for ipsec
    ... On 6/16/06, Max Laier wrote: ... automatically able to read your IPSEC traffic ending at that box. ... thing technically on the internal interface? ... Just playing devils ...
    (freebsd-arch)