Re: where am I supposed to put my rc.firewall?

From: Peder Blom (dion_at_bredband.net)
Date: 01/31/04

  • Next message: Jeff Elkins: "Re: Using the ATAPI/CAM Driver" 
    Date: Sat, 31 Jan 2004 18:53:00 +0100
To: Chuck Swiger <cswiger@mac.com>

    On Sat, 31 Jan 2004 10:50:19 -0500
    Chuck Swiger <cswiger@mac.com> wrote:

    > Peder Blom wrote:
    > [ ... ]
    > > Add this to your rc.conf: (instead of firewall_type=...):
    > > firewall_script="/etc/grog.firewall"
    > >
    > > See /etc/defaults/rc.conf !
    >
    > While I won't speak against looking at /etc/defaults/rc.conf, setting
    > firewall_type works fine; see the end of /etc/rc.firewall:
    >
    > *)
    > if [ -r "${firewall_type}" ]; then
    > ${fwcmd} ${firewall_flags} ${firewall_type}
    > fi
    > ;;
    >
    > --
    > -Chuck
    > _______________________________________________

    Yes, that's the other way of doing it. The mentioning of scripts and the
    fact that his file was in the form of a script made me assume that he
    wanted to write his own script for setting up his firewall. On second
    thought I realize that he might just as well want to do it your way and
    define a set of rules to be read in by rc.firewall. (This might even be
    the best solution).

    I've never done it this way, but in this case I assume that you just
    define the rules in '/etc/ERICS_firewall', thus:

    --------------
    add 100 pass all from any to any via lo0
    add 200 deny all from any to 127.0.0.0/8
    add 300 deny ip from 127.0.0.0/8 to any
    add 600 allow all from any to any
    --------------

    Using your suggestions for rc.conf, of course.

    Is this correct?

    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Jeff Elkins: "Re: Using the ATAPI/CAM Driver"

    Relevant Pages

    • Re: Some new SSH exploit script?
      ... You see, rather than do all this, I think it's much much smarter to turn over the logs more, and write a script that outputs the log - without the script kiddies if it really bothers you. ... If 3 people connect to this port, by all means, but just moving the port to decrease your viability of hacktards isn't smart. ... echo "Deleted all rules numbered $RANGE and added the following rules:" ... CMDTEMP=`echo "$IPFWCMD add $ENDIPFW deny ip from $IP to any"` ...
      (Pen-Test)
    • Re: User Account Options
      ... ntSecurityDescriptor is not an attribute. ... Both remove the deny ACE's from ... properties and not getting anything from script. ... some times about 30 minutes all permission changed with other permission ...
      (microsoft.public.windows.server.active_directory)
    • Re: how to restrict users to search in their own Organizational Unit
      ... decided a script can make it possible to accomplish, ... You could also TRY removing the "Authenticated Users" ... Domain level since using a lot of DENY ... permissions is in and of itself a poor practice. ...
      (microsoft.public.windows.server.active_directory)
    • Re: how to restrict users to search in their own Organizational Unit
      ... I also want to say that in fact you shouldn't deny the read permission to anyone and this scenario the MOSS Administrators or who is responsible for Add users to Your Sites should be carefull when performing this action. ... Now, because you're dealing with many users, my recommendation is to create THE NECESARY Security Groups in each OU and related them with your MOSS2007 existing security groups, in future when someone creates some user, you just have to add that user to the necessary group and that user will be given the necessary permissions. ... decided a script can make it possible to accomplish, ... > If I need to create a security group per OU and then add all users ...
      (microsoft.public.windows.server.active_directory)
    • Re: Deny rules...
      ... I have created the deny rule both ... Created rule by script. ... - Was a Packet Filter created by the Blockattacker script? ... >> If you are writing code to populate a Client set, ...
      (microsoft.public.isa)