Date: Thu, 11 Jun 1998 21:19:48 +0100 From: njs3@doc.ic.ac.uk (Niall Smart) To: jbryant@unix.tfs.net, njs3@doc.ic.ac.uk (Niall Smart) Cc: freebsd-hackers@FreeBSD.ORG Subject: Re: [Fwd: Secure Ping 1.0] Message-ID: <E0ykDp6-0004bf-00@oak71.doc.ic.ac.uk> In-Reply-To: Jim Bryant <jbryant@unix.tfs.net> "Re: [Fwd: Secure Ping 1.0]" (Jun 11, 3:01pm)
next in thread | previous in thread | raw e-mail | index | archive | help
On Jun 11, 3:01pm, Jim Bryant wrote: } Subject: Re: [Fwd: Secure Ping 1.0] > In reply: > > > > What you really need is resource limits for > > sockets. > > mebbe limiting icmp, but can global socket limits create an unusable > situation. heck such limits could be imposed that would prevent > people from doing legitimate tasks. Show me a resource manager that this doesn't hold true for. It's up to the administrator to decide reasonable limits. Besides, just limiting ICMP would be pointless, as Robert Watson just pointed out, people can just use UDP instead. > whatever happened to bandwidth limiting? an intelligent bandwidth > limiting algorithm could detect a icmp flood and filter it's bandwidth > down to a trickle.. other protocols could be done the same way. Well, this exactly the sort of thing I'm talking about, except I make it more flexible, for example it would nice to be able to specify "allow 8 megabytes outgoing traffic per day, a peak of 4 megabytes per hour, and a limit of 2 megabytes per day to any given host except xyz.com". > the original "secure-ping" idea presented is useful for preventing > abuse by the casual unix user. anyhow, what kind of idiot keeps a > compiler user-accessable in an untrusted environment?! "secure-ping" and removing the compiler will only help you make your system more secure if your users are very casual, i.e. completely brain dead in the UNIX department, in which case you don't really fit into the "untrusted environment" category. Anyway, I suggest we take this to freebsd-security. Niall To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E0ykDp6-0004bf-00>