Date: Wed, 13 Aug 2003 15:09:15 +0200 From: Ruben de Groot <mail23@bzerk.org> To: Andy Farkas <andyf@speednet.com.au> Cc: freebsd-questions@freebsd.org Subject: Re: Restricting ICMP Message-ID: <20030813130915.GA86196@ei.bzerk.org> In-Reply-To: <20030813215540.T90272-100000@hewey.af.speednet.com.au> References: <200308130956.H7D9U28E022832@asarian-host.net> <20030813215540.T90272-100000@hewey.af.speednet.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Aug 13, 2003 at 10:01:03PM +1000, Andy Farkas typed: > Mark wrote: > > > I am just not very fond of the idea of local users starting ICMP wars over > > the net, using my server :) I have already had an instance where a web-user > > did an excessive ping attack on one of his buddies. And, naturally, I want > > to prevent that. The chmod u-s idea mentioned here, was a good idea. Except > > that, prefereably, I'd like all of wheel to have access, and the rest not. > > And that may be harder to implement. > > If your users play up, put your BOFH hat on and lart them. > > chmod'ing /sbin/ping is useless - users can compile their own version of > ping. They can compile all they want, but they can't make the command suid root, which is required for ping to work. ruben@ei:/home/ruben> cp /sbin/ping . ruben@ei:/home/ruben> ./ping localhost ping: socket: Operation not permitted So I would say taking away the s bit (or the execute bit for others) can be very usefull. -Ruben > Make your users aware that abusing ping (and other net resources) will get > them kicked and banned from your system. > > -- > > :{ andyf@speednet.com.au > > Andy Farkas > System Administrator > Speednet Communications > http://www.speednet.com.au/ > > > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030813130915.GA86196>