| gabriel rosenkoetter on Thu, 30 Jan 2003 07:50:29 -0500 |
|
On Thu, Jan 30, 2003 at 06:50:46AM -0500, Jeff Abrahamson wrote: > That is, suppose I make the naive argument that I only run sshd on > port 22, so all other ports get denied anyway by dint of having > nothing listening (not even inetd). Why bother with ip tables beyond > masquerading? > > (I'm pretty sure this is wrong, I just don't know why.) Because, historically, the Linux kernel has a bad track record of errors leading to DoS or even remote accessibitity in the TCP/IP stack. (So, btw, does the 4.2 BSD kernel's IP code, which is one reason that WinNT had long-term problems, having used 4.2 BSD's IP source and not merged in later fixes by more recent operating systems.) -- gabriel rosenkoetter gr@eclipsed.net Attachment:
pgpbOFFERO5sx.pgp
|
|