Re: [gentoo-dev] Gentoo Linux Security Guide

[Kim Nielsen]

On Mon, 2002-06-24 at 03:50, Conny R. Landstedt wrote:
> To Kim Nielsen & Gentoo-dev
>
> In the "Gentoo Linux Security Guide"
> >Code listing 64: /etc/init.d/firewall
> >  #Incoming traffic
> >  einfo "Creating incoming ssh traffic chain"
> >  $IPTABLES -N allow-ssh-traffic-in
> >  $IPTABLES -F allow-ssh-traffic-in
> >  $IPTABLES -A allow-ssh-traffic-in -p tcp --sport ssh -j ACCEPT
>
> I'm not absolutely certain, but shouldn't it be "--dport" instead of
> "--sport"?
>

No .. since --sport would be the client port and not the actual port of
the service

example:

You create a http request to gentoo.org and this is what happens

1. get ip for gentoo.org (64.57.168.198)
2. allocate a client port
3. send request from <ip>:<port> (Source) to 64.57.168.198:80
(Destination)

The http server on gentoo.org says:
1. I got a request on port 80
2. send request back to <ip>:<port>

And if the firewall is install it checks the allowed chains if anyone is
allowed to send packets to port 80 (The servers port 80, destination
port) .. 

if you where to use sport instead of dport you would only allow the
packet if the user sends from client port 80 which is very unlikely
since ports below 1024 is privileged ports

/Kim