1 |
Hi! |
2 |
|
3 |
On Tue, 07 Feb 2006, Francois Toussenel wrote: |
4 |
|
5 |
> On Sun, 5 Feb 2006 13:29:55 +0100 Tobias Klausmann <klausman@××××××××××××.de> wrote: |
6 |
> |
7 |
> > Which *should* make iptables start before net.* (maybe except |
8 |
> > net.lo). And sure enough, the boot sequence is: |
9 |
> |
10 |
> This depends on the runlevels in which you have iptables and net.eth0. |
11 |
> Could you please post the output of the following command? |
12 |
> |
13 |
> # rc-update show | grep 'iptables\|net\.' |
14 |
> |
15 |
> By having iptables in boot and net.eth0 in default, iptables starts |
16 |
> before net.eth0, but it also stops before services and of course |
17 |
> net.eth0. Does somebody know a setting to avoid that? |
18 |
|
19 |
I'm using the defaults for both (i.e. I did what's in the install |
20 |
handbook): |
21 |
|
22 |
$ rc-update show | grep 'iptables\|net\.' |
23 |
iptables | default |
24 |
net.eth0 | default |
25 |
net.lo | boot |
26 |
|
27 |
I really don't understand what happened on the original poster's |
28 |
machine. My (wild) guess is, that somehow parallel startip messed |
29 |
it up, but that would be a bug in the parallel startip code. |
30 |
|
31 |
> (I would add that one might want to never respond to pings, for |
32 |
> instance, so starting iptables between net.eth0 and services seems not |
33 |
> enough.) |
34 |
|
35 |
Why (outside of s specific attack in that area) would one *not* |
36 |
respond to pings? Outside from a specific attack in that area |
37 |
happening, I see no reason to do so. |
38 |
|
39 |
Regards, |
40 |
Tobias |
41 |
-- |
42 |
You don't need eyes to see, you need vision. |
43 |
-- |
44 |
gentoo-security@g.o mailing list |