Johnny Hughes wrote:
> SO ... if the box needs to do either mDNS or CUPS printer browsing, you
> need them enabled. If not, you can remove them.
And system-config-securitylevel is going to add them again next time it
is run. IMO, the best is to remove system-config-securitylevel and do
firewall configuration manually. The stuff that
system-config-securitylevel is writing into /etc/sysconfig/iptables
isn't exactly tight anyhow. It treats INPUT and FORWARD about the same,
no per-interface controll, no source address controll (do you really
want to enable ssh access from Internet?), weak controll of ICMP (why
allow non-related ICMP messages?), no TCP flags checks, allows RELATED
stuff without further checks... just to name few things that are a must
in any half-decent Linux/Netfilter based firewall configuration...
--
Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
