Laszlo Attila Toth wrote:
Patrick McHardy írta:
Laszlo Attila Toth wrote:
Set the default policy of INPUT/FORWARD/OUTPUT chains of IPv4/IPv6
filter
tables to DROP or ACCEPT in kernel configuration. It can be override by
a module parameter (defaultdrop for IPv4 and defaultdropv6 for IPv6).
Whats the point of this? You can simply execute the corresponding
iptables commands early during boot ...
Yes, that's right. But in case of a security audit unfortunatelly it is
not enough, the only acceptable way is to set the policy to DROP. In our
kernel the default policy is DROP because of it.
Frankly, any "audit" that insists on this while ignoring that the
policy can be set before any network interface is up or even
drivers loaded deserves to go to the trash. Thats just as stupid
as "icmp is bad" dogma and similar crap.
So I'm not going to apply this, sorry.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
