Linked by Thom Holwerda on Mon 24th Sep 2007 21:52 UTC, submitted by Oliver
Permalink for comment 274252
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
News
Linked by Thom Holwerda on 05/25/13 0:45 UTC
Linked by Thom Holwerda on 05/24/13 23:59 UTC
Linked by Thom Holwerda on 05/24/13 22:33 UTC
Linked by Howard Fosdick on 05/24/13 21:41 UTC
Linked by Thom Holwerda on 05/24/13 14:44 UTC
Linked by Thom Holwerda on 05/23/13 23:22 UTC
Linked by Thom Holwerda on 05/23/13 22:04 UTC
Linked by Thom Holwerda on 05/23/13 22:01 UTC
Linked by Thom Holwerda on 05/23/13 17:52 UTC
Linked by Thom Holwerda on 05/22/13 22:23 UTC
More News »
Sponsored Links



Member since:
2006-10-08
"To be frankly i think the firewall GUI in PCBSD is such a "budenzauber". I would like to see pf blocking all incoming connections by default. Yet tcp{22,445, 139} ports are open. I expected to see all ports to be filtered. "
Filtered? No. Closed, please. There's a RFC (cannot remember which) that requires closed ports to reply with a RST packet if closed, or ACK if open, but replying nothing is not recommended. Instead, having all ports closed for incomming connections (sending RST on request) would be good. If someone needs (!) to enable a certain connection (e. g. to run a web server, a mail server or allow SSH connections), he should be smart enough to do it on his own. As far as I know, OpenBSD has all ports closed by default and needs enabling by the user afterwards, if intended.
SSH functionality enabled by default is not that bad because it cannot be used without knowledge of a valid user account (name + password). Port 139/tcp is "netbios-ssn" and 445/tcp is "microsoft-ds", what are these needed for? I wondered in PC-BSD versions prior to 1.4...
A frontend to form pf rulesets could be a good idea, allthough I'd like to mention that I've formed my few firewall rules many years ago and never needed to change them.