faq
flatforty
contribute
subscribe
configure
search
rdf
main
parent
|
Guarddog is insecure by default!
by c on Monday 01/Aug/2005, @22:09
|
| Let your computer be an ICQ _client_ and the supposedly "secure by default" firewall opens all _server_ ports >= 1024!!! |
|
|
The Fine Print: The following comments
are owned by whomever posted them.
( Reply )
|
Re: Guarddog is insecure by default!
by Simon Edwards on Tuesday 02/Aug/2005, @02:45
|
then don't use ICQ. Seriously, the ICQ protocol is grossly insecure and just doesn't work with firewalls. ICQ wants almost every port open so that it can do direct connections for chat.
--
Simon
|
[
Reply To This | View ]
|
Re: Guarddog is insecure by default!
by Roberto Alsina on Tuesday 02/Aug/2005, @05:30
|
Perhaps it could check using netstat which server ports >1024 are already in use and exclude them from the rule?
Ok, it's harder, and it is not perfect, but it is slightly better.
Another idea: it could ask the user what ICQ app (say kopete) he is using and then do something like "-m owner --cmdowner kopete" on the iptables rule.
Or, you could have ICQ-kopete ICQ-whatever rules.
Of course, that only works on the OUTPUT chain, so the connection may still take place, but the box shouldn't send much stuff over that connection that isn't ICQ (or gadu-gadu/MSN/whatever kopete can handle), I suppose.
|
[
Reply To This | View ]
|
Re: Guarddog is insecure by default!
by c on Tuesday 02/Aug/2005, @17:59
|
then do 1 or more of the following:
1. warn that the icq protocol is not secure
2. use ralsina's proposal
3. don't advertise guarddog as secure by default
|
[
Reply To This | View ]
|
Re: Guarddog is insecure by default!
by Simon Edwards on Tuesday 02/Aug/2005, @22:16
|
> 1. warn that the icq protocol is not secure
I'll have a good think about how best to communicate that to the user.
(Suggestions are welcome. I'm gravitating towards any extra 'risk' column with a small rating symbol. Instead of little gold stars there will be scary little skull-and-crossbones symbols. :-) Seriously, that is exactly what I am thinking now.)
> 2. use ralsina's proposal
That is not likely to happen soon. It is, well, radically different than the current approach.
> 3. don't advertise guarddog as secure by default
ICQ is not on by default.
--
Simon
|
[
Reply To This | View ]
|
Re: Guarddog is insecure by default!
by dsaf on Thursday 04/Aug/2005, @03:29
|
> > 1. warn that the icq protocol is not secure
> I'll have a good think about how best to communicate that to the user.
> (Suggestions are welcome. I'm gravitating towards any extra 'risk' column
> with a small rating symbol. Instead of little gold stars there will be scary
> little skull-and-crossbones symbols. :-) Seriously, that is exactly what I am
> thinking now.)
In addition to that, how about a GRC-style set of coloured boxes that show what ports Guarddog has opened up. Additionally doubly warn of server ports that are opened up.
> > 3. don't advertise guarddog as secure by default
> ICQ is not on by default.
Oh please. The real issue is this:
No user can expect that allowing an ICQ client turns their computer into an open server!
|
[
Reply To This | View ]
|
Re: Guarddog is insecure by default!
by Simon Edwards on Thursday 04/Aug/2005, @10:04
|
To be honest I don't think that warning the user is really going to help much. People don't read warnings. The best idea I can think of right now is to choose a range of ports and open only those for ICQ, and tell everyone to configure their ICQ client. That looks like the safest way to me.
(Email me, or take this to the mailing list. Lets not take over the Dot. ;) )
--
Simon
|
[
Reply To This | View ]
|
|
Re: Guarddog is insecure by default!
by Nick on Tuesday 02/Aug/2005, @07:43
|
use jabber's icq transport (its supported at least by psi)
|
[
Reply To This | View ]
|
The Fine Print: The previous
comments are owned by whomever posted them.
( Reply )
|
|
![[KDE Dot News]](http://www.kde.org/dot/Images/kdedotnews.gif)
