Re: Localhost connection refused

[Jonathan Q <jq@example.com>]

Glenn Evanish (glenn@example.com) wrote:

> >From something Johnathan wrote a while back I knew where to look for
> ipchains rules now and noticed there was nothing to let pop3 through, so
> because it was already late, I just changed all the REJECTs to ACCEPTs.  No
> dice.  It still refuses connections, including ftp.

Try disabling ipchains entirely:

/etc/rc.d/init.d/ipchains stop

and see if that changes things.  I imagine it would :-)

> My question boils down to this.  Security is all well and good, but it would
> be nice to see things work first and then put my #'s in and change my S's to
> s's to tighten it.  What else might it be in RH 7.1 that forbids stuff that
> Man7.1 allows?

Red Hat 7.1 gives you full control over what is allowed and not allowed
when you set up firewalling in the install.  To see what you allowed
and didn't, take a look at /etc/sysconfig/ipchains


> Also, how does one now stop and start telnet, pop3, etc if not in
> inetd.conf?  Anyone got a good URL to share?

I would not allow telnet even on a box that was behind a firewall,
NATted, running its own firewall, and properly locked down (of
course, "properly locked down" by definition means that telnet is
disabled) but you can find those things in /etc/xinetd.d.

Since that has all the usual suspects enabled by default, you do
need to visit this. A half-assed approach to security is better than
none, and a big step forward for Red Hat - at least they have
firewalling configurable during the install, but you're still
firewalling a box that has "own me now" tattoed on its forehead.
All someobdy has to do is find an exploit for the firewall or
attack when you have the firewall disabled.

What I did is created a new directory, /etc/xinetd.d/REMOVED and
put every entry from /etc/xinetd.d/ into it.  Multiple levels
of defense are important.  Run a firewall.  Secure the machine and
keep on top of all security updates (very easy with RH 7.1 
using up2date) and use tripwire.  Maybe run LIDS as well 
(be careful you don't lock yourself out with this one).  Maybe
use Snort, too.  The more layers of security and checks you have,
the safer you are.  That doesn't mean no one can get you, but
the more locked down you are, the fewer people are going to 
be able to do it. 

Jonathan
-- 
There is Bag of Modul in the router