Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #179180
| From | Dan Purgert <dan@djph.net> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Guide(s?) to backup philosophies |
| Date | 2017-03-23 10:30 +0100 |
| Message-ID | <to7ea-eW-25@gated-at.bofh.it> (permalink) |
| References | (5 earlier) <tmeWt-1mc-1@gated-at.bofh.it> <tnM02-11I-27@gated-at.bofh.it> <tnM03-11I-37@gated-at.bofh.it> <tnNp8-2fJ-13@gated-at.bofh.it> <tnNyN-2kr-1@gated-at.bofh.it> |
| Organization | A noiseless patient Spider |
<tomas@tuxteam.de> wrote: > > On Wed, Mar 22, 2017 at 11:57:44AM -0000, Dan Purgert wrote: >> <tomas@tuxteam.de> wrote: >> > >> > On Wed, Mar 22, 2017 at 10:35:13AM -0000, Dan Purgert wrote: >> >> David Christensen wrote: >> >> > On 03/17/2017 03:31 AM, Dan Purgert wrote: >> >> >> David Christensen wrote: >> >> >>> On 03/13/2017 05:38 AM, Dan Purgert wrote: >> >> >>> [...] >> >> > >> >> > I should clarify that: >> >> > >> >> > "The backup server can be firewalled with no incoming ports and >> >> > outgoing ports limited to SSH and other required ports". >> >> > >> >> > >> >> > I still need to figure out the "other required outgoing ports". >> >> > Suggestions and comments are welcome. >> >> >> >> Unfortunately, pretty much "all ephemeral ports", if the server is >> >> running things that initiate connections. Some programs allow you to >> >> specify what ports they're connecting from, but not all. >> > >> > That's what ESTABLISHED is for, in firewall jargon (you accept packets >> > belonging to an established TCP connection). >> > >> >> You're not gonna have any ESTABLISHED connections in your firewall if >> you're _initiating_ the connection. ;) >> >> if my firewall has the following rules: >> - default drop >> - rule 10 accept established >> >> the command: >> rsync (whatever switches) user@remote-host:/path/to/files/ /local/ >> >> Will fail to connect to remote-host, as the rsync command is not >> connecting across a previously established link. > > You're holding it wrong :) > > Remote-host has to allow connections (from wherever, perhaps only > from the backup host) *to* its port 22. The ESTABLISHED is for > rsync's "other leg". You do realize that the thread of discussion you hopped onto was specifically talking about if the "server box" was _initiating_ connections, right? Of course if the server is simply responding to incoming requests, "accept established" would let the responses back out. -- |_|O|_| Registered Linux user #585947 |_|_|O| Github: https://github.com/dpurgert |O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5 4AEE 8E11 DDF3 1279 A281
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Guide(s?) to backup philosophies Richard Owlett <rowlett@cloud85.net> - 2017-03-11 16:20 +0100
Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-11 22:10 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-13 14:00 +0100
Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-14 05:00 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-17 11:50 +0100
Re: Guide(s?) to backup philosophies Glenn English <ghe2001@gmail.com> - 2017-03-17 19:50 +0100
Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-18 06:20 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-22 11:50 +0100
Re: Guide(s?) to backup philosophies <tomas@tuxteam.de> - 2017-03-22 11:50 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-22 13:20 +0100
Re: Guide(s?) to backup philosophies <tomas@tuxteam.de> - 2017-03-22 13:30 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-23 10:30 +0100
Re: Guide(s?) to backup philosophies <tomas@tuxteam.de> - 2017-03-23 11:10 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-23 13:10 +0100
Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-23 04:00 +0100
Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-23 10:40 +0100
Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-23 20:10 +0100
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 14:10 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 23:20 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Nathan Dorfman <ndorf@rtfm.net> - 2017-04-01 11:00 +0200
should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) cbannister@slingshot.co.nz - 2017-03-31 14:10 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) <tomas@tuxteam.de> - 2017-03-31 14:20 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Brian <ad44@cityscape.co.uk> - 2017-03-31 15:20 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) <tomas@tuxteam.de> - 2017-03-31 15:30 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 15:30 +0200
Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 15:50 +0200
Re: Guide(s?) to backup philosophies Glenn English <ghe2001@gmail.com> - 2017-03-14 19:00 +0100
Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-14 19:20 +0100
Re: Guide(s?) to backup philosophies Miles Fidelman <mfidelman@meetinghouse.net> - 2017-03-14 20:20 +0100
Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-14 21:40 +0100
Re: Guide(s?) to backup philosophies Stefan Monnier <monnier@iro.umontreal.ca> - 2017-03-15 13:30 +0100
Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-15 14:10 +0100
Re: Guide(s?) to backup philosophies "Martin McCormick" <martin.m@suddenlink.net> - 2017-03-15 14:30 +0100
Re: Guide(s?) to backup philosophies Jonathan Dowland <jmtd@debian.org> - 2017-03-15 16:40 +0100
Re: Guide(s?) to backup philosophies Jonathan Dowland <jmtd@debian.org> - 2017-03-15 16:40 +0100
Re: Guide(s?) to backup philosophies Stefan Monnier <monnier@iro.umontreal.ca> - 2017-03-15 21:50 +0100
Re: Guide(s?) to backup philosophies songbird <songbird@anthive.com> - 2017-03-16 23:50 +0100
Re: Guide(s?) to backup philosophies Miles Fidelman <mfidelman@meetinghouse.net> - 2017-03-14 20:10 +0100
Re: Guide(s?) to backup philosophies Joe <joe@jretrading.com> - 2017-03-11 23:30 +0100
Re: Guide(s?) to backup philosophies Jonathan Dowland <jmtd@debian.org> - 2017-03-15 13:30 +0100
Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-13 15:20 +0100
Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-14 05:10 +0100
Re: Guide(s?) to backup philosophies Richard Owlett <rowlett@cloud85.net> - 2017-03-14 15:50 +0100
Re: Guide(s?) to backup philosophies Merlin Büge <toni@bluenox07.de> - 2017-03-14 19:50 +0100
Re: Guide(s?) to backup philosophies DdB <debianlist@potentially-spam.de-bruyn.de> - 2017-03-19 11:40 +0100
csiph-web