Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #157019 > unrolled thread
| Started by | rlharris@oplink.net |
|---|---|
| First post | 2015-08-29 07:00 +0200 |
| Last post | 2015-08-30 21:10 +0200 |
| Articles | 20 on this page of 73 — 22 participants |
Back to article view | Back to linux.debian.user
laptop protection in an office network rlharris@oplink.net - 2015-08-29 07:00 +0200
Re: laptop protection in an office network Riley Baird <BM-2cVqnDuYbAU5do2DfJTrN7ZbAJ246S4XiX@bitmessage.ch> - 2015-08-29 08:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 08:20 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 09:20 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 10:20 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 14:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 18:20 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 18:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 20:30 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 20:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:50 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 02:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 03:30 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 03:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 04:30 +0200
Re: laptop protection in an office network Doug <dmcgarrett@optonline.net> - 2015-08-30 04:50 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 05:00 +0200
Re: laptop protection in an office network Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 00:20 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 05:10 +0200
Re: laptop protection in an office network David Wright <deblis@lionunicorn.co.uk> - 2015-08-30 06:40 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 07:30 +0200
Re: laptop protection in an office network Martin Read <zen75502@zen.co.uk> - 2015-08-31 03:50 +0200
quality keyboards rlharris@oplink.net - 2015-08-31 09:10 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 09:40 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 09:50 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 12:00 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:20 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 14:30 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 14:40 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 15:50 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 16:40 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 17:00 +0200
Re: quality keyboards Anthony Maples <anthonym7009@gmail.com> - 2015-09-01 00:10 +0200
Re: quality keyboards "Thomas Schmitt" <scdbackup@gmx.net> - 2015-08-31 16:10 +0200
Re: quality keyboards Haines Brown <haines@histomat.net> - 2015-08-31 13:00 +0200
Re: quality keyboards Curt <curty@free.fr> - 2015-08-31 14:20 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:10 +0200
Re: quality keyboards Gene Heskett <gheskett@wdtv.com> - 2015-08-31 14:30 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 15:00 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 15:10 +0200
Re: quality keyboards Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 15:10 +0200
Re: quality keyboards Martin Read <zen75502@zen.co.uk> - 2015-08-31 13:20 +0200
Re: quality keyboards David Wright <deblis@lionunicorn.co.uk> - 2015-08-31 17:40 +0200
Re: quality keyboards Glenn English <ghe@slsware.net> - 2015-08-31 18:30 +0200
Re: quality keyboards Don Armstrong <don@debian.org> - 2015-08-31 21:50 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:20 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:50 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 22:00 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-30 00:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:50 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:40 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 16:10 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 18:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 20:50 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 22:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:50 +0200
Re: laptop protection in an office network Renaud (Ron) OLGIATI <renaud@olgiati-in-paraguay.org> - 2015-08-29 23:40 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 23:00 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:50 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-30 10:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 01:50 +0200
Re: laptop protection in an office network Chris Bannister <cbannister@slingshot.co.nz> - 2015-08-30 09:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 11:10 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 21:10 +0200
Page 1 of 4 [1] 2 3 4 Next page →
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 07:00 +0200 |
| Subject | laptop protection in an office network |
| Message-ID | <q2Gpb-8p8-1@gated-at.bofh.it> |
Several times a month I need to take my laptop (which is running Debian Jessie) into the office of a client and connect it to his network (he has both Ethernet and WiFi). The need is to view and save web pages (real estate listings) posted by commercial listing services and by other agencies. The client is running several windows machines. Do I need to take special precautions such as configuring the iptable firewall on my laptop? Is the laptop likely to "pick up" anything (virus, trojan, or whatever) which could compromise the machines in my own network? RLH
[toc] | [next] | [standalone]
| From | Riley Baird <BM-2cVqnDuYbAU5do2DfJTrN7ZbAJ246S4XiX@bitmessage.ch> |
|---|---|
| Date | 2015-08-29 08:00 +0200 |
| Message-ID | <q2Hlf-1in-1@gated-at.bofh.it> |
| In reply to | #157019 |
[Multipart message — attachments visible in raw view] — view raw
On Fri, 28 Aug 2015 23:56:17 -0500 rlharris@oplink.net wrote: > Several times a month I need to take my laptop (which is running Debian > Jessie) into the office of a client and connect it to his network (he has > both Ethernet and WiFi). The need is to view and save web pages (real > estate listings) posted by commercial listing services and by other > agencies. The client is running several windows machines. > > Do I need to take special precautions such as configuring the iptable > firewall on my laptop? Is the laptop likely to "pick up" anything (virus, > trojan, or whatever) which could compromise the machines in my own > network? Probably not, if you have no network services running on your laptop.
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 08:20 +0200 |
| Message-ID | <q2HEC-1Ub-7@gated-at.bofh.it> |
| In reply to | #157020 |
On Sat, August 29, 2015 12:53 am, Riley Baird wrote: > On Fri, 28 Aug 2015 23:56:17 -0500 > rlharris@oplink.net wrote: >> Do I need to take special precautions such as configuring the iptable >> firewall on my laptop? Is the laptop likely to "pick up" anything >> (virus, trojan, or whatever) which could compromise the machines in my >> own network? > > Probably not, if you have no network services running on your laptop. On https://wiki.debian.org/Network I find the following list of network services: Printing, Data Base, DHCP, DNS, FTP, LDAP, Mail, Monitoring, NTP, PPP, Remote Display, File sharing, Disk Sharing, SSH, SVN, Web Server, IM, IPSec VPN, Azureus as a daemon I do not recall all the details of the installation, but I did install SSH, printing, and approx. I may have installed NTP and a web server. I did not install mail. The laptop uses DHCP to get an ip address from the router, but DHCP as a network service must have to do with a machine used as a router, correct? Installing again would take only a few hours, most of the time being spent on configuration of the XFCE desktop. RLH
[toc] | [prev] | [next] | [standalone]
| From | Joe <joe@jretrading.com> |
|---|---|
| Date | 2015-08-29 09:20 +0200 |
| Message-ID | <q2IAG-3ek-7@gated-at.bofh.it> |
| In reply to | #157022 |
On Sat, 29 Aug 2015 01:16:35 -0500 rlharris@oplink.net wrote: > On Sat, August 29, 2015 12:53 am, Riley Baird wrote: > > On Fri, 28 Aug 2015 23:56:17 -0500 > > rlharris@oplink.net wrote: > >> Do I need to take special precautions such as configuring the > >> iptable firewall on my laptop? Is the laptop likely to "pick up" > >> anything (virus, trojan, or whatever) which could compromise the > >> machines in my own network? > > > > Probably not, if you have no network services running on your > > laptop. > > On https://wiki.debian.org/Network I find the following list of > network services: > > Printing, Data Base, DHCP, DNS, FTP, LDAP, Mail, Monitoring, NTP, PPP, > Remote Display, File sharing, Disk Sharing, SSH, SVN, Web Server, IM, > IPSec VPN, Azureus as a daemon > > I do not recall all the details of the installation, but I did install > SSH, printing, and approx. I may have installed NTP and a web > server. I did not install mail. > > The laptop uses DHCP to get an ip address from the router, but DHCP as > a network service must have to do with a machine used as a router, > correct? > > Installing again would take only a few hours, most of the time being > spent on configuration of the XFCE desktop. > Do you have other Linux machines in your network? If so, use nmap from one of them to see what services your laptop is offering. It is possible to install nmap on Windows, but Windows networking is such a pain these days that I wouldn't trust the results of running it. In particular, Windows AV software is increasingly invasive. If you don't have another Linux machine, you could run a Live CD/USB. -- Joe
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 10:20 +0200 |
| Message-ID | <q2JwJ-4yL-5@gated-at.bofh.it> |
| In reply to | #157025 |
On Sat, August 29, 2015 2:10 am, Joe wrote: > Do you have other Linux machines in your network? If so, use nmap from > one of them to see what services your laptop is offering. > > It is possible to install nmap on Windows, but Windows networking is > such a pain these days that I wouldn't trust the results of running it. In > particular, Windows AV software is increasingly invasive. If you don't > have another Linux machine, you could run a Live CD/USB. My home LAN is all-Debian. The office LAN to which I need to connect is all-Windows. First thing tomorrow I plan to install nmap on this machine, then fire up the laptop and take a look. Thanks. RLH
[toc] | [prev] | [next] | [standalone]
| From | <tomas@tuxteam.de> |
|---|---|
| Date | 2015-08-29 14:00 +0200 |
| Message-ID | <q2MXE-Td-9@gated-at.bofh.it> |
| In reply to | #157029 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sat, Aug 29, 2015 at 03:13:59AM -0500, rlharris@oplink.net wrote: > On Sat, August 29, 2015 2:10 am, Joe wrote: > > Do you have other Linux machines in your network? If so, use nmap from > > one of them to see what services your laptop is offering. > > > > It is possible to install nmap on Windows, but Windows networking is > > such a pain these days that I wouldn't trust the results of running it. In > > particular, Windows AV software is increasingly invasive. If you don't > > have another Linux machine, you could run a Live CD/USB. > > My home LAN is all-Debian. The office LAN to which I need to connect is > all-Windows. Also netstat (issued from your laptop) gives insight. For example 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are root (or sudo, of course), the extra option -p tells you which process is "at the other side" listening. Note that the dhcp client itself (which you need to get an IP address to take part in your customer's network) puts you already at some risk, depending on how it's configured. hth - - tomás -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlXhnTEACgkQBcgs9XrR2kaUHgCfSQhmUIZaWAbmqA52Sa/wkVdn ThQAn22cOi3CiixWjiNT10CfJKyZbgBU =zSwU -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 18:20 +0200 |
| Message-ID | <q2R1g-6Wa-5@gated-at.bofh.it> |
| In reply to | #157036 |
On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > Also netstat (issued from your laptop) gives insight. For example > 'netstat > - -lntu' shows you the TCP or UDP listening sockets. If you are root (or > sudo, of course), the extra option -p tells you which process is "at the > other side" listening. With synaptic, I see the following Debian packages, but no plain "netstat": netstat-nat nicstat vnstat
[toc] | [prev] | [next] | [standalone]
| From | Joe <joe@jretrading.com> |
|---|---|
| Date | 2015-08-29 18:30 +0200 |
| Message-ID | <q2RaV-77s-9@gated-at.bofh.it> |
| In reply to | #157056 |
On Sat, 29 Aug 2015 11:12:07 -0500 rlharris@oplink.net wrote: > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > Also netstat (issued from your laptop) gives insight. For example > > 'netstat > > - -lntu' shows you the TCP or UDP listening sockets. If you are > > root (or sudo, of course), the extra option -p tells you which > > process is "at the other side" listening. > > With synaptic, I see the following Debian packages, but no plain > "netstat": > > netstat-nat > nicstat > vnstat > net-tools is the package which contains netstat, and I would expect it to be a core Debian package. You should have it installed. A number of command-line utilities are part of a larger package. When in doubt, try man <utility> and the parent package will be named at the end of the text. -- Joe
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 20:30 +0200 |
| Message-ID | <q2T34-1mE-3@gated-at.bofh.it> |
| In reply to | #157036 |
On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote:
> Also netstat (issued from your laptop) gives insight. For example
> 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are
> root (or sudo, of course), the extra option -p tells you which process is
> "at the other side" listening.
>
> Note that the dhcp client itself (which you need to get an IP address to
> take part in your customer's network) puts you already at some risk,
> depending on how it's configured.
Here is the output from the laptop:
# netstat -lntup
Active Internet connections (only servers)
Prot Rec Snd Local Address Foreign State PID/Program name
-Q -Q Address
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LIS 561/inetd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LIS 530/rpcbind
tcp 0 0 0.0.0.0:46225 0.0.0.0:* LIS 540/rpc.statd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LIS 568/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LIS 1248/cupsd
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LIS 675/postgres
tcp 0 0 127.0.0.1:25 0.0.0.0:* LIS 1063/exim4
tcp 0 0 127.0.0.1:2628 0.0.0.0:* LIS 599/0
tcp6 0 0 :::111 :::* LIS 530/rpcbind
tcp6 0 0 :::38930 :::* LIS 540/rpc.statd
tcp6 0 0 :::22 :::* LIS 568/sshd
tcp6 0 0 ::1:631 :::* LIS 1248/cupsd
tcp6 0 0 ::1:5432 :::* LIS 675/postgres
tcp6 0 0 ::1:25 :::* LIS 1063/exim4
udp 0 0 0.0.0.0:36358 0.0.0.0:* 612/avahi-daemon:r
udp 0 0 0.0.0.0:631 0.0.0.0:* 647/cups-browsed
udp 0 0 0.0.0.0:689 0.0.0.0:* 530/rpcbind
udp 0 0 127.0.0.1:716 0.0.0.0:* 540/rpc.statd
udp 0 0 0.0.0.0:57106 0.0.0.0:* 540/rpc.statd
udp 0 0 0.0.0.0:111 0.0.0.0:* 530/rpcbind
udp 0 0 192.168.1.99:123 0.0.0.0:* 664/ntpd
udp 0 0 127.0.0.1:123 0.0.0.0:* 664/ntpd
udp 0 0 0.0.0.0:123 0.0.0.0:* 664/ntpd
udp 0 0 0.0.0.0:5353 0.0.0.0:* 612/avahi-daemon:r
udp6 0 0 :::689 :::* 530/rpcbind
udp6 0 0 :::43913 :::* 540/rpc.statd
udp6 0 0 :::111 :::* 530/rpcbind
udp6 0 0 fe80::ba70:f4ff:fe2:123 :::* 664/ntpd
udp6 0 0 ::1:123 :::* 664/ntpd
udp6 0 0 :::123 :::* 664/ntpd
udp6 0 0 :::5353 :::* 612/avahi-daemon:r
udp6 0 0 :::44274 :::* 612/avahi-daemon:r
#
Regrettably, the formatting of the output does not consider the need to
include the output in the body of an e-mail, so editing was required to
remove excess spaces so as to prevent every line from being wrapped.
RLH
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2015-08-29 20:40 +0200 |
| Message-ID | <q2TcK-1y2-15@gated-at.bofh.it> |
| In reply to | #157060 |
Hi. On Sat, 29 Aug 2015 13:25:28 -0500 rlharris@oplink.net wrote: > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > Also netstat (issued from your laptop) gives insight. For example > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > root (or sudo, of course), the extra option -p tells you which process is > > "at the other side" listening. > > > > Note that the dhcp client itself (which you need to get an IP address to > > take part in your customer's network) puts you already at some risk, > > depending on how it's configured. > > Here is the output from the laptop: > > # netstat -lntup > Active Internet connections (only servers) > Prot Rec Snd Local Address Foreign State PID/Program name > -Q -Q Address > tcp 0 0 0.0.0.0:9999 0.0.0.0:* LIS 561/inetd > tcp 0 0 0.0.0.0:111 0.0.0.0:* LIS 530/rpcbind > tcp 0 0 0.0.0.0:46225 0.0.0.0:* LIS 540/rpc.statd > tcp 0 0 0.0.0.0:22 0.0.0.0:* LIS 568/sshd > tcp 0 0 127.0.0.1:631 0.0.0.0:* LIS 1248/cupsd > tcp 0 0 127.0.0.1:5432 0.0.0.0:* LIS 675/postgres > tcp 0 0 127.0.0.1:25 0.0.0.0:* LIS 1063/exim4 > tcp 0 0 127.0.0.1:2628 0.0.0.0:* LIS 599/0 > tcp6 0 0 :::111 :::* LIS 530/rpcbind > tcp6 0 0 :::38930 :::* LIS 540/rpc.statd > tcp6 0 0 :::22 :::* LIS 568/sshd > tcp6 0 0 ::1:631 :::* LIS 1248/cupsd > tcp6 0 0 ::1:5432 :::* LIS 675/postgres > tcp6 0 0 ::1:25 :::* LIS 1063/exim4 > udp 0 0 0.0.0.0:36358 0.0.0.0:* 612/avahi-daemon:r > udp 0 0 0.0.0.0:631 0.0.0.0:* 647/cups-browsed > udp 0 0 0.0.0.0:689 0.0.0.0:* 530/rpcbind > udp 0 0 127.0.0.1:716 0.0.0.0:* 540/rpc.statd > udp 0 0 0.0.0.0:57106 0.0.0.0:* 540/rpc.statd > udp 0 0 0.0.0.0:111 0.0.0.0:* 530/rpcbind > udp 0 0 192.168.1.99:123 0.0.0.0:* 664/ntpd > udp 0 0 127.0.0.1:123 0.0.0.0:* 664/ntpd > udp 0 0 0.0.0.0:123 0.0.0.0:* 664/ntpd > udp 0 0 0.0.0.0:5353 0.0.0.0:* 612/avahi-daemon:r > udp6 0 0 :::689 :::* 530/rpcbind > udp6 0 0 :::43913 :::* 540/rpc.statd > udp6 0 0 :::111 :::* 530/rpcbind > udp6 0 0 fe80::ba70:f4ff:fe2:123 :::* 664/ntpd > udp6 0 0 ::1:123 :::* 664/ntpd > udp6 0 0 :::123 :::* 664/ntpd > udp6 0 0 :::5353 :::* 612/avahi-daemon:r > udp6 0 0 :::44274 :::* 612/avahi-daemon:r > # > > Regrettably, the formatting of the output does not consider the need to > include the output in the body of an e-mail, so editing was required to > remove excess spaces so as to prevent every line from being wrapped. Something like this should save you from the most troubles provided that you don't plan to use your laptop as a print server or NFS: iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT iptables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p udp --dport 123 -j ACCEPT iptables -P FORWARD DROP ip6tables -P INPUT DROP ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables -A INPUT -m conntrack --ctstate INVALID -j DROP ip6tables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT ip6tables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT ip6tables -A INPUT -p udp --dport 123 -j ACCEPT ip6tables -P FORWARD DROP Of course, it's *very* simplistic set of rules (for example, someone may consider accepting ssh connections from arbitrary hosts a bad idea), but it should work. Two things I'm unsure of are: 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office network), but YMMV. 2) Whatever thing you're listening for on tcp 9999 with inetd. Reco
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 21:10 +0200 |
| Message-ID | <q2TFM-2lh-1@gated-at.bofh.it> |
| In reply to | #157061 |
On Sat, August 29, 2015 1:39 pm, Reco wrote: > Something like this should save you from the most troubles provided > that you don't plan to use your laptop as a print server or NFS: I am not sure how "print server" is defined. I installed CUPS so that I can print to a laser printer in my home network. And if my client gives me a URL which I view on the laptop, it would be nice to be able to bookmark the URL and, once I am back home, bring up and print the web page directly from the laptop. As to NSF, I had to search with google to find the definition. No, on the laptop and in my LAN the only drives accessed are internal, formatted with ext4, and an external USB. > iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT > -p icmp -j ACCEPT > iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT > -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ > -j ACCEPT > iptables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ -j > ACCEPT > iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p udp > --dport 123 -j ACCEPT > > iptables -P FORWARD DROP > > ip6tables -P INPUT DROP ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables > -A INPUT -m conntrack --ctstate INVALID -j DROP > ip6tables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ -j > ACCEPT > ip6tables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ -j > ACCEPT > ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT ip6tables -A INPUT -p udp > --dport 123 -j ACCEPT > > ip6tables -P FORWARD DROP > > > Of course, it's *very* simplistic set of rules (for example, someone > may consider accepting ssh connections from arbitrary hosts a bad idea), > but it should work. And I thank you. > Two things I'm unsure of are: > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > network), but YMMV. I have been running Debian for thirteen years, but I know absolutely nothing about avahi. It must have been installed by default, or else, perhaps as a dependency of some other package. > 2) Whatever thing you're listening for on tcp 9999 with inetd. Ah! 9999 is the port used by the approx server. Months ago I had to install Debian on a system in another location which had a substandard DSL connection. And whenever I do a Debian netinst, I always use approx, "just in case". So that is why I installed approx on the laptop. RLH
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2015-08-29 21:30 +0200 |
| Message-ID | <q2TZ7-2Ii-11@gated-at.bofh.it> |
| In reply to | #157062 |
On Sat, 29 Aug 2015 14:05:57 -0500 rlharris@oplink.net wrote: > On Sat, August 29, 2015 1:39 pm, Reco wrote: > > > Something like this should save you from the most troubles provided > > that you don't plan to use your laptop as a print server or NFS: > > I am not sure how "print server" is defined. An installed CUPS that allows connections from any host other than yours. Currently it's not your case. > As to NSF, I had to search with google to find the definition. No, on the > laptop and in my LAN the only drives accessed are internal, formatted with > ext4, and an external USB. Ok. In that case you'll lose nothing if you remove "rpcbind" and "nfs-common" packages. > > Of course, it's *very* simplistic set of rules (for example, someone > > may consider accepting ssh connections from arbitrary hosts a bad idea), > > but it should work. > > And I thank you. You're welcome. > > Two things I'm unsure of are: > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > > network), but YMMV. > > I have been running Debian for thirteen years, but I know absolutely > nothing about avahi. It must have been installed by default, or else, > perhaps as a dependency of some other package. It's CUPS, probably. CUPS *client* can use Avahi to discover CUPS *servers* on a *network*. It's completely useless if you have your own CUPS with you and only print to a locally attached printer. It's also useless if you *know* which print-server you'll use today. > > 2) Whatever thing you're listening for on tcp 9999 with inetd. > > Ah! 9999 is the port used by the approx server. Months ago I had to > install Debian on a system in another location which had a substandard DSL > connection. And whenever I do a Debian netinst, I always use approx, > "just in case". So that is why I installed approx on the laptop. Oh. Then it's definitely should be shielded with iptables. Unless, of course, you plan to provide Debian packages to anyone on your LAN. Reco
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 21:50 +0200 |
| Message-ID | <q2Uiu-38a-13@gated-at.bofh.it> |
| In reply to | #157066 |
On Sat, August 29, 2015 2:26 pm, Reco wrote: >> 9999 is the port used by the approx server. Months ago I had to >> install Debian on a system in another location which had a substandard >> DSL connection. And whenever I do a Debian netinst, I always use >> approx, "just in case". So that is why I installed approx on the laptop. > > Oh. Then it's definitely should be shielded with iptables. Unless, of > course, you plan to provide Debian packages to anyone on your LAN. It would be nice to have approx running and configured on a laptop, in case that I again have need to install Debian outside of my own LAN. But that is not very likely. For installations -- and for updates to machines within the LAN -- I have been running approx on a desktop machine. So I would be willing to uninstall approx on the laptop, if you so advise. Then, again, this is my first encounter with iptables, and I am finding this thread interesting. RLH
[toc] | [prev] | [next] | [standalone]
| From | Gene Heskett <gheskett@wdtv.com> |
|---|---|
| Date | 2015-08-30 02:40 +0200 |
| Message-ID | <q2YP7-1in-1@gated-at.bofh.it> |
| In reply to | #157062 |
On Saturday 29 August 2015 15:05:57 rlharris@oplink.net wrote: > On Sat, August 29, 2015 1:39 pm, Reco wrote: > > Something like this should save you from the most troubles provided > > that you don't plan to use your laptop as a print server or NFS: > > I am not sure how "print server" is defined. I installed CUPS so that > I can print to a laser printer in my home network. And if my client > gives me a URL which I view on the laptop, it would be nice to be able > to bookmark the URL and, once I am back home, bring up and print the > web page directly from the laptop. > > As to NSF, I had to search with google to find the definition. No, on > the laptop and in my LAN the only drives accessed are internal, > formatted with ext4, and an external USB. NSF is incorrect, its NFS, aka Network File System. > > iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A > > INPUT -p icmp -j ACCEPT > > iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A > > INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ > > -j ACCEPT > > iptables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED > > \ -j ACCEPT > > iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p > > udp --dport 123 -j ACCEPT > > > > iptables -P FORWARD DROP > > > > ip6tables -P INPUT DROP ip6tables -A INPUT -p ipv6-icmp -j ACCEPT > > ip6tables -A INPUT -m conntrack --ctstate INVALID -j DROP > > ip6tables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED > > \ -j ACCEPT > > ip6tables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED > > \ -j ACCEPT > > ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT ip6tables -A INPUT -p > > udp --dport 123 -j ACCEPT > > > > ip6tables -P FORWARD DROP > > > > > > Of course, it's *very* simplistic set of rules (for example, someone > > may consider accepting ssh connections from arbitrary hosts a bad > > idea), but it should work. > > And I thank you. > > > Two things I'm unsure of are: > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in > > office network), but YMMV. > > I have been running Debian for thirteen years, but I know absolutely > nothing about avahi. It must have been installed by default, or else, > perhaps as a dependency of some other package. > > > 2) Whatever thing you're listening for on tcp 9999 with inetd. > > Ah! 9999 is the port used by the approx server. Months ago I had to > install Debian on a system in another location which had a substandard > DSL connection. And whenever I do a Debian netinst, I always use > approx, "just in case". So that is why I installed approx on the > laptop. > > RLH Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Genes Web page <http://geneslinuxbox.net:6309/gene>
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-30 03:30 +0200 |
| Message-ID | <q2ZBv-2rS-3@gated-at.bofh.it> |
| In reply to | #157085 |
On Sat, August 29, 2015 7:35 pm, Gene Heskett wrote: > NSF is incorrect, its NFS, aka Network File System. Forgive me; my fingers are dyslexic. RLH -- Bumper Sticker: DYSLEXICS UNTIE!
[toc] | [prev] | [next] | [standalone]
| From | Gene Heskett <gheskett@wdtv.com> |
|---|---|
| Date | 2015-08-30 03:40 +0200 |
| Message-ID | <q2ZLb-2Da-1@gated-at.bofh.it> |
| In reply to | #157089 |
On Saturday 29 August 2015 21:24:47 rlharris@oplink.net wrote: > On Sat, August 29, 2015 7:35 pm, Gene Heskett wrote: > > NSF is incorrect, its NFS, aka Network File System. > > Forgive me; my fingers are dyslexic. > > RLH So are mine. They don't type what I tell them to lots of the time. Coulnd't be the accumulated years (nearly 81) could it? Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Genes Web page <http://geneslinuxbox.net:6309/gene>
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-30 04:30 +0200 |
| Message-ID | <q30xA-3RN-5@gated-at.bofh.it> |
| In reply to | #157090 |
On Sat, August 29, 2015 8:33 pm, Gene Heskett wrote: > On Saturday 29 August 2015 21:24:47 rlharris@oplink.net wrote: >> Forgive me; my fingers are dyslexic. > So are mine. They don't type what I tell them to lots of the time. > Coulnd't be the accumulated years (nearly 81) could it? Not necessarily. >From time to time, I have found a sudden, large increase in the number of typographical errors in the documents which I produce. And several times, investigation has revealed that the problem lies in a worn-out keyboard. Back in the 1960's and 1970's, manufacturers such as Honeywell and Cherry made keyswitches with a life rating in the tens of millions or even hundreds of millions of keystrokes. Nowadays, it is becoming difficult to find a keyboard with a rating in the tens of thousands of keystrokes. Many manufacturers today have a poor keyswitch design which utilizes low-quality plastics; they depend upon a lubricant such as wax to keep the plunger working freely. And when the wax wears away, the plunger begins to stick. And when the plunger does not depress freely, the result is a multitude of typographical errors. RLH
[toc] | [prev] | [next] | [standalone]
| From | Doug <dmcgarrett@optonline.net> |
|---|---|
| Date | 2015-08-30 04:50 +0200 |
| Message-ID | <q30QV-4dX-3@gated-at.bofh.it> |
| In reply to | #157092 |
On 08/29/2015 09:20 PM, rlharris@oplink.net wrote: > On Sat, August 29, 2015 8:33 pm, Gene Heskett wrote: >> On Saturday 29 August 2015 21:24:47 rlharris@oplink.net wrote: >>> Forgive me; my fingers are dyslexic. >> So are mine. They don't type what I tell them to lots of the time. >> Coulnd't be the accumulated years (nearly 81) could it? > > Not necessarily. > >>From time to time, I have found a sudden, large increase in the number of > typographical errors in the documents which I produce. And several times, > investigation has revealed that the problem lies in a worn-out keyboard. > > Back in the 1960's and 1970's, manufacturers such as Honeywell and Cherry > made keyswitches with a life rating in the tens of millions or even > hundreds of millions of keystrokes. Nowadays, it is becoming difficult to > find a keyboard with a rating in the tens of thousands of keystrokes. > > Many manufacturers today have a poor keyswitch design which utilizes > low-quality plastics; they depend upon a lubricant such as wax to keep the > plunger working freely. And when the wax wears away, the plunger begins > to stick. And when the plunger does not depress freely, the result is a > multitude of typographical errors. > > RLH > > > What you need is an IBM model M keyboard. They are refurbished and sold by Clicky Keys: http://www.clickykeyboards.com/ as well as some other designs that use prime components. I am using three model M keyboards here, on two desktops and on one in-place laptop. I got these 15 or more years ago, as surplus from office closings, etc. They have never been refurbished and work perfectly, and they will surely be working perfectly long after I'm dead, if some nincompoop doesn't throw them out for not having Windows keys. (You can get a keyboard modifier program to make some hardly-used key into a Win key. I have selected the * above the number block.) You probably don't need the right Windows key--that would be a good key to make into a Compose key, but since I don't have that key either, I use the right ALT key for Compose. Do not be bummed by the price: you buy that once and you will never need another! --doug
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-30 05:00 +0200 |
| Message-ID | <q310B-4pd-3@gated-at.bofh.it> |
| In reply to | #157093 |
On Sun, August 30, 2015 10:42 pm, Doug wrote: > What you need is an IBM model M keyboard. They are refurbished and sold > by Clicky Keys: > > http://www.clickykeyboards.com/ > (You can get a keyboard modifier program to make some hardly-used key > into a Win key. I have selected the * above the number block.) You probably > don't need the right Windows key--that would be a good key to make into a > Compose key, but since I don't have that key either, I use the right ALT > key for Compose. This is a Windows-free environment (except for a Windows machine which I keep in the closet but hardly ever turn on anymore). Besides, I use the Dvorak Classic keymap. Thanks; these look good. RLH
[toc] | [prev] | [next] | [standalone]
| From | Lisi Reisz <lisi.reisz@gmail.com> |
|---|---|
| Date | 2015-08-31 00:20 +0200 |
| Message-ID | <q3j7c-5ke-3@gated-at.bofh.it> |
| In reply to | #157093 |
On Monday 31 August 2015 04:42:12 Doug wrote: > On 08/29/2015 09:20 PM, rlharris@oplink.net wrote: > > On Sat, August 29, 2015 8:33 pm, Gene Heskett wrote: > >> On Saturday 29 August 2015 21:24:47 rlharris@oplink.net wrote: > >>> Forgive me; my fingers are dyslexic. > >> > >> So are mine. They don't type what I tell them to lots of the time. > >> Coulnd't be the accumulated years (nearly 81) could it? > > > > Not necessarily. > > > >>From time to time, I have found a sudden, large increase in the number of > > > > typographical errors in the documents which I produce. And several > > times, investigation has revealed that the problem lies in a worn-out > > keyboard. > > > > Back in the 1960's and 1970's, manufacturers such as Honeywell and Cherry > > made keyswitches with a life rating in the tens of millions or even > > hundreds of millions of keystrokes. Nowadays, it is becoming difficult > > to find a keyboard with a rating in the tens of thousands of keystrokes. > > > > Many manufacturers today have a poor keyswitch design which utilizes > > low-quality plastics; they depend upon a lubricant such as wax to keep > > the plunger working freely. And when the wax wears away, the plunger > > begins to stick. And when the plunger does not depress freely, the > > result is a multitude of typographical errors. > > > > RLH > > What you need is an IBM model M keyboard. They are refurbished and sold by > Clicky Keys: > > http://www.clickykeyboards.com/ I use an IBM KB-9910. Not quite as good as the Model M, nor as good as I was trying to find, but not bad. I make loads of typos. Old age? Poor sight? The fact that I am a lousy typist? The last one certainly. The sight doesn't help. But so far I don't feel that old age has exacerbated things. Lisi
[toc] | [prev] | [next] | [standalone]
Page 1 of 4 [1] 2 3 4 Next page →
Back to top | Article view | linux.debian.user
csiph-web