[ILUG] Network cracking toolkit?

[Rick Moen]

Quoting wintermute (cout at eircom.net):

> From the server's side of the equation, you might want to think about
> leaving some ports in your firewall config open (but not actually running
> any services).
> 
> On these open ports you set up portsentry.
> 
> Then you wait for someone to smurf your server with nmap or the like and
> tertly have portsentry block out that user's ip permenantly.

So, anyone who is able to send forged smurf packets can maneouver your 
host into null-routing arbitrary IP addresses.  Not necessarily good for
you.

> You might even think about having port sentry do a nmap on 'whoever' it was
> smurfed you to begin with.

So, anyone who is able to send forged smurf packets can maneouver your
host into port-scanning arbitrary IP addresses.  Not necessarily wise
for you.

That's one of the basic design problems of portsentry.  The other is
that, used in that fashion, it invites probes of those
seemingly-vulnerable open ports.  Is it really in your interest to run
even minor honeypots?  I phrase that as a question because it's
debatable.  Here's one viewpoint that says no:
http://linuxmafia.com/~rick/linux-info/ids-baylisa

-- 
Cheers,                                      "Reality is not optional."
Rick Moen                                             -- Thomas Sowell
rick at linuxmafia.com