Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
You manage a heterogeneous network and want to provide different Quality of Service agreements and network restrictions based on the client operating system. With pf and altq, you can now limit the amount of bandwidth available to users of different operating systems, or force outbound web traffic through a transparent filtering proxy. This article describes how to install pf, altq, and Squid on your FreeBSD router and web proxy to achieve these goals. . In an ideal environment, there would be no need for bandwidth shaping, OS fingerprint-based filtering, or even Quality of Service (QoS). Several factors in the real world require a change of game plan. Bandwidth is not free, and many ISPs charge customers based on bandwidth usage. Worms, viruses, and compromised systems can all lead to higher bandwidth costs. In the wake of the W32.Slammer worm, which saturated the connections of infected networks, many companies saw their monthly connectivity bills skyrocket due to the worm's traffic. Filtering your connections based on operating system can go partway to helping keep such situations from running away. While I will focus on filtering traffic from Windows systems, this process can equally apply to BSD, Linux, Mac OS, or a host of other operating systems listed in the pf.os file on your system. This may be especially useful to people running older versions of OSes that have not or cannot be patched but still require some network connectivity. . In an ideal environment, there would be no need for bandwidth shaping, OS fingerprint-based filterin. manage, heterogeneous, network, provide, different, quality, service, agreements. . Brittany Day
Mike Frantzen recently committed OS fingerprinting capabilities to PF, OpenBSD's stateful packet filter, based on Michal Zalewski's p0f (passive OS fingerprinting) code. The functionality was also added to tcpdump. From the p0f README. . .. Mike Frantzen recently committed OS fingerprinting capabilities to PF, OpenBSD's stateful packet filter, based on Michal Zalewski's p0f (passive OS fingerprinting) code. The functionality was also added to tcpdump. From the p0f README : "The passive OS fingerprinting technique is based on information coming from a remote host when it tries to establish a connection to your system. Captured packet parameters contain enough information to identify the remote OS. In contrast to active scanners such as nmap and queSO, p0f does this without sending anything to the remote host." Mike points out that it is very easy to spoof a TCP stack to make one OS appear as if it's really another, so this new functionality is not a security feature. Instead, it's intended as a policy feature... For Mike's announcement email which includes a few quick examples of how this functionality might be used, read on. The link for this article located at KernelTrap is no longer available. . Mike Frantzen recently committed OS fingerprinting capabilities to PF, OpenBSD's stateful packet fil. frantzen, recently, committed, fingerprinting, capabilities, openbsd's, stateful, packet. . Anthony Pell
Get the latest Linux and open source security news straight to your inbox.