Slashdot Mirror

← Back to Stories (view on slashdot.org)

Run Your Firewall Halted for Extra Security

Posted by michael on from the neat-trick dept.

n8willis writes: "There's a great article over at the SysAdmin magazine site that presents a unique approach to improving network security: run your firewall in a halted state. This means runlevel 0; no processes running and no disks mounted, but with packet filtering still on. The author heard a rumor of this capability in the 2.0 series kernels, and he's managed to get it working in 2.2 as well."

4 of 390 comments (clear)

  1. It's a bridge by booch · · Score: 5, Insightful

    This method causes the firewall to act as a bridge instead of a router. The advantage is that the firewall is not IP-addressable. To hack it, you'd have to go down to the MAC layer, which is generally only possible if you're on the same network segment.

    I read the SysAdmin article a month ago and thought the same thing. The OpenBSD Invisible Firewall is a much better solution -- you can't hack it from the outside, but you can still make any changes necessary without causing downtime.

    --
    Software sucks. Open Source sucks less.
  2. Re:brilliant! by swb · · Score: 5, Insightful

    Indeed, what if kernel modules were added to handle non-firewalling tasks instead? Could a kernel module provide a useful network service? You start the machine up, it loads the kernel and "halts" but still provides the service. Something goes wrong? Just power cycle; there's no disk access, no way for an attack or malfunction to make a persistant alteration in the machine.

    I think you just reinvented the embedded system.

  3. Re:Logging? by booyah · · Score: 5, Insightful

    Same place I log anyways

    Dot matrix printer on LP1 :-)

    try to erase THAT log :-)

    -booyah

    --
    #include sig.h
  4. More secure...? by st0mp · · Score: 5, Insightful

    Aren't we forgetting the most important security feature of a firewall...? There's no logging! This is fly by the seat of your pants security if you ask me. You gonna hang a lucky rabbit's foot over the thing?