On Thu, 23 Nov 2006, in the Usenet newsgroup comp.os.linux.networking, in
article <L589h.2710$(E-Mail Removed). net>, CharlieB wrote:
>Moe Trin wrote:
>
>> Most likely, this is a firewall problem - but which computer is blocking
>> things? Otherwise, you are doing OK.
>You were absolutely right. I did a:
>
>shorewall clear
>
>On both computers and I can ping now. I put a small rule in shorewall to
>allow ssh connections from the LAN only and now ssh works also. Thank you
>very much.
I like to start securing my systems by first looking at 'netstat -anptu'
to see what is running. Do I what "this" or "that" even _running_ on the
system? Find out where they are being started (the PID is often a clue)
and take the appropriate action. Then I set up the firewall to "cover"
the rest. I see no need to block well known port (those below 1024) that
have nothing running. I do set a rule to DROP (silently ignore) any UDP
packets that are not responses to my DNS queries, because in most cases
this is windoze Messenger spam aimed at ports 1025-1040/udp, and often
the claimed IP source addresses are demonstrably faked. This avoids
me sending ICMP Type 3 Code 3 (port unreachable) or IP RST packets to
hosts that the spammer is spoofing.
>I'll look into the host naming too. I'll save your reply to fix at a later
>date. My biggest stumbling block there is thinking up a good name for the
>computers :-)
1178 Choosing a name for your computer. D. Libes. August 1990.
(Format: TXT=18472 bytes) (Also FYI0005) (Status: INFORMATIONAL)
2100 The Naming of Hosts. J. Ashworth. April 1 1997. (Format: TXT=4077
bytes) (Status: INFORMATIONAL)
Two RFCs available on any search engine. Note that RFCs dated April 1
are often humorous, such as
1925 The Twelve Networking Truths. R. Callon. April 1 1996. (Format:
TXT=4294 bytes) (Status: INFORMATIONAL)
As regards naming schemes, that's a wide open game that can be fun and
challenging. We've got over 2000 systems in the sub-domain where I work,
and the registrar has decreed that the user (or manager) is responsible
for coming up with the name. As a result, there are lots of naming
schemes, such as:
=========================
Cars Beers Navel vessels Battles
Countries Animals Film/Stage/TV Stars Fruit/Vegetables
Stars/Planets Flowers Athletes Sports Teams
Chemicals/Elements Newspapers Magazines Publishers
States/Provinces Oceans/Seas Diseases Mythical Names
Cities Firearms Satellites Kings/Queens/Presidents
Cartoon Characters Pasta Wines Disasters
Painters Zodiac Currencies/Coins Scientists
=========================
As far as the domain portion of the name goes, unless you have registered
a name with an Internet Domain Registry, do not use any domain that might
possibly exist. Don't take it for granted, _test_it_ using a DNS query
tool like 'dig', 'dnsquery', 'host', or 'nslookup'. All to many people
choose some catchy name, not realizing that someone out on the Internet
already is using it. This causes subtle problems that are quite miserable
to troubleshoot, both for you and the actual owner of the domain.
2606 Reserved Top Level DNS Names. D. Eastlake 3rd, A. Panitz. June
1999. (Format: TXT=8008 bytes) (Also BCP0032) (Status: BEST CURRENT
PRACTICE)
That's another RFC with some suggestions.
Old guy
|
Similar Threads
Linear Mode
