tcp blackhole and ident

[Uwe Doering]

J.D. Bronson wrote:
> At 07:39 AM 1/31/2004, Matthew Seaman wrote:
> 
>> On Sat, Jan 31, 2004 at 07:32:36AM -0600, J.D. Bronson wrote:
>> > I have a question. I setup the following in sysctl.conf:
>> >
>> > net.inet.tcp.blackhole=2
>> > net.inet.udp.blackhole=1
>> >
>> > ..Well this works, but now I have a new issue.
>> > I run sendmail and as such, need to allow TCP 113 into this machine
>> > and yet get CONNECTION REFUSED. - I dont want to run IDENT, but
>> > need to still get the CONNECTION REFUSED...
>>
>> Run ipfw(8) or a similar firewall and set up a rule that sends an ICMP
>> reject whenever it detects an incoming connection on port 113 as part
>> of your firewall configuration.  Eg. something like:
>>
>>     01600 reset tcp from any to me dst-port 113 setup
> 
> Thanks...but I have quite a robust Cisco firewall in place ahead of the 
> freebsd machines...so I dont -need- to run ipfw...Hmmm...

You can achieve this rejection on the application level as well.  Here's 
how:

1. Run inetd with command line options '-wW' to enable libwrap support.

2. Enable inetd's internal auth service with
      auth    stream  tcp     nowait  root    internal

3. Deny auth connections in libwrap's /etc/hosts.allow, like so:
      auth : ALL : severity debug : deny
      ALL : ALL : allow

Now you have something (inetd) bound to port 113, so a connection can be 
established, but it gets dropped immediately due to the libwrap setup. 
This is sufficient to prevent timeouts on the remote end but at the same 
time leaks as little information as possible for an application level 
solution.

    Uwe
-- 
Uwe Doering         |  EscapeBox - Managed On-Demand UNIX Servers
gemini at geminix.org  |  http://www.escapebox.net