[FUG-BR] Regra contra nmap

[mantunes]

Tenta colocar essas regras..

${ipcmd} add deny tcp from any to any tcpflags fin,urg,psh in recv $oifwan
${ipcmd} add deny tcp from any to any tcpflags
!fin,!syn,!ack,!urg,!psh,!rst in recv $oifwan
${ipcmd} add deny tcp from any to any tcpflags syn,fin,rst,ack in recv $oifwan
${ipcmd} add deny tcp from any to any tcpflags fin,!syn,!rst,!ack in
recv $oifwan
${ipcmd} add deny tcp from any to any tcpflags syn,fin,!rst,!ack in recv $oifwan
${ipcmd} add deny tcp from any to any tcpflags urg,!syn,!fin,!rst,!ack
in recv $oifwan

Não testei tcp_drop_synfin="YES" no rc.conf

2008/11/4 Wanderson Tinti <wanderson at bsd.com.br>:
> Tente colocar no /etc/rc.conf essa linha:
> tcp_drop_synfin="YES"
>
>
> 2008/11/4 Cristina Fernandes Silva <cristinafs.listas at gmail.com>:
>> Thiago,
>>
>> Acho que não é FreeBSD este servidor da empresa. verifique..
>>
>> SInfo(V=4.11%P=i386-redhat-linux-gnu%D=11/4%Tm=491046C3%O=21%C=1)
>>
>>
>>
>>
>> 2008/11/4 Thiago Gomes <thiagomespb at gmail.com>:
>>> Pessoal,
>>>
>>> Alguem sabe a regra IPFW  para o nmap não desconbrir o meu sistema
>>> operacional, passei em meus
>>> servidores e o mesmo apareceu essa mensagem.
>>>
>>>  nmap -sS -O -P0 -v www.exemplo.com.br
>>>
>>> Running (JUST GUESSING) : FreeBSD 5.X|6.X (89%), Microsoft Windows
>>> NT/2K/XP (86%), Sun Solaris 2.X|7 (85%), Apple Mac OS X 10.3.X (85%),
>>> Linux 2.4.X (84%), Linksys embedded (84%)
>>> Aggressive OS guesses: FreeBSD 5.0-RELEASE (89%), FreeBSD 5.2 - 5.3
>>> (89%), FreeBSD 5.3-RELEASE (89%), FreeBSD 5.3-STABLE (89%), FreeBSD
>>> 5.4-RELEASE (88%), FreeBSD 5.2.1 (SPARC) (88%), FreeBSD 5.2-CURRENT -
>>> 5.3 (x86) with pf scrub all (86%), FreeBSD 5.3 (86%), Microsoft
>>> Windows XP Pro SP2 (86%), Sun Solaris 2.6 - 7 with tcp_strong_iss=2
>>> (85%)
>>> No exact OS matches for host (test conditions non-ideal).
>>> TCP Sequence Prediction: Class=truly random
>>>                         Difficulty=9999999 (Good luck!)
>>> IPID Sequence Generation: Incremental
>>>
>>> Nmap finished: 1 IP address (1 host up) scanned in 33.029 seconds
>>>               Raw packets sent: 3418 (152.910KB) | Rcvd: 34 (1896B)
>>>
>>> Em um servidor de uma empresa que eu conheço que é FreeBSD passei
>>> novamente só que não apareceu.
>>>
>>> No exact OS matches for host (If you know what OS is running on it,
>>> see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
>>> TCP/IP fingerprint:
>>> SInfo(V=4.11%P=i386-redhat-linux-gnu%D=11/4%Tm=491046C3%O=21%C=1)
>>> TSeq(Class=TR%IPID=I)
>>> T1(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
>>> T2(Resp=N)
>>> T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
>>> T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
>>> T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
>>> T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
>>> T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
>>> PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
>>>
>>> TCP Sequence Prediction: Class=truly random
>>>                         Difficulty=9999999 (Good luck!)
>>> IPID Sequence Generation: Incremental
>>>
>>> Nmap finished: 1 IP address (1 host up) scanned in 27.351 seconds
>>>               Raw packets sent: 1945 (87.104KB) | Rcvd: 1718 (79.394KB)
>>>
>>>
>>> Alguem tem uma dica
>>>
>>> Obrigado
>>> -------------------------
>>> Histórico: http://www.fug.com.br/historico/html/freebsd/
>>> Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
>>>
>> -------------------------
>> Histórico: http://www.fug.com.br/historico/html/freebsd/
>> Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
>>
> -------------------------
> Histórico: http://www.fug.com.br/historico/html/freebsd/
> Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
>



-- 
Marcio Antunes
Powered by FreeBSD
==================================
* Windows: "Where do you want to go tomorrow?"
* Linux: "Where do you want to go today?"
* FreeBSD: "Are you, guys, comming or what?"