| *** olani_ <olani_!~olani@81-225-149-133-no2814.tbcn.telia.com> has quit IRC (Ping timeout: 252 seconds) | 00:08 | |
| *** olani_ <olani_!~olani@134.238.54.91> has joined #oe | 00:09 | |
| *** olani_ <olani_!~olani@134.238.54.91> has quit IRC (Ping timeout: 252 seconds) | 00:13 | |
| *** m4t <m4t!~matt@2604:180:0:5d2::bad:beef> has quit IRC (Quit: m4t) | 00:25 | |
| *** hrw <hrw!~hrw@redhat/hrw> has quit IRC (Ping timeout: 252 seconds) | 00:43 | |
| *** hrw <hrw!~hrw@redhat/hrw> has joined #oe | 00:54 | |
| *** florian <florian!~florian@dynamic-002-243-190-231.2.243.pool.telefonica.de> has quit IRC (Ping timeout: 252 seconds) | 01:02 | |
| *** tgamblin_ <tgamblin_!~tgamblin@d24-150-219-207.home.cgocable.net> has joined #oe | 01:10 | |
| *** dankm <dankm!~dan@user/dankm> has quit IRC (Remote host closed the connection) | 01:11 | |
| *** dankm <dankm!~dan@user/dankm> has joined #oe | 01:12 | |
| *** tgamblin <tgamblin!~tgamblin@d24-150-219-207.home.cgocable.net> has quit IRC (Ping timeout: 246 seconds) | 01:13 | |
| *** npcomp <npcomp!~user@user/npcomp> has quit IRC (Ping timeout: 244 seconds) | 01:14 | |
| *** npcomp <npcomp!~user@user/npcomp> has joined #oe | 01:27 | |
| *** m4t <m4t!~matt@2604:180:0:5d2::bad:beef> has joined #oe | 01:37 | |
| *** dankm <dankm!~dan@user/dankm> has quit IRC (Remote host closed the connection) | 02:30 | |
| *** dankm <dankm!~dan@user/dankm> has joined #oe | 02:32 | |
| *** KanjiMonster <KanjiMonster!~KanjiMons@dslb-084-061-146-083.084.061.pools.vodafone-ip.de> has quit IRC (Remote host closed the connection) | 03:07 | |
| *** KanjiMonster <KanjiMonster!~KanjiMons@dslb-084-061-146-083.084.061.pools.vodafone-ip.de> has joined #oe | 03:07 | |
| *** Xagen <Xagen!~Xagen@99-135-179-142.lightspeed.austtx.sbcglobal.net> has joined #oe | 03:33 | |
| *** Xagen <Xagen!~Xagen@99-135-179-142.lightspeed.austtx.sbcglobal.net> has quit IRC (Quit: My MacBook has gone to sleep. ZZZzzz…) | 03:39 | |
| *** Xagen <Xagen!~Xagen@99-135-179-142.lightspeed.austtx.sbcglobal.net> has joined #oe | 04:41 | |
| *** Xagen <Xagen!~Xagen@99-135-179-142.lightspeed.austtx.sbcglobal.net> has quit IRC (Client Quit) | 04:43 | |
| *** leon-anavi <leon-anavi!~Leon@46.55.231.62> has joined #oe | 07:32 | |
| *** Kubu_work <Kubu_work!~kubu@lfbn-nan-1-335-137.w82-120.abo.wanadoo.fr> has joined #oe | 08:13 | |
| *** mckoan|away is now known as mckoan | 08:14 | |
| *** florian <florian!~florian@dynamic-080-171-152-031.80.171.pool.telefonica.de> has joined #oe | 08:18 | |
| *** kanavin <kanavin!~Alexander@2a02:2455:86a1:c500:cfe8:f434:3125:3cb3> has quit IRC (Remote host closed the connection) | 08:31 | |
| *** florian <florian!~florian@dynamic-080-171-152-031.80.171.pool.telefonica.de> has quit IRC (Ping timeout: 276 seconds) | 08:32 | |
| *** zeddii <zeddii!~zeddii@pool-174-112-62-108.cpe.net.cable.rogers.com> has quit IRC (Quit: ZNC 1.9.0+deb2build3 - https://znc.in) | 08:43 | |
| *** zeddii <zeddii!~zeddii@pool-174-112-62-108.cpe.net.cable.rogers.com> has joined #oe | 08:43 | |
| *** kanavin <kanavin!~Alexander@2a02:2455:86a1:c500:cfe8:f434:3125:3cb3> has joined #oe | 08:48 | |
| *** aduskett <aduskett!~adam@2a02:a211:a140:6480:f59d:d8b2:eb04:8d6f> has joined #oe | 08:51 | |
| *** florian <florian!~florian@port-217-146-132-69.static.as20676.net> has joined #oe | 09:19 | |
| *** florian_kc <florian_kc!~florian@port-217-146-132-69.static.as20676.net> has joined #oe | 09:44 | |
| *** florian_kc <florian_kc!~florian@port-217-146-132-69.static.as20676.net> has quit IRC (Ping timeout: 260 seconds) | 11:42 | |
| *** florian_kc <florian_kc!~florian@dynamic-080-171-152-031.80.171.pool.telefonica.de> has joined #oe | 11:43 | |
| *** florian_kc <florian_kc!~florian@dynamic-080-171-152-031.80.171.pool.telefonica.de> has quit IRC (Read error: Connection reset by peer) | 11:55 | |
| *** tgamblin_ is now known as tgamblin | 12:13 | |
| mort | What would y'all do for a super simple "deny all incoming connections" style firewall? | 14:02 |
|---|---|---|
| *** Xagen <Xagen!~Xagen@4.14.206.69> has joined #oe | 14:11 | |
| JPEW | mort: iptables maybe? | 14:17 |
| mort | hm | 14:18 |
| mort | everything I've seen wrt iptables seemingly has the device boot without any form of firewall and then, in some init script, run iptables-restore to load firewall rules | 14:19 |
| mort | that seems both error prone and fail-open | 14:19 |
| JPEW | mort: Ya, I'm not sure about that level of hardening. Maybe the kernel has some way of specifying default netfilter rules until userspace sets new ones? | 14:26 |
| JPEW | Or set them in initrd maybe? | 14:27 |
| mort | I thought everyone would want to make the firewall be on by default if they wanted a firewall | 14:35 |
| mort | most people aren't modifying their initrd to enable firewall are they? | 14:35 |
| JPEW | mort: No. I suspect most people just make sure that the firewall is configured by iptables et. al. before any services start | 14:36 |
| mort | weird | 14:36 |
| mort | I guess I could make a systemd service which is required by basic.target or something | 14:37 |
| JPEW | mort: I would be kinda suprised if systemd didn't already have something that did that | 14:38 |
| JPEW | Anyway, unless you are configuring the firewall to do DROP or something, there's probably not much behavioral difference between the firewall being enabled and disabled is no services are running yet | 14:39 |
| JPEW | *if no services are running yet | 14:39 |
| mort | it's just weird to have a fail-open firewall | 14:39 |
| JPEW | Maybe ask some security folks... I'm not one of them :) | 14:40 |
| JaMa | do you need it before networking is configured? and if you deny all before networking is configured, who will allow e.g. dhcp to work? | 14:41 |
| mort | DHCP isn't an incoming thing though, right? | 14:42 |
| JaMa | but I agree that there should be standard way how to configure the rules early (as you can configure static network with kernel params, then userspace loading iptables rules will be way later) | 14:42 |
| mort | I mean I know it's a UDP thing which makes it weird but isn't there typically some way to configure "incoming packets should be dropped unless they're a response to something we sent first" | 14:43 |
| JaMa | ok then WoL should be enabled or configured somehow when the device is sleeping? | 14:44 |
| JaMa | incoming packets are "dangerous" only when something listens for them, I guess the assumtion is that nothing will listen for incomming packets before networking is configured and services are started | 14:46 |
| mort | well they're also dangerous if there's a kernel bug, but I guess firewalls don't help with that | 14:47 |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 14:51 | |
| mort | I made a recipe which provides a systemd service which runs iptables-restore as I described above | 14:51 |
| mort | I still don't love it but meh it's fine | 14:52 |
| *** florian_kc <florian_kc!~florian@port-217-146-132-69.static.as20676.net> has joined #oe | 15:26 | |
| *** reavertm_ <reavertm_!~reavertm@178.43.238.211.ipv4.supernova.orange.pl> has joined #oe | 15:33 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Ping timeout: 276 seconds) | 15:33 | |
| *** reavertm_ <reavertm_!~reavertm@178.43.238.211.ipv4.supernova.orange.pl> has quit IRC (Read error: Connection reset by peer) | 16:13 | |
| *** mckoan is now known as mckoan|away | 17:02 | |
| *** florian <florian!~florian@port-217-146-132-69.static.as20676.net> has quit IRC (Quit: Ex-Chat) | 17:33 | |
| *** florian_kc <florian_kc!~florian@port-217-146-132-69.static.as20676.net> has quit IRC (Ping timeout: 260 seconds) | 17:35 | |
| *** reavertm <reavertm!~reavertm@2a01:112f:4600:2c00:7039:bcbe:2df8:265> has joined #oe | 18:31 | |
| *** florian_kc <florian_kc!~florian@dynamic-080-171-152-031.80.171.pool.telefonica.de> has joined #oe | 18:41 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 18:42 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 18:44 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 18:50 | |
| *** reavertm <reavertm!~reavertm@2a01:112f:4600:2c00:6341:21de:f05d:ef5f> has joined #oe | 18:51 | |
| *** yocton <yocton!~quassel@163-172-29-20.rev.poneytelecom.eu> has quit IRC (Remote host closed the connection) | 19:07 | |
| *** yocton <yocton!~quassel@163-172-29-20.rev.poneytelecom.eu> has joined #oe | 19:08 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 19:19 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 19:20 | |
| *** leonanavi <leonanavi!~Leon@46.55.231.62> has joined #oe | 20:47 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 20:55 | |
| *** reavertm <reavertm!~reavertm@2a01:112f:4600:2c00:bb4f:ab20:af17:81fd> has joined #oe | 20:56 | |
| *** rber|res <rber|res!~rber|res@46.57.123.117.dsl.dyn.drei.com> has joined #oe | 20:56 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 21:01 | |
| *** reavertm <reavertm!~reavertm@2a01:112f:4600:2c00:d6ef:57c1:169c:f292> has joined #oe | 21:02 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 21:06 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 21:07 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 21:11 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 21:13 | |
| *** Xagen <Xagen!~Xagen@4.14.206.69> has quit IRC (Quit: My MacBook has gone to sleep. ZZZzzz…) | 21:14 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 21:17 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 21:18 | |
| *** DvorkinDmitry <DvorkinDmitry!~dvorkin@5.167.98.73> has joined #oe | 21:54 | |
| *** brrrm <brrrm!~brrm@ip-078-043-203-234.um18.pools.vodafone-ip.de> has quit IRC (Ping timeout: 248 seconds) | 21:56 | |
| *** brrm <brrm!~brrm@2a02:8071:b700::1c89> has joined #oe | 21:57 | |
| *** leonanavi <leonanavi!~Leon@46.55.231.62> has quit IRC (Remote host closed the connection) | 22:04 | |
| *** leonanavi <leonanavi!~Leon@46.55.231.62> has joined #oe | 22:05 | |
| *** leon-anavi <leon-anavi!~Leon@46.55.231.62> has quit IRC (Ping timeout: 248 seconds) | 22:07 | |
| *** leon-anavi <leon-anavi!~Leon@46.55.231.62> has joined #oe | 22:07 | |
| *** leon-anavi <leon-anavi!~Leon@46.55.231.62> has quit IRC (Quit: Leaving) | 22:12 | |
| *** florian_kc is now known as florian | 22:26 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 22:41 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 22:42 | |
| *** leonanavi <leonanavi!~Leon@46.55.231.62> has quit IRC (Remote host closed the connection) | 22:49 | |
| *** Kubu_work <Kubu_work!~kubu@lfbn-nan-1-335-137.w82-120.abo.wanadoo.fr> has quit IRC (Quit: Leaving.) | 23:02 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has quit IRC (Remote host closed the connection) | 23:41 | |
| *** reavertm <reavertm!~reavertm@gentoo/developer/reavertm> has joined #oe | 23:42 | |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!