On Wed, 24 Sep 2003 Richard.Corfield.Admin-XZoyATsUNX5Wk0Htik3J/[email protected] wrote:
> On Red Hat we had to enable it in xinetd by hand. Maybe there's a GUI
> somewhere for this, but it wasn't done for us.
# chkconfig ipop3 on
# service xinetd restart (or /etc/rc.d/init.d/xinetd restart if you prefer)
> We then met the firewall.
> Running nmap against the box, we found that it stealths ports 1 to 1023.
> Port 1024 is open, and nmap claims it to be KDM, which is not something
> I'd want the outside world to see.
Hmmm, maybe... I prefer and use GNOME, so I've not encountered that. It's no
secret that GNOME is RH's prefer desktop environment.
> Ports above remain closed, but not stealthed, so I wonder if the firewall
> just doesn't go that high. I'd expect a default deny policy with few
> allowed ports open. Our admin took the firewall down, this is an internal
> test box only, otherwise I could have looked at the iptables and found
> out.
/etc/sysconfig/iptables is where to find the firewall configuration. The
automagically generated policy is pretty basic, but should result in a
reasonably secure-across-the-network configuration.
> I also found that the Red Hat system (it was a Workstation Install)
> enables remote root access in SSH by default. Debian are far more paranoid
> and don't even allow X over SSH by default. Debian also don't install
> things like portmap unless needed.
True, but based on SSH's recent history, if you're allowing SSH connections
from random internet hosts, you're running the risk of remote root
compromise (via security vulnerabilities) anyway.
> It seems to be like VHS and BetaMax. The market leader, with the
> advertising and the pretty GUIs, is not actually as usable or complete in
> my experience as the quiet but not market leader. Debian is technically
> well thought out, but lacking in the GUI sense where Red Hat has a
> pretty GUI, but technically is at least different.
I prefer RH, but I like the fact that Debian's around.
But Debian is deficient in some significant ways too. I don't like the way
it interrupts the installation to ask about little things, like whether I
want a load monitor running in colour or monochrome. I don't like the way it
leaves lots of hardware for me to configure manually. I don't like the way
the stable distro is too old to work well with hardware that's shipping when
it's released (e.g. Debian 3.0 doesn't support the Intel ethernet adaptors
that were on the motherboards I purchased around the same time).
[snip]
> - Richard
Best Regards,
Alex.
--
Alex Butcher Brainbench MVP for Internet Security: www.brainbench.com
Bristol, UK Need reliable and secure network systems?
PGP/GnuPG ID:0x271fd950 <http://www.assursys.com/>
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.