Context Navigation

r0a9287a	r64d97b7c
13	13	setup more complex and your box less secure: You induce the risks of
14	14	misconfigured services or running a service with an exploitable bug, both risks
15		that a firewall principially should be immune of. See the introduction to
	15	that a firewall principally should be immune of. See the introduction to
16	16	<xref linkend="postlfs-security-fw-masqRouter"/> for some more details.</para>
17	17

postlfs/security/firewalling/intro.xml

-              r0a9287a
+              r64d97b7c
 to aim no harm, you wouldn't need to do firewalling!
 In the real world however, daemons may be misconfigured,
 exploits against essential services are freely availiable, you
+exploits against essential services are freely available, you
 may wish to choose which services are accessible by certain machines,
 you may wish to limit which machines or applications are allowed
 …
 <sect3><title><xref linkend="postlfs-security-fw-masqRouter"/></title>
 <para>This is a box placed between the internet and an intranet.
 To minimize the risk of compromizing the firewall itself it
+To minimize the risk of compromising the firewall itself it
 should generally have only one role, that of protecting the intranet.
 Although not completely riskless, the tasks of doing the routing
 …
 of the packets it routes from clients with private IP-addresses onto
 the internet so that they seem to come from the firewall
 itself</para></footnote> are commonly considerd harmless.</para></sect3>
+itself</para></footnote> are commonly considered harmless.</para></sect3>
 <sect3><title><xref linkend="postlfs-security-fw-busybox"/></title>

r0a9287a	r64d97b7c
15	15
16	16	<sect3><title>iptables-save, ~-restore</title>
17		<para>to save and to restore your elabourated set of chains and rules.
	17	<para>to save and to restore your elaborated set of chains and rules.
18	18	Until iptables-1.2.5 they were declared experimental.</para>
19	19	</sect3>

r0a9287a	r64d97b7c
24	24	is checked (if it is available at <filename>/usr/src/linux</filename> to
25	25	see which features are available. Support will only be compiled into
26		iptables for the features recognised at compile-time. Applying a kernel
	26	iptables for the features recognized at compile-time. Applying a kernel
27	27	patch may result in errors, often because the hooks for the patches
28	28	have changed or because the runme script doesn't recognize that a patch

r0a9287a	r64d97b7c
1	1	<sect2>
2		<title>Reinstallation of shadow to utilize PAM</title>
	2	<title>Re-installation of shadow to utilize PAM</title>
3	3
4	4	<para>Download the patch for shadow from <ulink url="&hfile-root;"/></para>

Note: See TracChangeset for help on using the changeset viewer.