Changeset ab6bf6a for postlfs/security


Ignore:
Timestamp:
01/25/2021 03:04:27 AM (3 years ago)
Author:
Douglas R. Reno <renodr@…>
Branches:
10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
498a011
Parents:
ff40dcf
Message:

Update to iptables-1.8.7

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@24135 af4574ff-66df-0310-9fd7-8a98e5e911e0

File:
1 edited

Legend:

Unmodified
Added
Removed

  • postlfs/security/iptables.xml

    rff40dcf rab6bf6a  
    77  <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
    88  <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
    9   <!ENTITY iptables-md5sum        "bc0f0adccc93c09dc5b7507ccba93148">
    10   <!ENTITY iptables-size          "700 KB">
    11   <!ENTITY iptables-buildsize     "17 MB">
    12   <!ENTITY iptables-time          "0.2 SBU">
     9  <!ENTITY iptables-md5sum        "602ba7e937c72fbb7b1c2b71c3b0004b">
     10  <!ENTITY iptables-size          "704 KB">
     11  <!ENTITY iptables-buildsize     "22 MB">
     12  <!ENTITY iptables-time          "0.1 SBU">
    1313]>
    1414
    … …  
    3232    <para>
    3333      <application>iptables</application> is a userspace command line program
    34       used to configure Linux 2.4 and later kernel packet filtering ruleset.
     34      used to configure the Linux 2.4 and later kernel packet filtering ruleset.
    3535    </para>
    3636
    … …  
    7878      <xref linkend="libpcap"/> (required for nfsypproxy support),
    7979      <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink>
    80       (required for Berkely Packet Filter support),
     80      (required for Berkeley Packet Filter support),
    8181      <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink>
    8282      (required for connlabel support),
    83       <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack"</ulink>
     83      <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack</ulink>
    8484      (required for connlabel support), and
    8585      <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
    … …  
    184184    <para>
    185185      <parameter>--disable-nftables</parameter>: This switch disables building
    186       nftables compat. <!--Omit this switch if you have installed
     186      nftables compatibility. <!--Omit this switch if you have installed
    187187      <xref linkend="nftables"/>.-->
    188188    </para>
    … …  
    195195
    196196    <para>
    197       <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
    198       <application>iptables</application> modules are installed in the
     197      <parameter>--with-xtlibdir=/lib/xtables</parameter>: This switch ensures that
     198      all <application>iptables</application> modules are installed in the
    199199      <filename class="directory">/lib/xtables</filename> directory.
    200200    </para>
    … …  
    207207    <para>
    208208      <command>ln -sfv ../../sbin/xtables-legacy-multi /usr/bin/iptables-xml</command>:
    209       Ensure the symbolic link for <command>iptables-xml</command> is relative.
     209      This command ensures that the symbolic link for the
     210      <command>iptables-xml</command> command is relative.
    210211    </para>
    211212
    … …  
    241242      <para>
    242243        A Personal Firewall is designed to let you access all the
    243         services offered on the Internet, but keep your box secure and
     244        services offered on the Internet while keeping your computer secure and
    244245        your data private.
    245246      </para>
    … …  
    250251        url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
    251252        Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
    252         to the Linux 3.x kernels.
     253        to the Linux 5.x kernels.
    253254      </para>
    254255
    … …  
    322323iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    323324
    324 # Log everything else. What's Windows' latest exploitable vulnerability?
     325# Log everything else.
    325326iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    326327
    … …  
    400401iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    401402
    402 # Log everything else. What's Windows' latest exploitable vulnerability?
     403# Log everything else.
    403404iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    404405
    … …  
    434435
    435436      <para>
    436         A network Firewall has two interfaces, one connected to an
     437        A Network Firewall has two interfaces, one connected to an
    437438        intranet, in this example <emphasis role="strong">LAN1</emphasis>,
    438439        and one connected to the Internet, here <emphasis
    439440        role="strong">WAN1</emphasis>. To provide the maximum security
    440441        for the firewall itself, make sure that there are no unnecessary
    441         servers running on it such as <application>X11</application> et al.
     442        servers running on it such as <application>X11</application>.
    442443        As a general principle, the firewall itself should not access
    443444        any untrusted service (think of a remote server giving answers that
    … …  
    756757        </listitem>
    757758        <listitem>
    758           <para id='fw-BB-4-ipt' xreflabel="BusyBox with iptable example number 4">
     759          <para id='fw-BB-4-ipt' xreflabel="BusyBox with iptables example number 4">
    759760            If you are frequently accessing FTP servers or enjoy chatting, you
    760761            might notice delays because some implementations of these daemons
    … …  
    874875      <seglistitem>
    875876        <seg>
    876           ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
    877           iptables-save, iptables-xml, nfsynproxy (optional) and xtables-multi
     877          ip6tables,
     878          ip6tables-apply,
     879          ip6tables-legacy,
     880          ip6tables-legacy-restore,
     881          ip6tables-legacy-save,
     882          ip6tables-restore,
     883          ip6tables-save,
     884          iptables,
     885          iptables-apply,
     886          iptables-legacy,
     887          iptables-legacy-restore,
     888          iptables-legacy-apply,
     889          iptables-restore,
     890          iptables-save,
     891          iptables-xml,
     892          nfsynproxy (optional),
     893          and xtables-multi
    878894        </seg>
    879895        <seg>
    880           libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
     896          libip4tc.so,
     897          libip6tc.so,
     898          libipq.so,
     899          libiptc.so,
     900          and libxtables.so
    881901        </seg>
    882902        <seg>
    883           /lib/xtables and /usr/include/libiptc
     903          /lib/xtables and
     904          /usr/include/libiptc
    884905        </seg>
    885906      </seglistitem>
    … …  
    904925      </varlistentry>
    905926
     927      <varlistentry id="iptables-apply">
     928        <term><command>iptables-apply</command></term>
     929        <listitem>
     930          <para>
     931            is a safer way to update iptables remotely.
     932          </para>
     933          <indexterm zone="iptables iptables-apply">
     934            <primary sortas="b-iptables-apply">iptables-apply</primary>
     935          </indexterm>
     936        </listitem>
     937      </varlistentry>
     938
     939      <varlistentry id="iptables-legacy">
     940        <term><command>iptables-legacy</command></term>
     941        <listitem>
     942          <para>
     943            is used to interact with iptables using the legacy command set.
     944          </para>
     945          <indexterm zone="iptables iptables-legacy">
     946            <primary sortas="b-iptables-legacy">iptables-legacy</primary>
     947          </indexterm>
     948        </listitem>
     949      </varlistentry>
     950
     951      <varlistentry id="iptables-legacy-restore">
     952        <term><command>iptables-legacy-restore</command></term>
     953        <listitem>
     954          <para>
     955            is used to restore a set of legacy iptables rules.
     956          </para>
     957          <indexterm zone="iptables iptables-legacy-restore">
     958            <primary sortas="b-iptables-legacy-restore">iptables-legacy-restore</primary>
     959          </indexterm>
     960        </listitem>
     961      </varlistentry>
     962
     963      <varlistentry id="iptables-legacy-save">
     964        <term><command>iptables-legacy-save</command></term>
     965        <listitem>
     966          <para>
     967            is used to save a set of legacy iptables rules.
     968          </para>
     969          <indexterm zone="iptables iptables-legacy-save">
     970            <primary sortas="b-iptables-legacy-save">iptables-legacy-save</primary>
     971          </indexterm>
     972        </listitem>
     973      </varlistentry>
     974
    906975      <varlistentry id="iptables-restore">
    907976        <term><command>iptables-restore</command></term>
Note: See TracChangeset for help on using the changeset viewer.