Is there a way to filter websites with Shorewall? When I say this I mean local websites. For example: My website is www.danicar.net, well I get all kinds of worm attacks like: 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 282 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 280 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir I was wondering if Shorewall could be used to filter this type of thing? So anything trying to get at /scripts/ or /MSADC/ or /c/ could be dropped or something. Thanks Joe
Joe Gofton wrote:> Is there a way to filter websites with Shorewall? When I say this I mean > local websites. For example: My website is www.danicar.net, well I get > all kinds of worm attacks like: > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET > /scripts/root.exe?/c+dir HTTP/1.0" 404 282 > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET > /MSADC/root.exe?/c+dir HTTP/1.0" 404 280 > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > /scripts/..%255c../winnt/system32/cmd.exe?/c+dir > > I was wondering if Shorewall could be used to filter this type of thing?No. Shorwall is a packet filter - to filter based on data stream content requires some sort of Proxy. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net
In fact iptables can do this with the patch string enabled. ----- Original Message ----- From: "Tom Eastep" <teastep@shorewall.net> To: <jgofton@danicar.net> Cc: <shorewall-users@shorewall.net> Sent: Friday, October 11, 2002 3:53 PM Subject: Re: [Shorewall-users] Filter Question> > > Joe Gofton wrote: > > Is there a way to filter websites with Shorewall? When I say this Imean> > local websites. For example: My website is www.danicar.net, well I get > > all kinds of worm attacks like: > > > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET > > /scripts/root.exe?/c+dir HTTP/1.0" 404 282 > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET > > /MSADC/root.exe?/c+dir HTTP/1.0" 404 280 > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > > /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > > /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > > /scripts/..%255c../winnt/system32/cmd.exe?/c+dir > > > > I was wondering if Shorewall could be used to filter this type of thing? > > No. Shorwall is a packet filter - to filter based on data stream content > requires some sort of Proxy. > > -Tom > -- > Tom Eastep \ Shorewall - iptables made easy > AIM: tmeastep \ http://www.shorewall.net > ICQ: #60745924 \ teastep@shorewall.net > > _______________________________________________ > Shorewall-users mailing list > Shorewall-users@shorewall.net > http://www.shorewall.net/mailman/listinfo/shorewall-users >
Jérôme Tytgat wrote:> In fact iptables can do this with the patch string enabled. >And there are long and bloody threads on the Netfilter mailing list describing why this is a very poor idea. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net
> Joe Gofton wrote: > > Is there a way to filter websites with Shorewall? When I > say this I > > mean local websites. For example: My website is www.danicar.net, > > well I get all kinds of worm attacks like: > > > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:57 -0300] "GET > > /scripts/root.exe?/c+dir HTTP/1.0" 404 282 > 214-62.sh.cgocable.ca - - > > [06/Oct/2002:06:59:57 -0300] "GET /MSADC/root.exe?/c+dir > HTTP/1.0" 404 > > 280 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > > /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > > /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290 > > 214-62.sh.cgocable.ca - - [06/Oct/2002:06:59:58 -0300] "GET > > /scripts/..%255c../winnt/system32/cmd.exe?/c+dir > > > > I was wondering if Shorewall could be used to filter this type of > > thing? > > No. Shorwall is a packet filter - to filter based on data > stream content > requires some sort of Proxy. > > -Tom > -- > Tom Eastep \ Shorewall - iptables made easy > AIM: tmeastep \ http://www.shorewall.net > ICQ: #60745924 \ teastep@shorewall.net >proxy for content-filtering -> http://www.cert.dfn.de/eng/fwl/httpf/httpf.html
This is a multipart message in MIME format. --=_alternative 0060356983256C4F_Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable I would sugest installing transparent squid and use its powerful ACL=20 feature to filter that. but that is another list... Tom Eastep <teastep@shorewall.net>=20 Sent by: shorewall-users-admin@shorewall.net 11/10/2002 11:33 To J=E9r=F4me Tytgat <jtytgat@websurg.com> cc jgofton@danicar.net, shorewall-users@shorewall.net Subject Re: [Shorewall-users] Filter Question J=E9r=F4me Tytgat wrote:> In fact iptables can do this with the patch string enabled. >=20And there are long and bloody threads on the Netfilter mailing list=20 describing why this is a very poor idea. -Tom --=20 Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F Shorewall-users mailing list Shorewall-users@shorewall.net http://www.shorewall.net/mailman/listinfo/shorewall-users --=_alternative 0060356983256C4F_Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable <br><font size=3D2 face=3D"sans-serif">I would sugest installing transparent squid and use its powerful ACL feature to filter that. but that is another list...</font> <br> <br> <br> <br> <table width=3D100%> <tr valign=3Dtop> <td width=3D40%><font size=3D1 face=3D"sans-serif"><b>Tom Eastep <teastep@shorewall.net></b> </font> <br><font size=3D1 face=3D"sans-serif">Sent by: shorewall-users-admin@shorewall.net</font> <p><font size=3D1 face=3D"sans-serif">11/10/2002 11:33</font> <td width=3D59%> <table width=3D100%> <tr> <td> <div align=3Dright><font size=3D1 face=3D"sans-serif">To</font></div> <td valign=3Dtop><font size=3D1 face=3D"sans-serif">J=E9r=F4me Tytgat <jtytgat@websurg.com></font> <tr> <td> <div align=3Dright><font size=3D1 face=3D"sans-serif">cc</font></div> <td valign=3Dtop><font size=3D1 face=3D"sans-serif">jgofton@danicar.net, shorewall-users@shorewall.net</font> <tr> <td> <div align=3Dright><font size=3D1 face=3D"sans-serif">Subject</font></div> <td valign=3Dtop><font size=3D1 face=3D"sans-serif">Re: [Shorewall-users] Filter Question</font></table> <br> <table> <tr valign=3Dtop> <td> <td></table> <br></table> <br> <br> <br><font size=3D2><tt><br> <br> J=E9r=F4me Tytgat wrote:<br> > In fact iptables can do this with the patch string enabled.<br> > <br> <br> And there are long and bloody threads on the Netfilter mailing list <br> describing why this is a very poor idea.<br> <br> -Tom<br> -- <br> Tom Eastep \ Shorewall - iptables made easy<br> AIM: tmeastep \ http://www.shorewall.net<br> ICQ: #60745924 \ teastep@shorewall.net<br> <br> =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F<br> Shorewall-users mailing list<br> Shorewall-users@shorewall.net<br> http://www.shorewall.net/mailman/listinfo/shorewall-users<br> </tt></font> <br> --=_alternative 0060356983256C4F_=--