Specifications

Help

Examples:

Examine the log ﬁles for messages of the IP ﬁlter.

Search for certain unusual IP addresses (frequently occurring rejection of

packets that correspond to IP addresses on one or more port numbers). Find

out exactly what happened. Using FAS, examine the log ﬁles according to

deﬁnable criteria.

Sometimes, it is unclear what to look for until you ﬁnd it. It is also possible

that a system administrator from another network is reporting a complaint,

via postmaster or abuse mail address, that attacks have been occurring from

your network to remote hosts. Take such complaints seriously. Request that

logs of all intrusions are sent so you have an idea of the date and time as

well as the method of attack on the external system. Attempt to verify the

circumstances surrounding the incident. A cracker, intruder, or attacker may

have already overstepped the security boundaries and misused your network.

Here as well, the reputation of your business is at stake.

Once you have backed everything up and documented it, review your ﬁre-

wall conﬁguration. After ﬁxing possible errors or after shutting down ser-

vices at risk, restart your ﬁrewall. This shows the clear advantage of the

SuSE Firewall on CD: the original status of the ﬁrewall can be restored sim-

ply by rebooting the ﬁrewall host, making a complicated reinstallation of the

operating system and restoring backups unnecessary.

Advantage of the Live File System of the SuSE Firewall on CD

One of the greatest advantages of the SuSE Firewall on CD is that its initial

state can be restored simply by booting it. Keep in mind that any possible

conﬁguration errors may reappear.

If the ﬁrewall has been breached, the method of intrusion should be investi-

gated to correct conﬁguration errors. If security holes are found in applica-

tions, SuSE Linux AG provides updates for the affected applications — in the

case of the Live CD, a new CD.

Find more information at

http://www.suse.de/de/security/, http:

//www.cert.org, and http://www.first.org.

147SuSE Linux – Firewall on CD2