Security

Apparantly there is some sort of DDoS attack against www.FreeBSDChina.org. What was that? Some internal information told me that it was an intended test against www.freebsdchina.org. We have found some defects in the original website design and that should be corrected soon.

I have plugged a workaround to defeat the DDoS attack, now the load average fall from 70 to 0.65.

While I believe that proactive security practice is necessary for every consumers, the most conversave ones should argue that even a security update will possibly break compablity.

Now I am in trouble. With rsync 2.5.5 installed on a FreeBSD system, we know that it is possible to overflow its heap, however, shall we patch it, or just let it as-is because it is not exploitable on FreeBSD, unlike Linux’s silly brk(9) implementation?

Finally, yes, itojun has imported pf(4) into NetBSD. Having pf(4) in base indicates that NetBSD’s recognition of pf(4) related work, and as security officer of NetBSD, itojun-san’s import have some special meanings.

I have watched spurious SYN messages and apparantly this has affected beastie.frontfree.net’s networking subsystem, namely, its mail system. The attack is from 203.81.27.11.

Whois indicates 203.81.27.11 is:

I have added some SYNFLOOD proof packet filter rules for beastie.frontfree.net. Interestingly, the filter options seems to “forge” beastie.frontfree.net to be an OpenBSD box.

I think FreeBSD will soon release a new advisory. Simply put, cvs updated again and is vulnerable to some potential security risks.

It appears that NetBSD has finally adopted packet filter, an OpenBSD feature to its base. Compared to FreeBSD’s pf port, this will be much easier one because the VM structure is almostly alike.

Let’s review what I have did years ago. I say, nothing can claim itself secure! Nothing, nothing, nothing!!

Not sure how did the corporation has designed the firewall system, it is simply - bogous and useless, and is fragile by design. All the design’s function is to keep the network out of being functional, not to make it a bit safer.

FreeBSD and OpenBSD’s inetd are based on a same codebase. However, they have different features and OpenBSD have some features that FreeBSD is lacking at present. For example, per-interface binding, etc.