I called it dynfire (Dynamic Firewall Config). Quite frankly, I decided it wasn't worth the effort. My logic was as follows:
1) The only port that needs to be open to the internet is SSH.
2) SSH is known to be very secure.
3) I cannot verify that a program I write will not have an exploitable buffer overflow in it, or that I can design an algorithm for it that won't be open to replay attacks.
4) It is therefore much more likely that my computer will be secure if I open up SSH itself on a high-numbered port rather than put my own daemon there to open up ssh.
Good logic, yes? I have my setup so that ssh is open anywhere, and once I ssh in it detects my IP and automatically opens up other important ports (samba, ftp, etc.) Same effect, but more secure, I think. |
