So I've added some suggested changes and would like to do this on the list instead of on IRC. So here's what I propose:
http://mmcgrath.fedorapeople.org/policy/ [1]
1) I'd like everyone in a sysadmin* group to be compliant with this policy as part of orientation for new members.
2) I'd like everyone who is already in a sysadmin* group to become compliant with this standard by March 31st 2009. PLENTY of time to make whatever changes you need to make.
3) We'll continue to refine this policy but never with the assumption that everyone is immediately compliant. Notice will be given.
-Mike
[1] I'm working on finding permanent hosting for that, but for now fedorapeople will work.
Hi there,
in iptables config, why not, change the default forward policy to drop ? by default ip forwarding is off, but I think is a good practice deny everything by default, just in case.
cheers, ./bras
On Jan 20, 2009, at 4:34 PM, Mike McGrath wrote:
So I've added some suggested changes and would like to do this on the list instead of on IRC. So here's what I propose:
http://mmcgrath.fedorapeople.org/policy/ [1]
- I'd like everyone in a sysadmin* group to be compliant with this
policy as part of orientation for new members.
- I'd like everyone who is already in a sysadmin* group to become
compliant with this standard by March 31st 2009. PLENTY of time to make whatever changes you need to make.
- We'll continue to refine this policy but never with the
assumption that everyone is immediately compliant. Notice will be given.
-Mike
[1] I'm working on finding permanent hosting for that, but for now fedorapeople will work.
Fedora-infrastructure-list mailing list Fedora-infrastructure-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list
On Tue, 20 Jan 2009, Jorge Bras wrote:
Hi there,
in iptables config, why not, change the default forward policy to drop ? by default ip forwarding is off, but I think is a good practice deny everything by default, just in case.
I could be wrong on this but:
net.ipv4.ip_forward = 0
listed in 1.2 should cover that. I'm not sure how its all designed to work. I just know how it seems to work.
Its probably not a bad idea to set it in both places though.
-Mike
Hiya,
There's subtle differences between both of the forward statements though.
net.ipv4.ip_forward = 0
is referring to allowing IP traffic to forward between two networks, be it virtual or physical.
The IP Tables forwarding rules are more for forwarding traffic into different IP tables chains to then be dealt with. i.e. http://jengelh.medozas.de/images/nf-packet-flow.png
This doesn't mean it can't be used to then send the traffic out of another network port, but to do that you need the net.ipv4.ip_forward = 1 where as sendign it down a different IP tables chain you do not necessarily need that set.
Hope that made sense :) Matt
2009/1/20 Mike McGrath mmcgrath@redhat.com
On Tue, 20 Jan 2009, Jorge Bras wrote:
Hi there,
in iptables config, why not, change the default forward policy to drop ? by default ip forwarding is off, but I think is a good practice deny everything by default, just in case.
I could be wrong on this but:
net.ipv4.ip_forward = 0
listed in 1.2 should cover that. I'm not sure how its all designed to work. I just know how it seems to work.
Its probably not a bad idea to set it in both places though.
-Mike
Fedora-infrastructure-list mailing list Fedora-infrastructure-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list
infrastructure@lists.fedoraproject.org
-
Jorge Bras -
Matthew ... -
Mike McGrath