String
The string module seems like a great idea to filter some of the httpd attacks. Is there any way to make it work in kernel 2.6.7? In the alternative is there something else that might do similar filtering?
Thanks.
Signature · 2 lines
David Cary Hart Hart's PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x58A60BB1
Quoted 2 lines · David Cary Hart
The string module seems like a great idea to filter some of the httpd attacks.
It may seem like a great idea, but it has limitations which (IMHO) mean it's just not worth using (for this sort of task).
The two major limitations are:
1. It will only match on a string which is completely contained within one packet - therefore a string "GET /index.html" which has the "GET " at the end of one packet, and the "/index.html" at the start of the next will not be matched.
2. The string match works on literal text characters, and therefore will not match anything at all for a gzip-compressed HTTP stream (quite commonly encountered with modern servers).
Quoted 1 line
In the alternative is there something else that might do similar filtering?
Yes, Squid, Dan's Guardian - something which truly understands HTTP, rather than just TCP/IP.
Regards,
Antony.
Signature · 5 lines
The difference between theory and practice is that in theory there is no
difference, whereas in practice there is.
Please reply to the list;
please don't CC me.