-m string --string cmd.exe

Hi Allen,

Download the newest version of iptables and make patch-o-matic.
This patch is experimental, i had to modify the source code of ipt_string.c to get this feature. After patching, activate the "string match support" in the kernel.

Cheers,
Annette

-------------------------------------------------------------------------------------------------------------------------------
Cablecom GmbH
Security Team
Zollstrasse 42
CH-8021 Zürich
Voice: +41 1 277 99 21
Fax: +41 1 277 93 22
E-Mail: [email protected]

hello:

i read in the linux journal the article "A NATural Progression" about a rule which twinked my interest:

iptables -t filter -I FORWARD -m string \
--string=root.exe -j DROP

this set me to thinking, "ahhhh, a way to stop all those microcosm virii. they have the commonality of the string 'cmd.exe.'" so off i go to build a rule of similar bent, that is:

iptables -A  INPUT -i $EXTERNAL -p tcp --dport 80 \
    -m string --string=cmd.exe -j DROP

when i try to use this rule, i get the following error:

iptables v1.1.1: Couldn't load match `string'

have i missed something, or do i need to recompile the kernel (please say it ain't so.....) fyi, i am using rh 7.0 and rh 7.2 on the servers.

regards,
allen wayne best, esq
"your friendly neighborhood rambler owner"
"my rambler will go from 0 to 105"
Current date: 20:54:8::161:2002

"Gort, klaatu nikto barada."
-- The Day the Earth Stood Still