[CentOS] pointers for using CentOS box as filter for children

Wed Oct 12 00:44:59 UTC 2005
Rodrigo Barbosa <rodrigob at suespammers.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Oct 11, 2005 at 11:18:56AM -0700, Steven Vishoot wrote:
> > > Rob,
> > > 
> > > I thought IM uses a specific port and you would be
> > > able to block that port. I know certain ones like
> > mirc
> > > uses port 6667 if i am remembering correctly.
> > Anyone
> > > can correct me if i am totally wrong. 
> > 
> > Steven,
> > 	you are "not exactly correct". Yes, 6667 is usually
> > the port IRC
> > Servers use, but not always. I have seem plenty of
> > servers using other ports,
> > including 6668, 6669, 6670, 31337 and even 194.
> > 
> > 	That is the same for IM softwares. Not to mention
> > the fact that many
> > simply use http-based protocols, with port 80.
> > 
> > 	Blocking IMs is not as simple as it may seem.
> > 
> Rodrigo,
> 
> thank you for correcting me, i knew i was kind of in
> the neighborhood and knew it was not that simply since
> a lot im programs use different ports. So it might a
> good idea to know what IM program they are using would
> you think?

Actually, the best way to go is to use one of those netfilter modules
that look at the trafic itself to identify what it is about, instead of
simply trusting the TCP/UDP port numbers.

There are at least 2 of those that people have been using, the named of
which have escaped my mind right now. Blame it on this damn heat wave we
are having down here in Brazil these days.

I'm sure someone else on the list can point you to those.

That way, you can block the MSN Protocol, no matter which server or
port they are connecting to. Same goes for GAIM, ICQ etc etc.

Of course it is not 100% garanteed. Nothing is. But if you combine
that with port and ip blocking, you can get very close to that.

[]s

- -- 
Rodrigo Barbosa <rodrigob at suespammers.org>
"Quid quid Latine dictum sit, altum viditur"
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDTFyLpdyWzQ5b5ckRAp75AJ4jlI1Lsf4DzEUGc7B5N9te05hicwCguPku
DKocZQAZm+vvSEeQnBCWz/o=
=6jmv
-----END PGP SIGNATURE-----