7245b843bb
PR: 184110 Submitted by: Marie Helene Kvello-Aune <marieheleneka@gmail.com> Reviewed by: wblock Approved by: wblock (mentor) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D3528
96 lines
3.0 KiB
Groff
96 lines
3.0 KiB
Groff
.\"
|
|
.\" blackhole - drop refused TCP or UDP connects
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\"
|
|
.\"
|
|
.\" $FreeBSD$
|
|
.Dd September 6, 2015
|
|
.Dt BLACKHOLE 4
|
|
.Os
|
|
.Sh NAME
|
|
.Nm blackhole
|
|
.Nd a
|
|
.Xr sysctl 8
|
|
MIB for manipulating behaviour in respect of refused SCTP, TCP, or UDP connection
|
|
attempts
|
|
.Sh SYNOPSIS
|
|
.Cd sysctl net.inet.sctp.blackhole Ns Op = Ns Brq "0 | 1 | 2"
|
|
.Cd sysctl net.inet.tcp.blackhole Ns Op = Ns Brq "0 | 1 | 2"
|
|
.Cd sysctl net.inet.udp.blackhole Ns Op = Ns Brq "0 | 1"
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Nm
|
|
.Xr sysctl 8
|
|
MIB is used to control system behaviour when connection requests
|
|
are received on SCTP, TCP, or UDP ports where there is no socket listening.
|
|
.Pp
|
|
The blackhole behaviour is useful to slow down an attacker who is port-scanning
|
|
a system in an attempt to detect vulnerable services.
|
|
It might also slow down an attempted denial of service attack.
|
|
.Ss SCTP
|
|
Setting the SCTP blackhole MIB to a numeric value of one
|
|
will prevent sending an ABORT packet in response to an incoming INIT.
|
|
A MIB value of two will do the same, but will also prevent sending an ABORT packet
|
|
when unexpected packets are received.
|
|
.Ss TCP
|
|
Normal behaviour, when a TCP SYN segment is received on a port where
|
|
there is no socket accepting connections, is for the system to return
|
|
a RST segment, and drop the connection.
|
|
The connecting system will
|
|
see this as a
|
|
.Dq Connection refused .
|
|
By setting the TCP blackhole
|
|
MIB to a numeric value of one, the incoming SYN segment
|
|
is merely dropped, and no RST is sent, making the system appear
|
|
as a blackhole.
|
|
By setting the MIB value to two, any segment arriving
|
|
on a closed port is dropped without returning a RST.
|
|
This provides some degree of protection against stealth port scans.
|
|
.Ss UDP
|
|
Enabling blackhole behaviour turns off the sending
|
|
of an ICMP port unreachable message in response to a UDP datagram which
|
|
arrives on a port where there is no socket listening.
|
|
It must be noted that this behaviour will prevent remote systems from running
|
|
.Xr traceroute 8
|
|
to a system.
|
|
.Sh WARNING
|
|
The SCTP, TCP, and UDP blackhole features should not be regarded as a replacement
|
|
for firewall solutions.
|
|
Better security would consist of the
|
|
.Nm
|
|
.Xr sysctl 8
|
|
MIB used in conjunction with one of the available firewall packages.
|
|
.Pp
|
|
This mechanism is not a substitute for securing a system.
|
|
It should be used together with other security mechanisms.
|
|
.Sh SEE ALSO
|
|
.Xr ip 4 ,
|
|
.Xr sctp 4 ,
|
|
.Xr tcp 4 ,
|
|
.Xr udp 4 ,
|
|
.Xr ipf 8 ,
|
|
.Xr ipfw 8 ,
|
|
.Xr pfctl 8 ,
|
|
.Xr sysctl 8
|
|
.Sh HISTORY
|
|
The TCP and UDP
|
|
.Nm
|
|
MIBs
|
|
first appeared in
|
|
.Fx 4.0 .
|
|
.Pp
|
|
The SCTP
|
|
.Nm
|
|
MIB first appeared in
|
|
.Fx 9.1 .
|
|
.Sh AUTHORS
|
|
.An Geoffrey M. Rehmet
|