About the SuSE Firewall and rootkit hunters.

Hi,

I've been using SuSe 9.3 for about 4 months now, (and regard it as superior
to M$ in almost every respect!) this, however also means that I'm still a
bit novice Linux-wise, so please bear with me on these questions .
Perhaps it is because of my long and arduous experience with M$ that has
made me paranoid on some security issues, and perhaps I haven't really
understood the security of Linux over M$... Well here goes my two guestions:

1, Is it possible to make the firewall allow only some _programs_ to
explicitly access the internet and make it refuse the connection from all
other programs (like in all M$ type firewalls). The SuSE Firewall and e.g.
Guarddog enable tweaking only at the service level (and Guarddog doesn't
seem to be albe to function properly on SuSE). Is this even a desired
effect; does Linux use a totally different philosophy with firewalls, or do
I have to start rewriting and editing ipchains rules by hand to achieve
this? I havent really found any answers to this from any Linux firewall guides.

2, I read somewhere that rootkit programs (like rkhunter) are intended
firstly for server machines, but are there any practical benefits or
reasons to use them on a normal workstation that has continuous broadband
internet access. Am I just overreacting to all sorts of linux trojans and
spy programs?

Many thanks for any replies!

ludvikengelbrekt@yahoo.co.uk wrote:

> 1, Is it possible to make the firewall allow only some _programs_ to

No. Not to my knowledge. Actually, the firewall is a packet filter that
operates on addresses and ports. It has no knowledge of applications.

> 2, I read somewhere that rootkit programs (like rkhunter) are intended
> firstly for server machines, but are there any practical benefits or
> reasons to use them on a normal workstation that has continuous broadband
> internet access.

True.

> Am I just overreacting to all sorts of linux trojans and
> spy programs?

Yes, you are :-) But better safe than sorry. Running a rootkitdetector now
and again on any host is a Good Thing (TM).

--
Ruurd

In article <7gCQe.4529$w73.3091@prv-forum2.provo.novell.com>, R.F. Pels
wrote:
> > 1, Is it possible to make the firewall allow only some _programs_ to
>
> No. Not to my knowledge. Actually, the firewall is a packet filter that
> operates on addresses and ports. It has no knowledge of applications.
>
However, if an application always communicates over the same port, a
firewall can be tailored to that port/application.

bd
NSC Volunteer SysOp