Knoppix Firewall

[utu]

In my copy of Knoppix 6.4.3, there is a menu choice under 'Preferences'
called 'Knoppix Firewall'. It doesn't do anything.

If my setup is like everyone elses, I can't imagine why there isn't
some ongoing discussion about this state of affairs.

I can't imagine that if nmap reports 'All 1000 scanned ports
on (my routers address) are closed', that that is the end of it.
Doesn't that leave 64,535 questions unanswered?

Can anyone orient me to some sense of reality here?
Is there no security concern beyond an nmap 1000 port test
for a machine running Knoppix?

[utu]

Here's an interesting answer from a Debian forum:

http://wiki.debian.org/iptables

[daveca]

having the same question, I note this:

http://www.debian.org/doc/manuals/se...firewall-setup

section 5.14.3

My Knoppix 6.4.4 ends up with a message "see Knoppix menu to create persistent image" when I attempt to save firewall settings, I assume, implying there is not a persistent image.

Seeing no menu item for doing that, I assume its crippleware.

"Doesn't that leave 64,535 questions unanswered?"

LOVE IT. computer humour!! and 64,535 hackers...

[Forester]

My Knoppix 6.4.4 ends up with a message "see Knoppix menu to create persistent image" when I attempt to save firewall settings, I assume, implying there is not a persistent image.

Hi Daveca,

Are you running a LiveCD or a LiveUSB ? Unfortunately with Knoppix 6 you cannot have persistent store with the LiveCD. Why is not known. You could with Knoppix 5. Wiki pages and quite possibly Knoppix scripts from the Knoppix 5 era have not all been updated. The Knoppix firewall script may indeed suggest you use the Knoppix menu to create a persistent image but there is no such menu item. You can create persistent store for a LiveUSB installation during boot.

Seeing no menu item for doing that, I assume its crippleware.

I suspect many people thought the same and left years ago.

In my copy of Knoppix 6.4.3, there is a menu choice under 'Preferences'
called 'Knoppix Firewall'. It doesn't do anything.

I suspect there is a misunderstanding of the need for a firewall here.

In the bad old days of dial-up modems, your PC was connected directly to the Internet in the sense that the bad guys out there could probe your IP address to see if they could get in. You needed a firewall to keep them out. In many homes a Windows PC is connected directly to broadband with other PCs in the house connecting through the first. The first needs a firewall, the others don't.

When I ran Windows and Windows firewall software I had a trusted zone - inside the house - and a untrusted zone - outside the house. I had a broadband router and it had all the firewall I needed but I still amused myself with the firewall software discovering just how many Windows applications needed to access the Internet without my knowledge or consent while I wasn't even using them.

If you have a broadband router, it has a firewall, most probably iptables based. Unless you've been playing around with it, your broadband router's firewall will have only two rules:

1. allow any connection from inside out
2. deny all connections from outside in

Inside, on your LAN, you don't need any more firewall unless you are insanely paranoid.

If you want to offer web services on a PC at home or access your PCs from work or college, upload digital photo next time you visit your gran or even just set MythTV to record from your mobile/handy/cell/blackberry/fondleslab/whatever, you would need to open your BBR firewall to allow connections from outside in.

I never done this but AFAIK you might then need firewalls on every PC to ensure the incoming connections only go to the right PC or you might set up a DMZ and a proxy server of your very own or you might prefer to set up own VPN or you might be able to do everything by just configuring your BBR correctly.

From the nature of your questions, I suspect you don't. I would not expect people who need to do this to use Knoppix except perhaps to try things out before doing it for real as servers need high availability and Live distributions don't really qualify.

If anyone knows different, please put me right on this.

[utu]

If you want to ... upload digital photo next time you visit your gran... you would need to open your BBR firewall to allow connections from outside in.

Could you expand on this?

[utu]

@ Forester:

Even more specifically:

Here's what I find using nmap.
I'm presuming all is well, but I don't know.

knoppix@Microknoppix:~$ sudo nmap 192.168.1.1 (My Verizon Router)

Starting Nmap 5.00 ( http://nmap.org ) at 2011-03-24 13:48 UTC
Interesting ports on 192.168.1.1:
Not shown: 993 closed ports
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
443/tcp open https
992/tcp open telnets
4567/tcp open unknown
8080/tcp open http-proxy
8443/tcp open https-alt
MAC Address: 00:18:01:A5:61:5E (Actiontec Electronics)

Nmap done: 1 IP address (1 host up) scanned in 1.95 seconds



knoppix@Microknoppix:~$ sudo nmap 192.168.1.2 (My Laptop)

Starting Nmap 5.00 ( http://nmap.org ) at 2011-03-24 13:48 UTC
All 1000 scanned ports on 192.168.1.2 are closed

Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds
knoppix@Microknoppix:~$

*******************

Questions that remain:
1. How do I know if my router has a firewall?
2. What about Laptop ports above 1000?
3. Why would KK leave in a menu choice that does not work?

[Forester]

Wiki pages and quite possibly Knoppix scripts from the Knoppix 5 era have not all been updated.

Yup. This script (/usr/sbin/firewall) has a copyright date of 2004 and still thinks /KNOPPIX.IMG is the name of the persistent store.

Report it as a bug to KK and/or fix it yourself.

[daveca]

interesting: - see if firewall running

http://wiki.linuxquestions.org/wiki/FireWall