howto make a networkcard readonly

[Donald Kok]

Hi there,
i like to configure a networkcard on an hpux 11 machine readonly. With this device I want to use snort, ttt ....

Can this be done.
(The only thing I think of is remove the w-bit in the devicefile)

Thanks
Donald

[Steven E. Protter]

The common way this is achieved is to make the filesystems available to the users read only.

Even if you accomplished this through some ndd command or slight of hand, you'd not have a system configuration many people would easily recognize. Kinda makes vacations tough you know?

Think about NFS exports(thought the data is not encrypted) with read only rights. Or CIFS/9000 Samba shares with the same priviledges.

Those ideas are secure and standardized.

SEP

[Donald Kok]

Hi SEP,

I want to be sure the networkport does generate any kind of traffic. I will describe what I want to do:

On the switch where the Default Gateway is connected , I spanned the DG-port to another port. The output on this port is used for analyses. On different machines I use snort, ttt and fluke. Do have the output of the spanned port available to all these machines, I connected the spanned port to a hub. I do NOT want traffic FROM the machines on the hub, since the other machines will notice this.

So I want a network who carefully listens, but does not talk.

Greetzz
Donald

[Jeff Schussele]

Hi Donald,

I'm not sure of this & have never tried it, but if this is on a different subnet than your "main" public IP. But possibly, if you don't setup a static route for it, then all traffic should go *out* the other IP to it's default gateway.

You may want to disable dead gateway probe
ip_ire_gw_probe=0 to keep it completely silent & there may be other options (source quench?) to enable/disable.

HTH,
Jeff

[Ron Kinner]

Might be simpler to just build a receive only cable:

http://www.dggomez.arrakis.es/secinf/roc/roc.pdf

Of course if you have a switch you shouldn't need a fancy cable since you won't be able to see traffic to other ports unless you use port monitoring (SPAN on Cisco) and in that case there is no real need for a readonly setup.

Also from the Snort archives:

You can do "stealth" config on most OSs (including NT).

On linux and BSD (for interface eth1) just activate the interface:

ifconfig eth1 up

and be sure to specify the interface with snort -i eth1



Another possibility is to use a tap. See:

http://www.netoptics.com/10-100-tap.html

http://www.comcraftfr.com/ethertap100tx.htm

for examples. In this situation you wouldn't have to worry about whether the NIC was Read Only since even if it decided to send something out it would be blocked.

Ron

[Sergejs Svitnevs]

You can create SPAN session (with inpkts disable option) to disable incoming packets on the destination port:
set span both inpkts disable learning enable create

Regards,
Sergejs

[Sridhar Bhaskarla]

Hi Don,

As long as the network interface is connected to the network, it is not necessary to plumb the card.

I use ethereal. Though it doesn't show up the unplumbed interfaces in it's GUI, you can sniff the interface by using "ethereal -i lanx".

-Sri