Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Apr 2011 16:26:44 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: new soft: conntrack, ucarp

Hi,

I'd suggest to include into Owl 3 packages:


1) conntrack (http://conntrack-tools.netfilter.org/).

"Program to modify the conntrack tables

 conntrack is a userspace command line program targeted at system
 administrators. It enables them to view and manage the in-kernel
 connection tracking state table."

It is a very usefull tool to debug and profile statefull firewall rules.


24 kb installed in Ubuntu.


2) conntrackd (the same tarball).

"Connection tracking daemon

 Conntrackd can replicate the status of the connections that are
 currently being processed by your stateful firewall based on Linux.
 Conntrackd can also run as statistics daemon."

It can be used for HA firewall setups.  110 kb in Ubuntu.

Both conntrack* require new library, libnfnetlink (14 kb installed in
Ubuntu).


3) ucarp (http://www.ucarp.org/project/ucarp).

"user-space replacement to VRRP -- automatic IP fail-over

 UCARP allows a pair of hosts to share common virtual IP addresses in
 order to provide automatic fail-over. It is a portable user-land
 implementation of the secure and patent-free Common Address Redundancy
 Protocol (CARP, OpenBSD's alternative to the VRRP).
 .
 Strong points of the CARP protocol are: very low overhead,
 cryptographically signed messages, interoperability between different
 operating systems and no need for any dedicated extra network link
 between redundant hosts."

37 kb installed, needs only libpcap.  Originates in OpenBSD camp ;-)


If it is not appropriate to include them into the Owl, it would be handy
to have them in some secondary repository.


Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ