I think everyone that uses UNIX/Linux are highschool/junior college boys who have never worked in the real world and have never seen a W2K active directory environment before. The security parameters are limitless, group policies, IPSec (which works at the IP layer), registry manipulation (I attached a small attached example of some of the registry policies we are implementing now) - all these things provide strong machine-level security.

Allow DEAD gateway detection
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Enab
leDeadGWDetect = 0

Disable IP source routing
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Disa
bleIPSourceRouting=2

Enable ICMP redirect (disabled)
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Enab
leICMPRedirect=0

Enable packet MTU discovery (Fix MTU of 576 byte for non local subnet connections)
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Enab
lePMTUDiscovery=0

Enable Router discovery (disabled)
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Perf
ormRouterDiscovery=0

Keep alive time for TCP connection (5 Minutes)
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Keep
AliveTime=300000

Maximum number of half-open retire TCP sockets to maintain
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\TcpM
axHalfOpenRetired=160

Maximum number of half-open TCP sockets to maintain
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\TcpM
axHalfOpen=200

Protect against Computer Browser spoofing attacks
HKLM\System\CurrentControlSet\Services\Netbt\Parmaeters\NoNa
meReleaseOnDemand=1

Protect against SYN attacks
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\SynA
ttackProtect=2

You can all comment on how Windows cannot be secured and is "broken", but I just laugh at you because you display your inexperience and simply make me shake my head at how dumb you must be.

You all keep reading your Register.uk garbage and propaganda/lies and we'll all continue to make the big bucks while you children wait at your parents house for Mullen to post so you can reply with the opposite of whatever he says.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/152/19235#19235