RE: [cobalt-users] Is a firewall necessary with a RaQ?

["Todd Kirk" <tkirk@xxxxxxxxxxxxxx>]

>> Probably good to close the ports but a firewall does give you 
>> much greater 
>> protection.
 
> Example: Suppose you notice someone poking around your 
> sensitive ports.. go 
> to the firewall rules and block that specific IP from your 
> box in two simple 
> steps.
> 
> Firewalling allows far greater protection than simply turning 
> off ports.

Our 'out-of-the-box' RAQ4R temporarily blocks an IP address when they
'poke' around..like when you get port scanned the IP gets suspended for
about 60 seconds.

I guess the real difference with something like port sentry and IP
chains is that a permanent rule gets automatically created to block that
IP, as you mention above.

A useability thought here - if someone is on a dynamic IP address the
next time they logon (given a fresh IP address) then the firewall would
cease block the correct person...further an innocent person who may have
been assigned the original 'now blocked' dynamic IP could not see your
server and therefore any of or websites!

Is my logic correct here??

 
regards,
 
Todd Kirk