debian kernel

[agar]

I just installed debian woody on a 133 and it installed the kernel on the disk which is 2.2.19. I will be running a web, SQL, ftp and samba file server from this pc. Is there any need to get a newer kernel in this thing?

[Feztaa]

Yes!

You must upgrade to at least 2.4.9.

That way you get iptables instead of ipchains, and your iptables has the string module (which is very useful for blocking Nimda and related attacks).

If you're planning to run this without a firewall (shame on you!), then kernel 2.2.19 will be fine as far as I can tell.

[Ashcrow]

Your kernel is fine as it is, but I would recomend upgrading it to the newest stable 2.2 release (or 2.4 release).

Iptabels are very cool but you can use ipchains to do most of the same stuff.

if ur gonna stay with the 2.2 kernel series i would upgrade to 2.2.20

but like Feztaa said, upgraid to 2.4 because iptables simply kicks ass compared to ipchains plus the virtual memory in the 2.4 kernel series is superior to 2.2 and it's safe to say the 2.4 kernel is stable now. i'd go with 2.4.16 if i were u

[agar]

the only port open on this thing is gonna be port 80 and is it possible to upgrade kernel with apt-get or will I have to do it by compiling? I'm only asking this because I once saw an article about upgrading kernel with rpm packages. Ofcourse I never did read it

[Feztaa]

the only port open on this thing is gonna be port 80

I don't lock my doors, because I only leave one window open when I leave the house for extended periods of time.

You need a firewall! The fact that you have one port open makes a firewall even more important than if you had no ports open!

and is it possible to upgrade kernel with apt-get or will I have to do it by compiling?

You can apt-get your kernel, but it has a really screwy name. it's like kernel-image-2.4.16-1 or something like that. You'd be better off using dselect, and searching for "kernel" until you find the version you want.

Then you just have to install it, edit your lilo.conf to boot the new kernel, then run lilo, and you're set!

[agar]

but its behind the router and the only port open to the outside is port 80 for the webserver. If the webserver is running on port 80 what would a firewall do? The port is already being used to the webserver and nothing else is open

[Feztaa]

but its behind the router and the only port open to the outside is port 80 for the webserver.

Ok, well that changes things. So the router only lets port 80 through? That's good.

If the webserver is running on port 80 what would a firewall do? The port is already being used to the webserver and nothing else is open

The firewall would protect you from FIN, XMAS, and NUL scans. It would also stop other programs from running as servers if they try to without your permission.

Also, if there is an exploit in your webserver, an attacker could potentially use it to open up other ports on the machine. A firewall would help to prevent that.

And on top of that, your firewall can block packets containing certain words (with the string module). This functionality can be used to prevent Nimda-style attacks. Yes I know apache is immune to Nimda, but it takes less system resources to block it at the firewall level, instead of letting the packet get all the way to apache, forcing apache to write some logs and send an error message, blah blah blah.

There's no reason not to use one.

[agar]

I thought firewalls simply blocked ports coming in

[kenshi]

I thought firewalls simply blocked ports coming in

I'm sure that's what they mean, though firewalls can block anything.