[solved] How to prevent system applications from accessing a network device

[doctordruidphd]

I'm posting this on "new guy" because I have no idea where to start searching for answers.

The general project is to set up the system to packet radio.

One thing that is involved is setting up a software modem, which installs itself as a network device /dev/sm0. As soon as I do that, it starts trying to send packets, I assume tcpip from various things on the system probing it. That won't work.

The instructions I am using state that, "you'll have a port name like "sm0". It appears to the system like an ethernet or wireless networking port and you may need to tell some system daemons not to use it. " Only thing it doesn't tell is HOW.

So, how do I go about keeping system programs from probing the port, which at the same time keeping it available for the applications that need to use it?

[jager]

Re: How to prevent system applications from accessing a network device

Interesting stuff. I've never tried X.25 but I looked around a bit for you and found this: http://www.xastir.org/wiki/HowTo:AX.25 linked from what looked to be the wiki you were using for setup instructions. (I googled your quoted sentence.) On that page toward the bottom you'll see instructions for a few daemons and some ideas to generalize them:

'Extra transmissions seen after configuring port

Extra transmissions could be from any network-capable program such as "Samba", "Icecream", or other Linux daemons or games. Many periodically send broadcasts on all networking ports.

Samba has been known to do this: Tweak the Samba config file to specify which ports it can/cannot use. Samba will re-read it's config file within 60 seconds and stop using the port.

Icecream has done this on wireless ports, so I assume it might do the same for an AX.25 port. Either kill it or change it's configs to disallow that port.

CUPS is also responsible for this sort of behavior if you enable the "Share published printers connected to this system" option. This option defaults to "off" but if you turn it on, CUPS rudely broadcasts IPP discovery packets repeatedly to all interfaces, and gives absolutely no option for selecting which interfaces to use. There are bugs in the CUPS bugzilla about this.

Dropbox, an offsite backup/archive service will pump broadcast messages to all interfaces by default also. The key is the "port": 17500, appearing in the output of a '/usr/bin/axlisten -c -a' command. To avoid this problem, right click on the dropbox icon in the system tray (at least in KDE it's there), select Preferences and deselect the 'Enable LAN Sync' check box.

Alternatively one can tweak the firewall rules to disallow those daemons from talking out specific ports.'


Hope this is helpful.

[wizard10000]

Re: How to prevent system applications from accessing a network device

...So, how do I go about keeping system programs from probing the port, which at the same time keeping it available for the applications that need to use it?

Thinking out loud here but I'm thinking a combination of hosts.allow and hosts.deny would work.

You'd deny access to all in hosts.deny and enable the single daemon or application in hosts.allow.

Hope this helps -

[doctordruidphd]

Re: How to prevent system applications from accessing a network device

Thanks for your reply.

I think I have found the problem -- the avahi daemon.

I stopped it by adding a deny-interfaces=sm0 line to etc/avahi/avahi-daemon.conf and restarting.

the other info is good to keep on hand, though, in case other demons raise their heads.