Subject: [Fwd: Sharing file systems]

From: Michel Bardiaux <[email-masked]>
Date: Mon, 31 Jan 2000 12:00:09 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Michel Bardiaux wrote:
> 
> Maria Alandes Pradillo wrote:
> >
> >         My TIS firewall protects an intranet which contains a server.
> > This server contains an Oracle DB and other applications such as
> > Rational that are accesed by clients. These clients also store
> > information in the server disk.
> 
> I assume the "clients" are outside the FW, i.e. somewhere on the
> Internet.
> Hence, they should *not* be trusted; hence, they should *never* be
> granted
> access to the intranet without rigorous security check.
> >
> >         I have two problems:
> >
> >         How can the clients access Oracle and Rational? Shall I use
> > plug-gw to connect the clients to the properly ports in the server?
> > (Another problem is that some ports are unknown, for instance the one to
> > give the key)
> 
> As I said above, very very dangerous. You should use SSH to tunnel
> through
> the firewall (if the clients can be trusted once they are
> authenticated),
> or provide the services on servers in the DMZ rather than the intranet.
> >
> >         The clients and the server are Windows-NT, how can the clients
> > view the server files through the firewall?
> 
> The Wintel rerquirement complicates things. There are several SSH
> clients for NT, including
> some OpenSource ones, but I do not know any SSH server for NT. Maybe
> someone
> did a port to Cygnus? Running sshd on the FW is a possibility, though
> not a
> good one, since the keyring would be much more vulnerable.
> >
> >         I installed TIS succesfully, but now no clients can use the
> > server, so I had to remove the firewall ;-)
> >
> Logical; a FW is not very useful if you have to grant unrestricted
> access anyway.
> 
> PS: I realize I sound dangerously pontificating :-) If I wrote something
> silly, please
> correct me!
> 
> Greetings.
> --
> Michel Bardiaux

-- 
Michel Bardiaux
UsrConsult S.P.R.L.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10