Subject: Sharing file systems

From: Maria Alandes Pradillo <[email-masked]>
Date: Mon, 31 Jan 2000 10:57:54 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

    Hi Everybody!

        My TIS firewall protects an intranet which contains a server.
This server contains an Oracle DB and other applications such as
Rational that are accesed by clients. These clients also store
information in the server disk.

        I have two problems:

        How can the clients access Oracle and Rational? Shall I use
plug-gw to connect the clients to the properly ports in the server?
(Another problem is that some ports are unknown, for instance the one to
give the key)

        The clients and the server are Windows-NT, how can the clients
view the server files through the firewall?

        I installed TIS succesfully, but now no clients can use the
server, so I had to remove the firewall ;-)

                Thanks!!

--
María Alandes Pradillo

Universidad Politécnica de Madrid (Madrid Technical University)
E.U. Informática. Organización y Estructura de la Información
Ctra. de Valencia, Km. 7. E-28031 Madrid. Spain
T.: (+34)-913367881 Fax. (+34)-913367520
e-mail: [email-masked]

---

From: Maria Alandes Pradillo <[email-masked]>
Date: Mon, 31 Jan 2000 12:39:06 +0100

Michel Bardiaux escribió:

> I assume the "clients" are outside the FW, i.e. somewhere on the
> Internet.
> Hence, they should *not* be trusted; hence, they should *never* be
> granted
> access to the intranet without rigorous security check.

Actually, the clients are outside the firewall (sorry for not specifying this
before). The problem is that they are not inside the firewall because its
physical distribution, I mean, they are in other rooms far away from the lab
where the firewall is. But they are allowed to use the services inside the
firewall: Oracle, rational, disk and, I forgot to mention it before, a
printer. We do want them to use this services.

> As I said above, very very dangerous. You should use SSH to tunnel
> through
> the firewall (if the clients can be trusted once they are
> authenticated),

Sure they are authenticated...

> or provide the services on servers in the DMZ rather than the intranet.
> >
>

That's not possible. The main problem is that we have a "SUPER"-server. Not
only does it provide ftp, mail and a web page! but also server applications.
The printer is connected to another computer. We cannot afford more computers,
that's why the sever is overloaded. I know that all these things living
toguether can bring big problems (i.e big security holes due to http) but I
should try to make it work

> The Wintel rerquirement complicates things. There are several SSH
> clients for NT, including
> some OpenSource ones, but I do not know any SSH server for NT. Maybe
> someone
> did a port to Cygnus? Running sshd on the FW is a possibility, though
> not a
> good one, since the keyring would be much more vulnerable.
> >
>

I would be very grateful if you could tell me where I can find information
about these topics.

Thanks a lot!

--
María Alandes Pradillo