Subject: Need some info

From: [email-masked]
Date: Tue, 21 Mar 2000 13:22:03 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,
    I need your help and some information on the following system we are
trying to implement.
  We are planning to implement a staging FTP server which acts as an
intermediate tier running some kind of a firewall and communicates with the
client and the actual web server for transfer of data to and fro. This is
decided so as to give more security and hence only the FTP staging server
is to be in the opennet. So the client can ftp into this staging server and
whatever ftp commands he gives needs to be communicated to the actual
webserver holding the data. So for instance the user ftps into the
intermediate server and executes  'ls' ( we have a aix system ) it has to
communicate that command to the webserver and return the result to the
client, this is so for all the commands. My question is can we use this
Firewall Toolkit to do this job by having a firewall run on the staging
server and the configuration mapped internally to the webserver so that the
staging server<->client part is in opennet and the staging server<->web
server is in intranet? Please explain to me how can this be done or
configured. I also heard that another product called Gauntlet Firewall from
NAI has similar features. If this is possible is there a version for AIX
for us to use or any beta versions to work together with? Please let me
know.Thanks!!

Regards,
Vik
  Vikram Chakravarthy,
  IBM E-Business Solutions

     T/L 348-2770
      Phone (847)-706-2770
      Fax       (847)-240-8395
      Email: [email-masked]

---

From: "Bill Kocik" <[email-masked]>
Date: Tue, 21 Mar 2000 12:09:37 -0800

The solution that comes to my mind is T.Rex (www.opensourcefirewall.com).
It's FTP proxy can be configured to act as a transparent bastion to an FTP
server sitting behind it (which would be your web server...it'll need to run
an FTP server as well, obviously). The only trouble is this only works well
if you're only using anonymous FTP. T.Rex doesn't allow authenticated FTP
without something like a CryptoCard or SecureCard. It's available for AIX.
You can download source and compile (I've done this...it's a major PITA on
Solaris 7 (but they're aware of the problems and are fixing it), easier on
Linux, haven't tried any other platforms), or buy one of their binary CD's
which aren't expensive.

I suppose this could also be done with the plug-gw portion of FWTK, though
you won't have control over which commands any user can or cannot execute.
If anyone would like to step up and point out that the FWTK FTP proxy can
also do this, please do so. I'm not sure, myself. Gauntlet can also do it,
as can FW1 I'm sure, but I don't personally know if either of those are
available for AIX.

Bill Kocik
Taos Mountain - "The Sys Admin Company"
Santa Clara, California
http://www.taos.com

"Logic is a systematic method of coming to the wrong conclusion with
confidence."

----- Original Message -----
From: <[email-masked]>
To: "Bill Kocik" <[email-masked]>
Cc: "Luis Fernando Barrera" <[email-masked]>; <[email-masked]>;
"Donald J Smith" <[email-masked]>
Sent: Tuesday, March 21, 2000 10:22 AM
Subject: Need some info

---

From: "Alejandro Rusell" <[email-masked]>
Date: Tue, 21 Mar 2000 17:40:55 -0300

> Hello,

Hi,

I understand from your mail that what you want to implement is 
outside access to an internal server (ftp, http?), minimizing the 
security risk.  Am I right?

To do this, you should implement a DMZ, with a firewall with three 
interfaces, one internal, one external and one in the DMZ.  Also, 
you should put application gateways/proxies in the firewall to grant 
the allowed access (internal and external) to the server.

This can be acomplished using FWTK (free product, should get 
from NAI), and if you need access to a web server, definitively 
should use squid (http://squid.nlanr.net/Squid).

Hope that it helps.

Regards,

Alejandro Rusell

> intermediate tier running some kind of a firewall and communicates with
> the client and the actual web server for transfer of data to and fro. This
> is decided so as to give more security and hence only the FTP staging
> server is to be in the opennet. So the client can ftp into this staging
> server and whatever ftp commands he gives needs to be communicated to the
> actual webserver holding the data. So for instance the user ftps into the
> server and the configuration mapped internally to the webserver so that
> the staging server<->client part is in opennet and the staging
> server<->web server is in intranet? Please explain to me how can this be
> done or configured. I also heard that another product called Gauntlet
> Firewall from NAI has similar features. If this is possible is there a
> version for AIX for us to use or any beta versions to work together with?
> Please let me know.Thanks!!
> 
> Regards,
> Vik
>   Vikram Chakravarthy,
>   IBM E-Business Solutions
> 
> 
>      T/L 348-2770
>       Phone (847)-706-2770
>       Fax       (847)-240-8395