Subject: Re: tis on rh linux 6.1

From: Jon Earle <[email-masked]>
Date: Wed, 22 Mar 2000 17:40:23 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

At 03:43 PM 03/21/00, you wrote:
> > Now if you suggest a indepth approach with one box as the application
> > gateway (proxy)
> > and another as the packet filtering (outside the proxy) then I would agree
> > whole heartly with you.
> > You have added to the security without risking the proxy firewall.
> > But adding anything to the proxy firewall adds to the risk.
>
>Even the proxies? I mean, come on, can you honestly say that you're better
>off *not* adding firewall software to your firewall? "Yes sir, we feel the
>naked operating system is pretty secure, and we're afraid that adding

Agreed.  If the point it utter and complete security, then the network the 
firewall is protecting shouldn't be anywhere close to the internet to start 
with.

My philosophy is to make is as difficult as possible for someone to enter 
without my permission.  Now, given that no solution other that cutting the 
wire is 100% secure, the best we can hope for is a darned good 
approximation.  For clients, I use TIS proxies, and although they do 
nothing except pass allowed packets back and forth (and make the users 
enter proxy settings in their software), at least there is a well 
scrutinized and tested piece of code sitting between each interface.  I can 
accept that.  I also employ filters on the same box to scrutinize all 
packets entering _and_ leaving the box, _before_ they even get near the 
proxies.  If the filters don't like the look of the packets, the proxies 
don't deal with them.  Security in layers.

Now, another solution which works well for me and freinds at home, is a 
tight set of ipfwadm/ipchains rules wrapped around masquerading. If 
masquerading (NAT) is employed vs proxies, both accomplish the same thing 
in the end (a packet gets transferred from one interface to the other), and 
NAT allows you to seamlessly access the internet without having to 
configure all your client software.  It is much cleaner, and given that 
most people don't do anything with TIS proxies other than install them, the 
ends offered by NAT (transparent access) are much more desirable and IMHO 
justify the means. Given a good set of filters to allow/deny access to 
prescribed services, and a good policy for determining who can access what, 
and where public services should reside (dmz vs internal lan vs outside), 
the resulting box _should_ be as secure as anything else on the market.

Thoughts?

Jon