Subject: Code for firewall "implementation" on an NT OS

From: "John Ward" <[email-masked]>
Date: Fri, 13 Oct 2000 10:38:24 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

Does anyone have info on where i can get to grips with writing code for an
NT firewall ??

Thanks in advance
________________________________________________
John Ward

---

From: [email-masked]
Date: Fri, 13 Oct 2000 15:09:13 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

What is "NT firewall"? Packet filtering engine? Winsock programming?

> Does anyone have info on where i can get to grips with writing code for an

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 13 Oct 2000 13:59:19 +0200

> Does anyone have info on where i can get to grips with writing code for an

If you want to make a packet-filtering FW on NT, that's off-topic for
this list and better discussed elsewhere.

As for a port of FWTK to NT, there are important issues, listed in
(IMHO) decreasing severity:

(1) Hardening NT. You need a box that is impenetrable unless the proxies
are installed. That means disable NT services or make them unaccessible
except from the localhost. Plus, you must make packet-forwarding and
source-routing impossible. Plus all the hardening tips you can find,
including fixing access rights for a great many files in the system
folders. Plus, all the service packs and upgrades to fix known exploits.
You will need some good books. I've heard it said that securing NT takes
*days* even when you know what you're doing.

(2) To port the FWTK code, you don't want to use NT threads for
multiprocessing, to keep sessions totally independent. So you need
fork(), so you need Cygwin.

(3) I don't know whether Cygwin contains an inetd for NT, or
daemonization calls; then you will have to patch the FWTK sources to
make them run as NT services.

(4) There are a number of gotchas in Winsock: the need for startup
calls, the fact you can not use read() or write() on sockets (only
send() and recv()).

Cheers (you'll need them :-)
-- 
Michel Bardiaux

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 13 Oct 2000 12:50:29 -0400

> Does anyone have info on where i can get to grips with writing code for an

How ccan you write a good firewall on an inherently insecure platform?

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 13 Oct 2000 19:12:31 +0200

> How ccan you write a good firewall on an inherently insecure platform?

What do you mean by *inherently*? I would say NT is about as stable and
secure as UNIX was 15 years ago (I was sysadmin for a bunch of SUN 3 and
4 and SGIs and Convexen by then - so I'm not just guessing). Do you mean
that (a lot of bugs, holes and exploits) or is there a basic design
characteristic of NT that makes it insecure (apart, of course, from the
bloat!)

-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 13 Oct 2000 17:18:18 -0400

> characteristic of NT that makes it insecure (apart, of course, from the

I probably should have said empirically.  I don't share your optimism
about NT, even relative to Unix of 25 years ago.  I do mean both bugs,
holes, exploits, and [but this is my bias] the fact that it is grown
from a system whose internal "structure" [chaos] I have seen, and been
repulsed by.  The code grows 30% or so each release, and it seems that
nothing is taken out.  There is nobody in the world who knows exactly
what goes on in MSW-NT, and I suspect that has been true for every
version of MSW-NT since the beginning.  [At least I was able to read
all of 6th Edition Unix's source code and understand it pretty well.]

OK, so I sound biased.  But most computer security people will tell you
that "hardened MSW-NT" is almost an oxymoron.