Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] firewall script, again...

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • Cc: sm-discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] firewall script, again...
  • Date: Mon, 10 Jan 2005 16:21:18 -0800

On Tue, Jan 11, 2005 at 12:21:17AM +0100, Thomas HOUSSIN wrote:
> Hi all,
>
> Here is a new version of the firewall spell I sent here a few weeks ago.
> Includes :
> - firewall_perso, the script itself, to be copied in
> /usr/sbin/firewall_perso
> - firewall_flush, to flush all rules
> - firewall_perso.conf, the config file. It needs to be copied in /etc,
> and edited with your settings.
> - firewall, a script for init.d. It just run the firewall_perso script.
> - update-ip, a script to update your config file with your new IP and
> rerun the firewall. If you use pppd to connect, just copying this file
> to /etc/ppp/ip-up should update your IP and launch the firewall each
> time you reconnect. It can also be run in init script, if your IP can
> change.
>
> For now, no NAT, but I'll work on that. I tried to include in the
> config file all that I could need. If it could be integrated into
> devel, that would allow me to have some bugs reports and new features
> requests. (if this is possible, I can write the spell)
>
> About PROVIDES, it would be useful to have a PROVIDES=firewall
> (running several iptables-based firewalls isn't a good idea)
>
> Last thing : IMHO SM should propose to install a firewall, for example
> as an optional dependency of basesystem. I think this is getting more
> and more useful nowadays...

No services are installed by default. None. We don't even provide a
mail client by default. Mutt and OpenSSH are optional default
installed, though. For what it's worth, I don't think we should be
providing a default firewall for the reason that it would be "extra" and
not needed in a machine with the default install. We have plenty of
firewalls, like shorewall and agt in the grimoire. Personally, I prefer
shorewall. If you want your default firewall provided by default, it
would have to be really simple and have CONFLICTS setup between all the
iptables-based firewalls. PROVIDES would help, but PROVIDES doesn't
automatically imply CONFLICTS. And PROVIDES=IPTABLES-FIREWALL would be
what would do.

I think sorcery could have a nice feature to support providers in
CONFLICTS, that way you don't have to edit all the conflicts for each
and every time you setup a provider. At the same time an "other"
semantic would be good "any_other IPTABLES-FIREWALL" would setup
conflicts between itself and any other iptables-based firewall that's
not itself. Possible feature request?

Even OpenBSD, while it ships a firewall, doesn't have it enabled by
default. There's a reason for that. Firewalls should be configured by
competent administrators or we'll all field requests on how to poke
holes in the firewall once we hit critical mass. Moreover, firewalls
can be a security liability because of the fact that they can inspect
states that can be in a turing-complete machine and are thus liable to
the halting problem (a strong indicator of how unprovable a system is).
Vulnerabilities are thus commonly found in protocol and stateful
inspectors. See the many libpcap and tcpdump vulnerabilities for
extreme examples of this (since their inspections are designed to be
somewhat full).

The security community is often ignorant of the role of parsimony in
designing secure systems. I don't think we should add complexity to fit
in with the corporate community which has gotten behind buzzword after
buzzword -- even Conan O'Brien made an unscripted joke about firewalls
in his CES emcee role to fill in time during a badly failing Consumer
Electronics Show demonstration of Windows Media Center.

Seth

P.S. If I have time, I'll check this out -- what's your nick in IRC?

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpunbm87fcTl.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page