sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
- From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
- To: sm-discuss <sm-discuss AT lists.ibiblio.org>
- Subject: Re: [SM-Discuss] firewall script, again...
- Date: Tue, 11 Jan 2005 08:14:17 +0100
On Mon, 10 Jan 2005 16:21:18 -0800, Seth Alan Woolley
<seth AT positivism.org> wrote:
> On Tue, Jan 11, 2005 at 12:21:17AM +0100, Thomas HOUSSIN wrote:
> > Hi all,
> >
> > Here is a new version of the firewall spell I sent here a few weeks ago.
> > Includes :
> > - firewall_perso, the script itself, to be copied in
> > /usr/sbin/firewall_perso
> > - firewall_flush, to flush all rules
> > - firewall_perso.conf, the config file. It needs to be copied in /etc,
> > and edited with your settings.
> > - firewall, a script for init.d. It just run the firewall_perso script.
> > - update-ip, a script to update your config file with your new IP and
> > rerun the firewall. If you use pppd to connect, just copying this file
> > to /etc/ppp/ip-up should update your IP and launch the firewall each
> > time you reconnect. It can also be run in init script, if your IP can
> > change.
> >
> > For now, no NAT, but I'll work on that. I tried to include in the
> > config file all that I could need. If it could be integrated into
> > devel, that would allow me to have some bugs reports and new features
> > requests. (if this is possible, I can write the spell)
> >
> > About PROVIDES, it would be useful to have a PROVIDES=firewall
> > (running several iptables-based firewalls isn't a good idea)
> >
> > Last thing : IMHO SM should propose to install a firewall, for example
> > as an optional dependency of basesystem. I think this is getting more
> > and more useful nowadays...
>
> No services are installed by default. None. We don't even provide a
> mail client by default. Mutt and OpenSSH are optional default
> installed, though. For what it's worth, I don't think we should be
> providing a default firewall for the reason that it would be "extra" and
> not needed in a machine with the default install. We have plenty of
> firewalls, like shorewall and agt in the grimoire.
OK basesystem was a bad example and a bad idea; I didn't mean to
install it by default, but to ask the user when he installs the
network (for example when he casts netconf). About plenty of
firewalls, I disagree : we have plenty of tools to configure
firewalls, but no almost-ready-to-use firewall. (we do have a
sm-firewall script, but he's IMHO rather unsuable and unsecure)
> Personally, I prefer
> shorewall. If you want your default firewall provided by default, it
> would have to be really simple and have CONFLICTS setup between all the
> iptables-based firewalls. PROVIDES would help, but PROVIDES doesn't
> automatically imply CONFLICTS. And PROVIDES=IPTABLES-FIREWALL would be
> what would do.
>
Not necessarly mine, but one script...
Is this really a CONFLICTS between iptables-based firewall ? They
should not be run all at the same time, but you can use several tools
to write differents security profiles (if they dont alter the same
files)
> I think sorcery could have a nice feature to support providers in
> CONFLICTS, that way you don't have to edit all the conflicts for each
> and every time you setup a provider. At the same time an "other"
> semantic would be good "any_other IPTABLES-FIREWALL" would setup
> conflicts between itself and any other iptables-based firewall that's
> not itself. Possible feature request?
>
> Even OpenBSD, while it ships a firewall, doesn't have it enabled by
> default. There's a reason for that. Firewalls should be configured by
> competent administrators or we'll all field requests on how to poke
> holes in the firewall once we hit critical mass.
I agree, and a badly configured firewall can be worse than no
firewall. But if we do not ship any fw, users will have either no
firewall, or a badly written one (that doesn't mean mine is perfect).
> Moreover, firewalls
> can be a security liability because of the fact that they can inspect
> states that can be in a turing-complete machine and are thus liable to
> the halting problem (a strong indicator of how unprovable a system is).
> Vulnerabilities are thus commonly found in protocol and stateful
> inspectors. See the many libpcap and tcpdump vulnerabilities for
> extreme examples of this (since their inspections are designed to be
> somewhat full).
But on a computer with server, the security risk is higher without
firewall than with one... If you set up a web server and a ftp server
and your SM, and if you have a permanent connection, you'll see lots
of attacks (sometimes several buffer-overflow attacks per day on my
apache I setup for testing purpose)
I'm a little short on time now to answer about the turing-complete
machine, but i'll do it :)
>
> The security community is often ignorant of the role of parsimony in
> designing secure systems. I don't think we should add complexity to fit
> in with the corporate community which has gotten behind buzzword after
> buzzword -- even Conan O'Brien made an unscripted joke about firewalls
> in his CES emcee role to fill in time during a badly failing Consumer
> Electronics Show demonstration of Windows Media Center.
>
> Seth
>
> P.S. If I have time, I'll check this out -- what's your nick in IRC?
>
Not always the same, but often Thomas ot Tommy
See you later then...
--
"[...] Tantôt sonnera l'heure où le divin Hasard,
Où l'auguste Vertu, ton épouse encor vierge,
Où le Repentir même (oh ! La dernière auberge !),
Où tout te dira : Meurs, vieux lâche ! Il est trop tard ! "
de Charles Baudelaire, "L'Horloge"
-
[SM-Discuss] firewall script, again...,
Thomas HOUSSIN, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Andrew, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Seth Alan Woolley, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Andrew, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Seth Alan Woolley, 01/10/2005
- Re: [SM-Discuss] firewall script, again..., Andrew, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Seth Alan Woolley, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Andrew, 01/10/2005
- Re: [SM-Discuss] firewall script, again..., Thomas HOUSSIN, 01/11/2005
-
Re: [SM-Discuss] firewall script, again...,
Seth Alan Woolley, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Seth Alan Woolley, 01/10/2005
- Re: [SM-Discuss] firewall script, again..., Andrew, 01/10/2005
-
Re: [SM-Discuss] firewall script, again...,
Thomas HOUSSIN, 01/11/2005
- Re: [SM-Discuss] firewall script, again..., Eric Sandall, 01/24/2005
-
Re: [SM-Discuss] firewall script, again...,
Andrew, 01/10/2005
Archive powered by MHonArc 2.6.24.