Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] firewall script, again...

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • To: sm-discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] firewall script, again...
  • Date: Tue, 11 Jan 2005 08:14:17 +0100

On Mon, 10 Jan 2005 16:21:18 -0800, Seth Alan Woolley
<seth AT positivism.org> wrote:
> On Tue, Jan 11, 2005 at 12:21:17AM +0100, Thomas HOUSSIN wrote:
> > Hi all,
> >
> > Here is a new version of the firewall spell I sent here a few weeks ago.
> > Includes :
> > - firewall_perso, the script itself, to be copied in
> > /usr/sbin/firewall_perso
> > - firewall_flush, to flush all rules
> > - firewall_perso.conf, the config file. It needs to be copied in /etc,
> > and edited with your settings.
> > - firewall, a script for init.d. It just run the firewall_perso script.
> > - update-ip, a script to update your config file with your new IP and
> > rerun the firewall. If you use pppd to connect, just copying this file
> > to /etc/ppp/ip-up should update your IP and launch the firewall each
> > time you reconnect. It can also be run in init script, if your IP can
> > change.
> >
> > For now, no NAT, but I'll work on that. I tried to include in the
> > config file all that I could need. If it could be integrated into
> > devel, that would allow me to have some bugs reports and new features
> > requests. (if this is possible, I can write the spell)
> >
> > About PROVIDES, it would be useful to have a PROVIDES=firewall
> > (running several iptables-based firewalls isn't a good idea)
> >
> > Last thing : IMHO SM should propose to install a firewall, for example
> > as an optional dependency of basesystem. I think this is getting more
> > and more useful nowadays...
>
> No services are installed by default. None. We don't even provide a
> mail client by default. Mutt and OpenSSH are optional default
> installed, though. For what it's worth, I don't think we should be
> providing a default firewall for the reason that it would be "extra" and
> not needed in a machine with the default install. We have plenty of
> firewalls, like shorewall and agt in the grimoire.

OK basesystem was a bad example and a bad idea; I didn't mean to
install it by default, but to ask the user when he installs the
network (for example when he casts netconf). About plenty of
firewalls, I disagree : we have plenty of tools to configure
firewalls, but no almost-ready-to-use firewall. (we do have a
sm-firewall script, but he's IMHO rather unsuable and unsecure)

> Personally, I prefer
> shorewall. If you want your default firewall provided by default, it
> would have to be really simple and have CONFLICTS setup between all the
> iptables-based firewalls. PROVIDES would help, but PROVIDES doesn't
> automatically imply CONFLICTS. And PROVIDES=IPTABLES-FIREWALL would be
> what would do.
>
Not necessarly mine, but one script...
Is this really a CONFLICTS between iptables-based firewall ? They
should not be run all at the same time, but you can use several tools
to write differents security profiles (if they dont alter the same
files)

> I think sorcery could have a nice feature to support providers in
> CONFLICTS, that way you don't have to edit all the conflicts for each
> and every time you setup a provider. At the same time an "other"
> semantic would be good "any_other IPTABLES-FIREWALL" would setup
> conflicts between itself and any other iptables-based firewall that's
> not itself. Possible feature request?
>
> Even OpenBSD, while it ships a firewall, doesn't have it enabled by
> default. There's a reason for that. Firewalls should be configured by
> competent administrators or we'll all field requests on how to poke
> holes in the firewall once we hit critical mass.

I agree, and a badly configured firewall can be worse than no
firewall. But if we do not ship any fw, users will have either no
firewall, or a badly written one (that doesn't mean mine is perfect).

> Moreover, firewalls
> can be a security liability because of the fact that they can inspect
> states that can be in a turing-complete machine and are thus liable to
> the halting problem (a strong indicator of how unprovable a system is).
> Vulnerabilities are thus commonly found in protocol and stateful
> inspectors. See the many libpcap and tcpdump vulnerabilities for
> extreme examples of this (since their inspections are designed to be
> somewhat full).

But on a computer with server, the security risk is higher without
firewall than with one... If you set up a web server and a ftp server
and your SM, and if you have a permanent connection, you'll see lots
of attacks (sometimes several buffer-overflow attacks per day on my
apache I setup for testing purpose)

I'm a little short on time now to answer about the turing-complete
machine, but i'll do it :)

>
> The security community is often ignorant of the role of parsimony in
> designing secure systems. I don't think we should add complexity to fit
> in with the corporate community which has gotten behind buzzword after
> buzzword -- even Conan O'Brien made an unscripted joke about firewalls
> in his CES emcee role to fill in time during a badly failing Consumer
> Electronics Show demonstration of Windows Media Center.
>
> Seth
>
> P.S. If I have time, I'll check this out -- what's your nick in IRC?
>

Not always the same, but often Thomas ot Tommy
See you later then...

--
"[...] Tantôt sonnera l'heure où le divin Hasard,
Où l'auguste Vertu, ton épouse encor vierge,
Où le Repentir même (oh ! La dernière auberge !),
Où tout te dira : Meurs, vieux lâche ! Il est trop tard ! "

de Charles Baudelaire, "L'Horloge"




Archive powered by MHonArc 2.6.24.

Top of Page