Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] firewall script, again...

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: SM Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] firewall script, again...
  • Date: Mon, 24 Jan 2005 16:25:43 -0800 (PST)

On Tue, 11 Jan 2005, Thomas HOUSSIN wrote:
On Mon, 10 Jan 2005 16:21:18 -0800, Seth Alan Woolley
<seth AT positivism.org> wrote:
On Tue, Jan 11, 2005 at 12:21:17AM +0100, Thomas HOUSSIN wrote:
Hi all,

Here is a new version of the firewall spell I sent here a few weeks ago.
Includes :
- firewall_perso, the script itself, to be copied in /usr/sbin/firewall_perso
- firewall_flush, to flush all rules
- firewall_perso.conf, the config file. It needs to be copied in /etc,
and edited with your settings.
- firewall, a script for init.d. It just run the firewall_perso script.
- update-ip, a script to update your config file with your new IP and
rerun the firewall. If you use pppd to connect, just copying this file
to /etc/ppp/ip-up should update your IP and launch the firewall each
time you reconnect. It can also be run in init script, if your IP can
change.

For now, no NAT, but I'll work on that. I tried to include in the
config file all that I could need. If it could be integrated into
devel, that would allow me to have some bugs reports and new features
requests. (if this is possible, I can write the spell)

About PROVIDES, it would be useful to have a PROVIDES=firewall
(running several iptables-based firewalls isn't a good idea)

Last thing : IMHO SM should propose to install a firewall, for example
as an optional dependency of basesystem. I think this is getting more
and more useful nowadays...

No services are installed by default. None. We don't even provide a
mail client by default. Mutt and OpenSSH are optional default
installed, though. For what it's worth, I don't think we should be
providing a default firewall for the reason that it would be "extra" and
not needed in a machine with the default install. We have plenty of
firewalls, like shorewall and agt in the grimoire.

OK basesystem was a bad example and a bad idea; I didn't mean to
install it by default, but to ask the user when he installs the
network (for example when he casts netconf). About plenty of
firewalls, I disagree : we have plenty of tools to configure
firewalls, but no almost-ready-to-use firewall. (we do have a
sm-firewall script, but he's IMHO rather unsuable and unsecure)

A script that installs only if netconf/network is setup on the ISO
would be great, especially if it blocks everything in, but lets
everything out and defaults to start on bootup.

Personally, I prefer
shorewall. If you want your default firewall provided by default, it
would have to be really simple and have CONFLICTS setup between all the
iptables-based firewalls. PROVIDES would help, but PROVIDES doesn't
automatically imply CONFLICTS. And PROVIDES=IPTABLES-FIREWALL would be
what would do.

Not necessarly mine, but one script...
Is this really a CONFLICTS between iptables-based firewall ? They
should not be run all at the same time, but you can use several tools
to write differents security profiles (if they dont alter the same
files)

For this script you probably wouldn't even need iptables, but could
instead modify files in /proc, though I'd prefer using iptables (which
only takes about 200k, compressed cache and all on the ISO).

I think sorcery could have a nice feature to support providers in
CONFLICTS, that way you don't have to edit all the conflicts for each
and every time you setup a provider. At the same time an "other"
semantic would be good "any_other IPTABLES-FIREWALL" would setup
conflicts between itself and any other iptables-based firewall that's
not itself. Possible feature request?

Even OpenBSD, while it ships a firewall, doesn't have it enabled by
default. There's a reason for that. Firewalls should be configured by
competent administrators or we'll all field requests on how to poke
holes in the firewall once we hit critical mass.

I agree, and a badly configured firewall can be worse than no
firewall. But if we do not ship any fw, users will have either no
firewall, or a badly written one (that doesn't mean mine is perfect).

If we say that we have enabled a firewall that allows X and Y only,
then the user can change that by installing a "proper" firewall (as
this script [a.k.a. the script used on the ISO], IMO, should be
tailored for the ISO) such as shorewall, which should then
disable/remove the ISO script.

Moreover, firewalls
can be a security liability because of the fact that they can inspect
states that can be in a turing-complete machine and are thus liable to
the halting problem (a strong indicator of how unprovable a system is).
Vulnerabilities are thus commonly found in protocol and stateful
inspectors. See the many libpcap and tcpdump vulnerabilities for
extreme examples of this (since their inspections are designed to be
somewhat full).

But on a computer with server, the security risk is higher without
firewall than with one... If you set up a web server and a ftp server
and your SM, and if you have a permanent connection, you'll see lots
of attacks (sometimes several buffer-overflow attacks per day on my
apache I setup for testing purpose)

I'm a little short on time now to answer about the turing-complete
machine, but i'll do it :)

I believe the ISO firewall (at least) would be there so that, while
you're installing and booting into your machine for the first time,
you're not as vulnerable to attacks if you enabled the network.


The security community is often ignorant of the role of parsimony in
designing secure systems. I don't think we should add complexity to fit
in with the corporate community which has gotten behind buzzword after
buzzword -- even Conan O'Brien made an unscripted joke about firewalls
in his CES emcee role to fill in time during a badly failing Consumer
Electronics Show demonstration of Windows Media Center.

Seth

P.S. If I have time, I'll check this out -- what's your nick in IRC?


Not always the same, but often Thomas ot Tommy
See you later then...

-sandalle

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/




Archive powered by MHonArc 2.6.24.

Top of Page