Messages in this thread | | | Subject | Re: One for the Security Guru's | From | Tony Gale <> | Date | 24 Oct 2002 11:01:04 +0100 |
| |
On Thu, 2002-10-24 at 10:38, Henning P. Schmiedehausen wrote: > Gerhard Mack <gmack@innerfire.net> writes: > > >Actually at the place that just went bankrupt on me I had a Security > >consultant complain that 2 of my servers were outside the firewall. He > >recommended that I get a firewall just for those 2 servers but backed off > >when I pointed out that I would need to open all of the same ports that > >are open on the server anyways so the vulnerability isn't any less with > >the firewall. > > So you should've bought a more expensive firewall that offers protocol > based forwarding instead of being a simple packet filter. > > packet filter != firewall. That's the main lie behind most of the > "Linux based" firewalls. > > Get the real thing. Checkpoint. PIX. But that's a little > more expensive than "xxx firewall based on Linux". >
Thats not entirely accurate, or fair. A packet filter is a type of Firewall (or can be). A Firewall is a means to implement a security policy, usually specifically a network access policy. A Packet Filter, including a ""Linux based" firewall" is a perfectly acceptable means of achieving that goal, if it meets the policy requirements.
Ref. http://csrc.nist.gov/publications/nistpubs/800-10/ (over 7 years old, but still highly relevant).
Most commercial firewalls are very bad at protecting servers offering Internet services, they aren't designed to do it.
-tony
[unhandled content-type:application/pgp-signature] | |