lkml.org 
[lkml]   [2002]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: One for the Security Guru's
    From
    Date
    On Thu, 2002-10-24 at 10:38, Henning P. Schmiedehausen wrote:
    > Gerhard Mack <gmack@innerfire.net> writes:
    >
    > >Actually at the place that just went bankrupt on me I had a Security
    > >consultant complain that 2 of my servers were outside the firewall. He
    > >recommended that I get a firewall just for those 2 servers but backed off
    > >when I pointed out that I would need to open all of the same ports that
    > >are open on the server anyways so the vulnerability isn't any less with
    > >the firewall.
    >
    > So you should've bought a more expensive firewall that offers protocol
    > based forwarding instead of being a simple packet filter.
    >
    > packet filter != firewall. That's the main lie behind most of the
    > "Linux based" firewalls.
    >
    > Get the real thing. Checkpoint. PIX. But that's a little
    > more expensive than "xxx firewall based on Linux".
    >

    Thats not entirely accurate, or fair. A packet filter is a type of
    Firewall (or can be). A Firewall is a means to implement a security
    policy, usually specifically a network access policy. A Packet Filter,
    including a ""Linux based" firewall" is a perfectly acceptable means of
    achieving that goal, if it meets the policy requirements.

    Ref. http://csrc.nist.gov/publications/nistpubs/800-10/ (over 7 years
    old, but still highly relevant).

    Most commercial firewalls are very bad at protecting servers offering
    Internet services, they aren't designed to do it.

    -tony

    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2005-03-22 13:30    [W:0.020 / U:29.520 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site