Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 18 Apr 2008 13:18:44 -0400
From:      Jon Radel <jon@radel.com>
To:        Paul Schmehl <pauls@utdallas.edu>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: [SSHd] Limiting access from authorized IP's
Message-ID:  <4808D7F4.8000709@radel.com>
In-Reply-To: <1EBA9459C137D287EEE2560D@utd65257.utdallas.edu>
References:  <2tng04doovnmtkr7or9kfkb596fgjfoj1c@4ax.com>	<20080418191449.212f43d3.gary@pattersonsoftware.com> <1EBA9459C137D287EEE2560D@utd65257.utdallas.edu>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Paul Schmehl wrote:

> I see this statement all the time, and I wonder why.  What does a
> firewall on an individual host accomplish?
> 
> I have maintained publicly available servers for a small hobby domain
> for almost ten years now.  Initially, I bought in to this logic and ran
> a firewall. (At that time we only had one server.)  What it cost me was
> CPU and memory. What it gained me was nothing.  I turned it off.  I have
> never run a firewall on a publicly available host since.
> 
> Firewalls are for preventing access to running services.  By definition,
> if you are running a service, you want it to be accessed.  So firewalls
> are self-defeating or completely useless at the host level **unless**
> you don't know what you're doing.  For an enterprise they make a great
> deal of sense.  No matter what a user inside your network might do, you
> can prevent access by simply not allowing traffic on that port.

Yes, in a world where nothing ever breaks, all system administrators
never make dumb mistakes, and no one ever breaks into your box to
install services that you certainly wouldn't approve of, the
defense-in-depth techniques being discussed here are pretty much a waste
of time.  Alas, alack, my machines prove every couple of years that they
don't live in such a world.  Must be me.  ;-)

> If *everyone* knew how to properly configure and maintain a host, even
> enterprise firewalls would be completely unnecessary.

And if you've got users on your network....  Oh, my, users do the
darnedest things.  As one little example:  My firewall blocks outbound
traffic to port 25 from all those pesky workstations to anywhere other
than the local SMTP servers.  Why?  Makes me worry just a bit less about
some Windows box pumping spam out to the world due to an unfortunate
choice made by a user.  I doubt there's an enterprise in the world where
every user both knows enough about host security *and* is disciplined
enough to apply that knowledge every minute of every day.

But then, I'm the guy who takes the time to put on his seatbelt each and
every time he starts the car, despite never, not once, having to
actually use it in 3 decades of driving.

> Firewalls are too often crutches for people that don't want to learn
> how to properly maintain a host.

Now that, on the other hand, I can completely agree with.

--Jon Radel

[-- Attachment #2 --]
0	*H
010	+0	*H
	100\mtv0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10URadel10U*
Jon Thomas10UJon Thomas Radel10	*H
	
jon@radel.com0"0
	*H
0
t,Pp#
٬q_2=L-^m>z3ʟV![([ AoE}ϛ3/6?񥃮cWx(/)'$6sTl<*i'=uoxMbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P;	*Wg/jN*OVՠQMB(=:
*0(0U0
jon@radel.com0U00
	*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)00\mtv0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10URadel10U*
Jon Thomas10UJon Thomas Radel10	*H
	
jon@radel.com0"0
	*H
0
t,Pp#
٬q_2=L-^m>z3ʟV![([ AoE}ϛ3/6?񥃮cWx(/)'$6sTl<*i'=uoxMbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P;	*Wg/jN*OVՠQMB(=:
*0(0U0
jon@radel.com0U00
	*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)0?0
0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
030717000000Z
130716235959Z0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
	*H
0Ħ<UsUNʙZhup[v:aQP
0cZ,p+Z?qV˯<6$*+w=+>@dקe*TH<a@dr`00U00CU<0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0U0)U"0 010UPrivateLabel2-1380
	*H
HP.
fgCL!6-6/P p<ab:~t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$F]_eO1d0`0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0	+0	*H
	1	*H
0	*H
	1
080418171844Z0#	*H
	1sV"Pn6܂e0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0	+71x0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0*H
	1xv0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0
	*H
BKr-mHK*0!_Ї^y;q#s
L4P(iN\QE,k$ЁIr%9}CΙG7*	hꑅ-Pk1Ul\Q۴ý{ϸVaE05xϱHIfsEQωEft/Y7z|_jdoXwm^8πu@>7fIl>|1#Œq49Rbj
\Į

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4808D7F4.8000709>