Date: Mon, 26 Feb 1996 15:22:08 +0100 From: Poul-Henning Kamp <phk@critter.tfs.com> To: michael butler <imb@scgt.oz.au> Cc: stable@freebsd.org, current@freebsd.org Subject: Re: -stable hangs at boot (fwd) Message-ID: <11519.825344528@critter.tfs.com> In-Reply-To: Your message of "Tue, 27 Feb 1996 01:05:48 %2B1100." <199602261405.BAA09438@asstdc.scgt.oz.au>
next in thread | previous in thread | raw e-mail | index | archive | help
> Poul-Henning Kamp writes: > > > Well, this happens to be your view. I know machines where IPFW are being > > used to restrict what users on the machine can do, this is only possible > > if you filter >ALL< traffic, to and from the machine. > > OK .. but, personally, I wouldn't call or attempt to use those boxes as > firewalls .. any "sensitive" firewall/filtering router I have control over > has two valid accounts which have any access at all, mine and one other, > with limited privilege, for daily monitoring. No users == much reduced risk. I agree, I'd do that too. However, that is all a question of what your policy is. The IPFW, should not affect your policy, but merely be able to implement it. > If security is _that_ important, investing in a dedicated box to do the job > is cheap at triple the price :-) depends, sometimes other things are of some importance too :-) > > The IPFW is not a policy, it's a tool to implement policies. As such it > > needs to be able to implement the widest possible range of policies. > > I can see where you're coming from .. but this behaviour caught me out > because it is unusual and I'm sure it'll catch many others :-(. I'm sure about that too, that is really too bad :-( However, the reason why I'm in this business right now was that a (by now documented) criminal person gained access through a FreeBSD firewall, even though the filters claimed that it wasn't possible. This was not something I could have sitting on my shoulders as a security supplier. I decided to fix it once and for all, so that the policy would be entirely in the hands of the sysadmin, rather than some of it being done in a very obscure piece of code. Security will always require people to know what they do, unfortunately. > > You should be on -committers if you run -stable or -current. If you were, > > you would have seen it. > > If I could get half-way through the stuff I'm obliged to read now .. <sigh> Talk to me about it... Ohh, and don't forget to read >all< of Terrys emails :-) Now, how about you check out the ipfw.8 from -current and send me your comments, and possibly a couple of good commented rule-sets for the doc, then I'll make sure the kernel-code does what we want it to and what we think ? -- Poul-Henning Kamp | phk@FreeBSD.ORG FreeBSD Core-team. http://www.freebsd.org/~phk | phk@login.dknet.dk Private mailbox. whois: [PHK] | phk@ref.tfs.com TRW Financial Systems, Inc. Future will arrive by its own means, progress not so.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?11519.825344528>