Date: Fri, 29 Oct 1999 15:00:18 -0700 From: "Ronald F. Guilmette" <rfg@monkeys.com> To: nate@mt.sri.com (Nate Williams) Cc: freebsd-bugs@FreeBSD.ORG Subject: Re: Some fixes for some non-features of the /etc/rc.firewall script Message-ID: <779.941234418@segfault.monkeys.com> In-Reply-To: Your message of Fri, 29 Oct 1999 15:51:40 -0600. <199910292151.PAA06826@mt.sri.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <199910292151.PAA06826@mt.sri.com>, you wrote: >> The second patch below allows outsiders to connect to your AUTH port (113). >> I found that allowing this will cut down a lot on the number of pointless >> "Deny" log messages you will get if you don't have this, because a *lot* >> of things out in the real world (most notably Sendmail) _will_ try to >> connect to your local auth port whenever you connect out to them. > >Or you can simply ignore them completely w/out logging them, since AUTH >is a useless protocol, and you really shouldn't have a real AUTH daemon >running on your box in any case. I can't imagine how having one hurts anything. On a firewall, the only string it will ever return to the outside world... even if it *is* running... will be "root". >> The next patch allows ICMP packets and UDP packets to flow freely between >> other machines on the local net and the current (firewall) machine and vise >> versa. I don't see how allowing this could create a security threat, so >> it seems to me that it ought to be allowed. I was definitely annoyed when, >> after having first tried the "simple" firewall setup, I found that I could >> no longer even ping the firewall machine from other machines on my own local >> net. > >It depends on local policy whether or not the 'firewall' should be >protected from internal users. In many installations (not mine, mind >you) internal users are *also* suspect. Internal users are not "untrusted" here either. (I am the only user, in fact, and I trust me... mostly. :-) I imagine that this is the rule, rather than the exception, and that the exceptional case is sites where even the local users are not trusted. (Maybe rc.firewall really needs to have a "simple" configuration and then also an "industrial strength" configuration.) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?779.941234418>