From owner-freebsd-pf@FreeBSD.ORG  Fri Dec  9 13:25:25 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2BA0216A437
	for <freebsd-pf@freebsd.org>; Fri,  9 Dec 2005 13:25:25 +0000 (GMT)
	(envelope-from gobbledegeek@gmail.com)
Received: from zproxy.gmail.com (zproxy.gmail.com [64.233.162.198])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3FB8043D5C
	for <freebsd-pf@freebsd.org>; Fri,  9 Dec 2005 13:25:05 +0000 (GMT)
	(envelope-from gobbledegeek@gmail.com)
Received: by zproxy.gmail.com with SMTP id i11so836278nzh
	for <freebsd-pf@freebsd.org>; Fri, 09 Dec 2005 05:24:50 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:user-agent:x-accept-language:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=qWanq27Tt+5xUTJQ1JqLvPMbe8J57PgzXbNYslJIfCOrFSHstq/DBHmhhzW4ah9CPkLQhM8+S+KXzEgTV6apejcKvEHiAYLvZDayAG4uIZPlCxQuXVXcSL0HDHVpqNkPbzvMM3jC91jroEZdF0TZyLg8hvELdpLzuyJNif71JhI=
Received: by 10.36.77.3 with SMTP id z3mr3475360nza;
	Fri, 09 Dec 2005 05:24:49 -0800 (PST)
Received: from ?61.2.58.87? ( [61.2.58.87])
	by mx.gmail.com with ESMTP id 24sm1916121nzn.2005.12.09.05.24.47;
	Fri, 09 Dec 2005 05:24:49 -0800 (PST)
Message-ID: <4399859D.1030200@gmail.com>
Date: Fri, 09 Dec 2005 18:54:45 +0530
From: GobbleDeGeek <gobbledegeek@gmail.com>
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-pf@freebsd.org
References: <20051209120100.AE93816A427@hub.freebsd.org>
In-Reply-To: <20051209120100.AE93816A427@hub.freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: freebsd-pf Digest, Vol 64, Issue 5
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Dec 2005 13:25:25 -0000

I agree. One way out is to setup each machine with a default tight local 
policy that only allows access to the local "remote file system" (sic!)
then read in the more liberal site-wide policy to replace the existing 
one... this will mean an nfs mount or a one-way rsync ... and a simple 
per machine ruleset blocking everything
but the firewall policy servers nfs or rsync... any other ideas ??

Rgrds
> 
> I would admit to this, but I am the only person usign these boxes.
> 
> One is my machine in the office the other one is at home.
> 
> Concerning the manageability I would say, yes, you are right. One
> should invent a solution like the manageability of WinXP SP2 with
> the help of the ActiveDirectory in a windows server domain.
> 
> One ruleset for all boxes.
> 
> But, often you read that attacks against servers will be done from
> the inside network. 
> 
> 
> 
> Marcus
>