Date: Thu, 11 Jan 2007 13:50:48 -0800 From: Garrett Cooper <youshi10@u.washington.edu> To: freebsd-questions@freebsd.org Subject: Re: Firewalls and RPC (was "Re: Improvement to IPFilter / nfsd in FBSD (6.2+?)") Message-ID: <45A6B138.7000409@u.washington.edu> In-Reply-To: <1BB74CBD-0BEA-43C7-8635-01AFB790A5AA@mac.com> References: <45A688C0.2020506@u.washington.edu> <B0288AAB-3220-43C5-AA0D-974F620D103B@mac.com> <45A6A3EF.5030101@u.washington.edu> <1BB74CBD-0BEA-43C7-8635-01AFB790A5AA@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Chuck Swiger wrote: > > Actually, no. While rpcbind/portmap/portmapper is assigned to 111/tcp & > udp, most other RPC services get assigned high port numbers in the 327xx > range, but that varies considerably from platform to platform. True. NFS is port 2049 by default, anyhow.. > Somewhat, yes. Samba/CIFS filesharing can require less trust between > server and client as accessing a Samba share does not require superuser > permissions, just limited user access, but Samba does require root > access to start up and bind to the low ports it uses, and it also > involves the "network browse master" (which nmbd can do) and so forth > which involve subnet-oriented broadcast traffic. > > Samba/CIFS is a chatty protocol. No kidding. The funny thing is that smbclient (Xbox Media Center runs smbclient) I've learned requires more open ports than regular CIFS enabled Windows XP hosts to RPC services, which has caused more issues than it's worth in the past. > No, not really. What you probably want to focus on is protecting your > entire subnet, including the fileserver and clients, from malicious > traffic via your Internet link(s), and then worry about egress > filtering, dividing your machines into a trusted internal LAN and a > semi-trusted DMZ, and so forth. > > A firewall system should not be running any kind of filesharing; while > you can run PF, IPFW, etc on your fileserver, that ought to be a > secondary line of protection for "defense in depth", and your Internet > connection ought to have a dual-homed or multihomed firewall machine > which is dedicated to that role and which runs zero services. Right. However, I don't trust the rest of the clients on my subnet other than the ones I maintain, so that's why I have setup the firewall rules I have. Sorry for not more clearly defining the situation earlier, but here's the reasoning / rationale for what I'm doing.. <IT nightmare> - -I live in a house with a shared LAN with a total of around 50 hosts connected / disconnected at various times of the day. - -I don't trust any of the Windows clients devoid a small handful because I have had a variety of connectivity problems caused by improperly managed personal machines, virii, and spyware on machines here. - -There isn't a real means of properly controlling IP distribution and people are free to change their IP addresses to whatever they choose (host information is set statically, not dynamically). - -I have 5 machines which have access to the network--2 serving machines and 3 clients which aren't always attached to the network. I have set the IP addresses up so they all lie in a range, but I don't trust whether someone will IP squat my address and do whatever they want to my serving machines (whether they mean to or it happens by accident). - -Some of the machines on the network have access to the machine serving via Samba, but that's a limited number. </IT nightmare> - -Garrett -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.1 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFprE4EnKyINQw/HARAjwyAKCY9F8O2rkdet2/gxNNqCQXij0xgwCfSF3/ tswDC5ovt0A5r3Tg7s7BSqE= =iVhr -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45A6B138.7000409>