[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Create a canned "Firewall Build"
- To: misc_(_at_)_openbsd_(_dot_)_org
- Subject: Re: Create a canned "Firewall Build"
- From: Steve Lincoln <slinco01_(_at_)_studentweb_(_dot_)_providence_(_dot_)_edu>
- Date: Thu, 21 Feb 2002 09:18:38 -0500
- Organization: Home
- Reply-to: slinco01_(_at_)_studentweb_(_dot_)_providence_(_dot_)_edu
I think it depends on the environment one find oneself in. My first dive
into a unix based firewall was e-smith (http://www.e-smith.org). E-smith was
basically a stripped down version of redhat, providing a variety of services
to a small lan. These services include a time server, smb (each user can
get his or her own "ibay" which is also published on the web). The server
was preconfigured to do dhcp, ipchains etc. etc.
Is this an ideal firewall? Nah. And I've since then (this was about 4 years
ago) moved on to bigger abd better things (firewall w/ openbsd + 3 nics for
dmz with my servers in it (although of course the smb server is internal).
The e-smith firewall was online for 2 years without getting broken into or
anything of the sort.
On Thursday 21 February 2002 08:55, Peter wrote:
> That's a good one. A firewall shouldn't have any user accounts (besides
> your own)
> and on a firewall you shouldn't run anything besides nat and pf.
> Otherwise it wouldn't
> be a firwall anymore.
> I'm kind of afraid to hear next that somebody is running smbd/nmbd on
> his firewall :-)))
> > >> Each user's files by default can be read by another user. Change
> > >> umask.
> > >
> > > irrelevant to system security. so what if joe can read john's
> > > that's no closer to root. the only umask that matters is root. and
> > > you're messing around as root, you should triple check everything
> you do
> > > anyway.
> > if this is supposed to be a distribution of OpenBSD for firewalls, why
> > would it have a bunch of users on the system whom you have to play
> > to?
> > --Matt