Re: secure installation
"R. W. Rodolico" <rod@dailydata.net> writes:
> Firewalls are for a stupidity shield. I had a situation where I was
> cracked on one of my servers a few years ago. It was totally my fault; I
> had a user I had mistakingly set up as an authorized ssh user who
> shouldn't have been. Their account was cracked, then the cracker got
> root access and installed a daemon that was ready to attack another
> server.
> My firewall gave one yelp, the cracker realized what was going on and
> told the firewall to shut up, basically. However, I got that one yelp
> from the firewall, investigated, and fixed the issue.
> A firewall is not, by any stretch of the imagination, the security for a
> server. Security for a server is, as you say, not running services that
> are not necessary. However, a firewall is for people like me, who make
> mistakes and, in so doing, create a security problem.
I definitely agree that firewalls are good for defense in depth. Where
I'm disagreeing is primarily over the idea that the average user is going
to find this helpful. Most users are not going to be sufficiently
paranoid to pay attention to that single yelp from the firewall, for
instance, and if you do crank up notification to the point where they see
such things, they end up complaining about legitimate traffic because they
don't understand what any of it means.
Firewalls are good in the situation where, whenever you open up new
network access, you want to have to make that choice independently in
multiple locations. I'm dubious that this matches the desires of the
average user or that forcing them to do this will really result in more
security as opposed to further training to just always click Okay. It's
great for administrators who want paranoid control over such things.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: