Re: Securing a Linux Firewall

["Stephen P. Berry" <spb () meshuggeneh net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Carson Gaspar writes:

> This is the "known good" list of all binaries aproach I mention above. It 
> creates unmaintainable boxes, in my experience.

I know network administrators that feel the same way about firewalls and
filtering routers.

This suggests the obvious analogy:  Once upon a time, common practise was
to allow everything through your perimeter(s), then tack on a list of
Known Bad stuff to be blocked.  Turns out this is a lousy approach, for a
couple of reasons.  Here's a few:

        -The list of Bad Things gets long in a hurry
        -Call the size of your list n.  The set of all Bad Things running
         around in the wild is always at least n + 1
        -It ain't really what you want to do.  Nobody really wants to allow
         just any damn thing to happen on their networks.  Put another way, the
         list of Bad Things will always be a proper subset of things you
         don't want happening on your network---the other elements being
         things in your acceptable use policy, the contents of relevent RFCs,
         and all sorts of other things.  In order for a network to function
         things have to behave in fairly specific ways, and even an exhaustive
         list of exploits du jour doesn't cover all the ways a network
         can fail to do so

The above applies pretty much equally well to host security:  Your list
of Known Bad Things will grow rapidly; your list will always lag behind
evildoer developments;  and your list won't cover all the behaviours you
don't want happening.

If you build a minimal install of the OS, you're not really creating
a Known Good list of binaries, devices, libraries, or whathaveyou.  You're
creating a list of the things -necessary- for providing some particular
function.  In you define what is necessary and eliminate everything
else you are in fact defining a system with the minimum exposure (given
the OS, platform, and so forth).  That's the motivation---tagging
a minimal install as Known Good is an act of hopeful optimism that I
couldn't condone, but I routinely build miminal installs because I'm
interested in managing risk.

I'm also fond of tricks and traps, and having a minimal install as a base
makes deploying that sort of thing much easier.  If you know, say,
that ls(1) isn't being used by anything involved in the legitimate
operation of the system, its use is a simple and unambiguous indication
that something's amiss.


I won't tell you that it's -easy- to build a bare minimum install of an OS.
But it ain't -hard-, either.  And hopefully you're not swapping OSes
capriciously, so once you develop a pared down distribution, chances are
it's going to last you awhile.





- -spb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9QauWG3kIaxeRZl8RArX+AKDpC2QwYr1JUiyW2LaX5OBUY6JHjQCeIraQ
FZP6LnmWM5doMKADFQr1Fhs=
=vOcH
-----END PGP SIGNATURE-----
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards