Michael Rash, the author behind "Linux Firewalls" chimes in about his background, his distro of choice, the current state of Linux security and much, much more. He covers many issues and provides a lot of insight into security and Linux: Question: What is the most interesting fact you've become aware of while researching for this book? Intrusion detection systems and firewalls commonly offer the ability to tear down TCP connections by forging a RST packets, but the specifics of how this is done varies quite a bit across different IDS and firewall implementations. The most interesting fact I stumbled across during my research concerns differences in the handling of the ACK control bit on RST packets. For example, . The link for this article located at Net-Security.org is no longer available. . The link for this article located at Net-Security.org is no longer available.. michael, author, behind, 'linux, firewalls', chimes, about, background, distro. . Brittany Day
We recently had a situation in which one of our servers was accessed by someone from another building/floor who had no need to get into the system. Part of the problem was that someone left their username/password out in plain sight; that problem has been fixed. . . .. "We recently had a situation in which one of our servers was accessed by someone from another building/floor who had no need to get into the system. Part of the problem was that someone left their username/password out in plain sight; that problem has been fixed. Management is concerned that our more sensitive servers may not be as protected as they should be. We already have one firewall protecting our Internet connection. Should we look at an additional firewall to protect the servers that management is concerned about?" A little more protection is always a good thing. There are two ways you can approach this. Depending on what type of a core switch/router you are using, you can restrict access to certain systems by using Access Control Lists (ACL) in the switch/router. While this is doable, you also should think about limiting the port numbers that the designated systems can be reached with. This, too, can be done with ACLs. Something to think about is keeping this information backed up in a safe place, as if you have to replace the system, you'll need to replace that information to keep the same level of protection. Another option is an interior firewall. Using more than one firewall is becoming commonplace on networks today as controlling access to designated systems is becoming more important. While Linux-/Unix-based systems come equipped with their own firewall functionality built in, why maintain a firewall setup on each system when you can centralize the management? One argument I frequently hear is whether to use the same brand of firewall for your second interior router or a different brand. There is some validity to this question. Look at it from this perspective: Would you rather have to learn two different interfaces to manage twofirewalls or use just interface to manage two firewalls? One reason for using different brands of firewalls is that if one gets compromised, the hacker/intruder has to pretty much start all over again to try and get past the second. Look at the vulnerabilities reported by the vendor and the security community on the firewall you're currently using. Compare this against the other firewalls you consider. See which has had the most problems and how quickly they were resolved. The link for this article located at Ron Nutter is no longer available. . Protecting data centers demands methodical positioning of firewalls and stringent access regulations to bolster overall network safety.. Firewall Protection, Server Security, Access Control, Network Security. . Anthony Pell
This article is a good discussion about what a firewall can be expected to do, and what it can't. "In most organizations, firewalls are now a commodity: everyone has at least one. In the future, access controls will need to become . . . . This article is a good discussion about what a firewall can be expected to do, and what it can't. "In most organizations, firewalls are now a commodity: everyone has at least one. In the future, access controls will need to become more granular, all the way down to the data level. .. Historically, many technologists took the view that a firewall was security-a terrible misconception, but widely perceived as true. The idea was supported by another misconception: that if you protected your perimeter network with a firewall, you were inherently protecting the data on your internal network. Accordingly, the only business requirement was to protect the network. Systems administrators set up accounts on individual systems, of course, but most technology managers contented themselves with the thought that the perimeter network provided all the protection they needed. " . Firewalls are essential but not a standalone security solution. Organizations must combine them with layered defenses and access controls to truly safeguard against evolving threats. Access Control, Firewall Strategies, Network Security. . Anthony Pell
Here's a quick 12 tips that describes a firewall, and how to build one. 1.A firewall implements your security policy. A firewall enforces some security policy. If you didn't have a security policy before you put the firewall in place, you . . . . Here's a quick 12 tips that describes a firewall, and how to build one. 1.A firewall implements your security policy. A firewall enforces some security policy. If you didn't have a security policy before you put the firewall in place, you do now. It may be unwritten, but it's still a security policy. If you haven't made explicit decisions about what you want the security policy to be, it's probably not the best policy for your site, and it will certainly be difficult for you to maintain it over time. In order to have a good firewall, you need a good security policy--one that is written down and widely agreed to. 2.A firewall is not usually a single device. Except in the most simple of cases, a firewall is seldom a single device; it is usually a collection of devices acting in concert. Even if you buy a commercial "all-in-one" firewall appliance, you'll still have to configure other machines (your public web server, for example) to work along with it. And these other machines should really be regarded as part of the firewall. This has all sorts of implications for how you configure and manage these machines, what they trust, what trusts them, and so on. You cannot simply choose one box, call it "the firewall," and expect it to assume all responsibility for security. . Evaluate your organization's security needs to tailor your firewall solutions, ensuring a cohesive, multi-layered defense to mitigate threats effectively. Firewall Construction, Network Security Strategies, Security Policy Implementation, Firewall Management. . Anthony Pell
Get the latest Linux and open source security news straight to your inbox.