Re: Secure Linux From Scratch

* Robert Day <[email protected]> [03-1226 12:03]:
> Why go with three layers, when 10 can be had?  A Port-Forwarding
> Hardware Firewall / router box that only forwards opened ports to the
> servers behind the network, hard-coded eeproms with port > ip maps so
> that it cannot be penetrated, and no external configurations, etc. The
> Linux box with it's own firewall limiting incoming connections to the
> open ports only, and outgoing connections to the NAT server, with
> authenticated services running chrooted on a triple-hardened software
> base, with honeypots setup to re-route unexpected incoming traffic, and
> double encrypted data on an encrypted partition of a locked server
> cabinet etc. etc. 
> 
> Basically, the point is, Somewhere, you have to say Enough. I think
> there will be a wave of agreement when I say we have to find a soft
> balance between security and useability.

I mostly agree, but I think we should go beyond finding the
balance. We should examine and propose many different alternatives,
and educate the reader so that he can choose the best for his
particular case.

Like I said in a previous post, we should discuss different
configurations and different situations. I'd love to have 10 computers
around but I have only one. Some people have an older machine that can
play the role of firewall, but that's all. There are many different
scenarios, and we should discuss the options available in each one.

Given a certain number of computers in the network, we can still
discuss the pros/cons of different ways of doing things. For example,
in the case of having a two computer (ws/fw) setup, one can make the
case of running untrusted apps (xmule for instance) on the firewall or
on the ws. We should list the advantages and disadvantages of each
solution.

-- 
Miguel Bazdresch
http://thewizardstower.org/
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page