Separate gateway functionality (Re: Suggestion for SME...)

On Mon, 8 Dec 2003, Klaus J. Mueller wrote:

> I think that the gateway functionality is just a minor part in the whole
> concept. (BTW: I think that for security reasons this is the component
> that should be the first one to be put on a different box in real world
> scenarios - which should be the case for most installations anyway
> (DSL-Routers...); it can be done very easily with another low end
> box running e.g. http://fli4l.de/ (ISDN, DSL))

If you analyse it carefully, having a separate gateway box does little to
protect the server from external attack. If, say, ssh, http and smtp are
forwarded from a firewall to an internal server, the internal server is
just as vulnerable to flaws in those protocols as it would have been if it
was also acting as the gateway.

Where a separate gateway has most security advantage is in safety from 
internal attacks, especially internal attacks being leveraged to 
reconfigure the firewall. For many small offices that's not a significant 
problem at a practical level, whereas provisioning, managing and 
understanding multiple servers might be. For concrete examples of this, 
search the boards some time and check the number of problems that people 
have encountered configuring their networks with external 
firewall/routers.

There's always a tradeoff between security and convenience. It's up to you 
to understand the options and make your own choice.

--
Charlie Brady                         [email protected]
Mitel Networks Corporation      http://www.mitel.com/
Phone: +1 (613) 592 5660 or 592 2122  Fax: +1 (613) 592 1175

A: Because we read from top to bottom, left to right.
Q: Why should i start my reply below the quoted text?


--
Please report bugs to [email protected]
Please mail [email protected] (only) to discuss security issues
Support for registered customers and partners to [email protected]
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Searchable archive at http://www.mail-archive.com/devinfo%40lists.e-smith.org