Date: Tue, 19 Nov 2002 09:49:32 +0000 (GMT) From: Avleen Vig <lists-freebsd@silverwraith.com> To: Pierrick Brossin <pbrossin@swissgeeks.com> Cc: Giorgos Keramidas <keramida@ceid.upatras.gr>, Greg 'groggy' Lehey <grog@FreeBSD.ORG>, "freebsd-questions@FreeBSD.ORG" <freebsd-questions@FreeBSD.ORG> Subject: Re: FreeBSD Easy Server Message-ID: <20021119093610.G53207-100000@apple.silverwraith.com> In-Reply-To: <1037698206.3dda049e32874@www.swissgeeks.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> > Errrr.. > > The only real benefits you get from a firewall are: > > 1) controlling which IP addresses can access a service > > 2) *maybe* bandwidth shaping. *maybe*. > > 3) packet re-writing. > > That's all ? That's all really! > I thought the firewall was THE thing to have when you have a server which is > running 24 jours a day, 365 days per year! I don't mean any disrespect Pierrick, but it sounds like you're following what other people are telling you without really understanding it. Please read a coupel of the others emails I sent after the above one, and you'll see why having a firewall may or may not be useful. If it's not useful then don't use it. It won't help! Maybe one thing I forgot that a firewall can do, is watch and log inbound connections, but something like an Intrution Detection System (IDS) is better at that. And it can log hack-in attempts and other nasties. Snort is a good lightweight IDS. www.snort.org. > I'm considering myself as a newbie under FreeBSD for the moment so I may be > wrong about the next point but what you telling me is that I can restrict access > to certain services to certains IPs ? > So I would use the config file of each service to say this one can access, let's > samba .. this one cant (interfaces=... in smb.conf if I remember correctly). Yes. Also look at 'man 5 hosts_access'. the file /etc/hosts.allow can be configured to allow or deny access to services in the same way. Eg, you could have these line in /etc/hosts.allow: netbios-ns : 12.34.56.1 : allow netbios-ns : ALL : deny this would allow netbios connections to port 137 for the ip address 12.34.56.1, but deny it to everyoen else. See? No firewall needed :-) > They are Linux (ouch :D) distributions that are only firewall and don't run any > other services (like smoothwall if I'm right). > So a distribution like this one is superfluous for users like me ? It certainly sounds like it, unless you want to do lots of restrictions on who can and cannot connect to certain ports. > I own swissgeeks.com and need a little bit of security. Got a lot of > stuff running on this server and if I'm switching to FreeBSD I have to > be sure I won't get hacked, though it's always possible. Let's say I'd > like the same security as SME provides me for the moment. As known, 1 > year and a half and no problem! > This was the story :D The chances of getting hacked are higher when: There is a bug in a server that is listening on a network port, and someoen you don't want connectig to this service because you don't trust them, exploits it. The best way around this is to always keeps your installations up to date. Eg when a new apache version is released, I normally install withing 2 or 3 days after testing it on a spare machine. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021119093610.G53207-100000>