NetNews Usenet Archive 1992 #16/NN_1992_16.iso/spool/comp/protocol/tcpip/3820

Text File | 1992-07-25 | 5.0 KB | 99 lines

Newsgroups: comp.protocols.tcp-ip
Path: sparky!uunet!zaphod.mps.ohio-state.edu!news.acns.nwu.edu!nucsrl!ddsw1!karl
From: [e-mail] (Karl Denninger)
Subject: Re: Firewall usage (was: Re: ping works, but ftp/telnet get "no route)
Message-ID: <[e-mail]>
Summary: Firewalls
Organization: Macro Computer Solutions, Inc., Chicago, IL
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Sat, 25 Jul 1992 04:05:58 GMT
X-Disclaimer:  Material posted in this article is the sole responsibility of
                the poster and does not represent MCSNet or the system owners.
Lines: 85

In article <[e-mail]> [e-mail] (Gary Heston) writes:
>In article <[e-mail]> [e-mail] (John Ioannidis) writes:
>>In article <[e-mail]> [e-mail] (Mark Bixby) writes:
>>>Why would I be able to ping a site OK, but when I try to ftp or telnet to it
>>>I receive a "no route to host" error?  ....
>
>>The site you are trying to ping is running a firewall gateway, because
>>they're too lazy to beef up their host security and are relying on the
>>firewall to protect themselves against external attacks.
>
>I have to take exception to this remark. Use of a firewall doesn't indicate
>laziness on the part of a site; it most probably means that the persons
>responsible for the Internet connection and security of the sites' net are
>either too understaffed to maintain all the hosts on their site, or they
>don't have control over all the hosts, and are therefore not able to make
>them secure. And there are doubtless many sites that suffer from both
>problems.

There are a number of reasons other than laziness or overwork that an
organization may firewall (seeing as I put these things in, I'll explain):

1)    The company may have rather loose security internally (i.e. Runs NIS
    for password validation) and doesn't like the idea of someone doing
    a ypset/ypcat on their password files, or its moral equivalent.
    This "rather loose" part may be a >requirement< by some of their
    hardware or software that they cannot control (see some of the major
    system vendors for some of the worst offenders here, and their utter
    failure to provide off-the-shelf secure alternatives.  KERBEROS is
    >NOT< adaquate in most commercial environments, as tickets expire,
    and for most people in these environments that is plain unacceptable).
    Organizationally it may be deemed acceptable to have this security
    level for employees, but not against outsiders.

2)    The organization may have a large number of MAC and PC desktops, all
    or any of which may be able to be compromised to someone's extreme
    detriment with no good way to stop the abuse.  Not all the world's a
    Unix.

3)    The organization may want to run NFS, and either has too many hosts
    to do individual host validation in the exports file, or just can't
    for other reasons.  This is a real bitch with the NFS mount
    protocols; there is >no< good way to stop this from being a
    potential problem in many organizations.  The ability to wild-card
    domain names in the export list as in "allow anyone from "mcs.com"
    access), along with a local name server (which prevents spoofing the
    reverse lookups) would solve this easily -- but it isn't happening
    these days with the major vendors -- again.  The NETGROUP paradigm
    does >not< help in many of these cases, especially when combined
    with the NIS problem.

4)    The organization may not like the idea of the local (or
    long-distance) teen-age hacker crowd taking pot-shots at their
    security on a daily basis across several hundred or thousand hosts.
    It is much easier to watch, and defend, one entry point.

5)    Change the offender in #4 to some corporate espionage types, and add
    a company that has significant computer-based assets, and you have
    yet another argument.

>>I wish I had a transcript of Dave Clark's talk at the IETF last week.
>>He said some great things about firewall gateways and mailbridges, and
>>how they've essentially destroyed the whole purpose of having an IP
>>internet, and have forced a lot of us to use mail as a transport-level
>>protocol.

Hogwash.  If it is that important to an organization, the firewall can
provide proxy service for it.  It is >not< that big a deal to provide a
proxy connection for these kinds of things, >provided< that you have a nice
clean requirement.  The generic "anyone can do anything" doesn't cut it in
Corporate America anyway.

>Yeah, I'd probably enjoy reading it myself. Unfortunantly, with the explosive
>growth of the net, it's no longer an approximation of an ideal world. In
>an ideal world, we wouldn't need locks on our doors, keyswitches in our
>cars, or firewalls on our nets.
>
>Flaming admins as being "lazy" because a firewall is in place is *way*
>out of line.

Agreed.

--
Karl Denninger ([e-mail], <well-connected>!ddsw1!karl)
Data Line: [[phone]] Anon. arch. (nuucp) 00:00-06:00 C[SD]T
Request file: /u/public/sources/DIRECTORY/README for instructions