On Tue, 2005-03-08 at 23:58, Rick Bilonick wrote: > Here are some additional details. The local IT for the data center has > no central firewall. Each computer is on it's own and has to run a > firewall. (The data center could use a firewall but it would have to be > maintained by the university - and the data center doesn't want to have > to deal with the university running a firewall for them.) Also, all the > printers are available to anyone who knows their IP address - they don't > sit behind any firewall. (This is SOOOO different from my previous > position in the corporate world where all the computers and printers > were behind a firewall.) > You mean they are assigning routable IP addresses to all equipment and sticking them on a flat network? No wonder they are paranoid. They have no protection at all, if I understand the situation. That network must be like the wild west, systems getting owned every day. Wonder how much paper gets wasted once some one stumbles onto an unprotected printer? > The data center would go ballistic if I used a router to set up a local > lan with a firewall. (The unversity frowns on connecting routers and > hubs to the network. It wants one computer for each port/ip address. I > think this is somewhat silly but what can I do?) > I can understand that. I was recommending that you buy them a firewall for them to administer and run on your behalf. But from other things you have described they would not know what to do with such a device. > So far, all the yelling and screaming is from the data center directed > at me. (I don't work for the data center - my appointment is in the > department. I just happen to have an office located in what is called > the data center.) > > The home solution has it's merits. But what is wrong with Verizon > Wireless Broadband? This is an always-on cellular connection - not > wireless ethernet type connection. I'm not sure though whether I would > be able to ssh into the computer although my biggest concern is > connecting to the Internet from the computer. I do know that the > business DSL line, while expensive, would allow me to deliver web pages > and use ssh etc. > Any kind of wireless connection is subject to snooping. Cellular is more difficult but with the right equipment someone could see every packet into and out of your system. And since it is wireless they could do it from out in the parking lot. And with cellular they could do from several blocks away. ssh and VPN should be used for any kind of wireless connection even if it has its own encryption. Play with kismet a while. Most likely there are any number of APs in the area some of which probably have very lack security. You will be surprised how many user ids and passwords for email accounts and such you will see going by in the clear on such wireless connections. > Unfortunately, the data center IT dept. consists only of a couple of > individuals who seem intent on preventing me from doing my work. They > were very irritated that I bought computer equipment without consulting > them and that I contacted the university IT people. (The university IT > have no concerns about me connecting my computer. I had no problem > getting an IP address from them and they will sell me a port if I want > one.) Why they care is beyond me since I'm not funding them through my > grant so any "help" they would give would be at their expense. > Like I suggested before make friends with the those in charge of the IT department, if possible. Try to demonstrate that the system will be run in a secure manor, iptables enabled, only required services exposed, etc. Other than that move they system home and use it there. From the sounds of it you would have better protection there using a $40 linksys NAT router than putting anything on the university network. > Thanks for your thoughts. > > Rick B. -- Scot L. Harris webid@xxxxxxxxxx Use a pun, go to jail.
