Re: FC3 Security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2005-03-08 at 23:58, Rick Bilonick wrote:

> Here are some additional details. The local IT for the data center has 
> no central firewall. Each computer is on it's own and has to run a 
> firewall. (The data center could use a firewall but it would have to be 
> maintained by the university - and the data center doesn't want to have 
> to deal with the university running a firewall for them.) Also, all the 
> printers are available to anyone who knows their IP address - they don't 
> sit behind any firewall. (This is SOOOO different from my previous 
> position in the corporate world where all the computers and printers 
> were behind a firewall.)
> 

You mean they are assigning routable IP addresses to all equipment and
sticking them on a flat network?  No wonder they are paranoid.  They
have no protection at all, if I understand the situation.

That network must be like the wild west, systems getting owned every
day.  Wonder how much paper gets wasted once some one stumbles onto an
unprotected printer?

> The data center would go ballistic if I used a router to set up a local 
> lan with a firewall. (The unversity frowns on connecting routers and 
> hubs to the network. It  wants one computer for each port/ip address. I 
> think this is somewhat silly but what can I do?)
> 
I can understand that.  I was recommending that you buy them a firewall
for them to administer and run on your behalf.  But from other things
you have described they would not know what to do with such a device.

> So far, all the yelling and screaming is from the data center directed 
> at me. (I don't work for the data center - my appointment is in the 
> department. I just happen to have an office located in what is called 
> the data center.)
> 
> The home solution has it's merits. But what is wrong with Verizon 
> Wireless Broadband? This is an always-on cellular connection - not 
> wireless ethernet type connection. I'm not sure though whether I would 
> be able to ssh into the computer although my biggest concern is 
> connecting to the Internet from the computer. I do know that the 
> business DSL line, while expensive, would allow me to deliver web pages 
> and use ssh etc.
> 

Any kind of wireless connection is subject to snooping.  Cellular is
more difficult but with the right equipment someone could see every
packet into and out of your system.  And since it is wireless they could
do it from out in the parking lot.  And with cellular they could do from
several blocks away.  ssh and VPN should be used for any kind of
wireless connection even if it has its own encryption.

Play with kismet a while.  Most likely there are any number of APs in
the area some of which probably have very lack security.  You will be
surprised how many user ids and passwords for email accounts and such
you will see going by in the clear on such wireless connections.

> Unfortunately, the data center IT dept. consists only of a couple of 
> individuals who seem intent on preventing me from doing my work. They 
> were very irritated that I bought computer equipment without consulting 
> them and that I contacted the university IT people. (The university IT 
> have no concerns about me connecting my computer. I had no problem 
> getting an IP address from them and they will sell me a port if I want 
> one.) Why they care is beyond me since I'm not funding them through my 
> grant so any "help" they would give would be at their expense.
> 

Like I suggested before make friends with the those in charge of the IT
department, if possible.  Try to demonstrate that the system will be run
in a secure manor, iptables enabled, only required services exposed,
etc.

Other than that move they system home and use it there.  From the sounds
of it you would have better protection there using a $40 linksys NAT
router than putting anything on the university network.

> Thanks for your thoughts.
> 
> Rick B.


-- 
Scot L. Harris
webid@xxxxxxxxxx

Use a pun, go to jail. 


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux