On Wed, Mar 09, 2005 at 02:25:31PM -0600, Aleksandar Milivojevic wrote: > Jeff Kinz wrote: > >Any IT dept that equates sshd to a server is either not up to snuff > >technically (and in a really bad way.), or they are being duplicitous. > >(Thats another word for lying) > > I've heard only one side of the story about that particular IT > department (Rick's side), and reacted upon it (probably shouldn't have, > at least not without knowing the other side of the story). > > However, for one thing I must agree with the IT department in question. > Allowing unrestricted connections to any service (including SSH) from > Internet isn't something that should be allowed. It isn't really > relevant if the machine is server or not. > > Now, definition of server is kind of fuzzy. If machine is running a > service that accepts connections, it might be considered a server. All > depends on the definition one chooses to use. On the other hand, using > that definition, each and every Windows machine with file&printer > sharing enabled is also a server (and my guess is that file&printer > sharing is commonly used on the university type of network). > > I can kind of see the mentioned IT department as having a point *if* > they are the only ones who are administering all those Windows boxes on > their network, keep them tightly closed down, with users not able to > change any system settings, with BIOS passwords to prevent users from > reinstalling machines. If users have Administrator privileges on those > Windows machines, than I can't see any reasoning behind their decision, > as long as Rick is not bugging them to troubleshoot his problems. > > Another thing that puzzles me is, if the network is completely open (as > Rick said it is), and they are depending only on Windows XP firewall > feature, than what is the difference between Rick's machine and any > other host on the Internet? Sure, somebody can do more effective DoS on > local network, but other than that? > > BTW, I completely agree with one comment made here. IT department > provides service. There are no "us" and "them". In corporate world, we > do whatever is needed to support bussiness needs. IT department in > university setting should be the same. If somebody needs Linux box > connected to network to do his work, IT folks shouldn't be in the way > "because we are Windows-only shop". I always considered my job > description to be "finding a way to allow people to do their work in > most efficient way, while keeping it secure". > > What Rick described is completely opposite attitude that results in > restricting people in doing their work, separation to "us" and "them", > and inefficient use of resources. > I shouldn't comment, not knowing the facts. Curiosity is getting the better of me. As others have suggested, I think Rick should work from home where he has more control. What other types of Internet access does Rick plan to use from his Linux box besides using an sshd so he can connect from home? I read, from a previous message, Rick has a half a million dollar grant to do research. If his grant is important to him, I would have expected him to ask what security measures are taken so his research is not disturbed or interrupted. Having a secure computer is hardly sufficient these days. The network one is connected to has to work reliably with a reasonable expectation of performance too. I would have expected other researchers to have similar requirements that their research not be disturbed or interrupted. I would find out what other researchers did (or didn't do). I would ask for a security audit of the data center so any weaknesses they may have can be uncovered and corrected. I.e., the data center should be able to prove it provides a secure environment for doing valuable research. I would expect the IT people in the data center to welcome an audit. The data center will get added, sounds like much needed, visibility. Hopefully, as a result of a security audit, some of the suggestions others have made, such as having firewalls, putting information needing greater security on separate subnets with firewall/routers separating the subnets, having DMZ zones with firewalls standing between not only the DMZ zones and the internal networks, but also between the DMZ zones and the Internet. How much would it cost to do a security audit? How much would a reasonable firewall/router cost these days? How much would it cost to have separate wiring for the subnets? What other costs would be involved? Who would pay these costs? I have no idea what these suggestions cost. It's easy to make suggestions when one is not paying the bills. It surprises me, if accurate, that communication with the IT people from the data center is this sour. If the IT people are truly to blame, I would find out who funds the data center. Rick is obviously not the "customer" providing funding to the data center. The people who matter are the people who provide the funding. They may or may not be the management that oversees the data center. The management will save complaints for later review when it's time to evaluate data center employees. I believe the action of management depends, not only on the substance of the complaint, but unfortunately and more importantly, on who made the complaint. The people who provide the funding, the true "customers" of the data center, might or might not be sympathetic to Rick's complaints. Decades ago, I saw how quickly management and IT people could jump when a very important customer, this one provided lots of funds, was about to sneeze. It's amazing how barriers and problems became trivial. It's amazing how, suddenly, money was no object. One person pointed out Rick should go to the head of his research department. A graduate student's complaint probably doesn't count as much as a tenured professor's. It would be interesting to hear the side of the IT people from the data center. They sound like they have limited funds. They may not be able to adequately protect the "data" and resources at their data center. One hopes the funds spent for security are, in some way, proportional to the value of the data and the value of the resources being protected. Perhaps, the IT people at the data center need more visibility to get more funds and resources to do their job better. One hopes the data center and the university take adequate security measures before their PCs become part of a large botnet. Perhaps, they could weather the bad publicity if their PCs were used for criminal purposes. Perhaps, there wouldn't be as many financial and legal repercussions if they could show they had done their best to prevent such an occurrence. Perhaps, if they pro actively do a security audit and take remedial action now, they will avoid much pain and embarrassment later. Just my two cents. Not knowing the facts or paying their bills, I should talk.... I should keep quiet now. -- Rick Sewill Phone/FAX: +1-218-287-1075 E-mail: rsewill@xxxxxxxxxxxx Cell Phone: +1-701-866-0266
