Rick Meyer wrote:
Yep...., except that the real information that is being transmitted by the
firewall is inside an encrypted VPN. Also the file system itself is
encrypted. The firewall won't accept SSH from just any system. It's locked
down. I'm just trying to make it extremely difficult for an unauthorized
user to get access to it.
Rick.
| -----Original Message-----
| From: ryan [mailto:ryanag@xxxxxxxxxxxxxxxx]
| Sent: Sunday, March 13, 2005 6:16 AM
| To: fedora-list@xxxxxxxxxx; rick@xxxxxxxxxxx
| Subject: fedora-list@xxxxxxxxxx
| | "How do I lock or disable unused ports such as keyboard, video and USB
| ports?
| | | Here is the scenario; I have several firewalls built upon Fedora that are
| in
| closets physically unmonitored. An unscrupulous individual could plug in
| a
| keyboard, mouse and monitor into one of these systems and start getting
| access to it. Even worse the individual could plug in other devices to
| log
| all packets flowing through the firewall. This gives me chills just
| thinking about it!
| | I would like to disable any I/O devices that aren't actually needed."
| | | Way too much work with no tangible benefits. If you did all this, what is
| to keep a malicious attacker from dropping in a $10 hub, then setting up a
| monitoring station. He/She could just walk in occaisionally and get the
| logs off, or worse, set up a cheap access point and just pull into the
| parking lot, SSH into their sniffer machine, and get the logs that way.
| | Physically secure the machines or don't think too hard about it. Stripping
| the servers down to a CPU/RAM/HD and ethernet ports won't provide much
| additional security.
| |
I meant that the attacker can SSH into their seperate sniffing machine.
The VPN setup helps as lot, but still doesn't protect you. Once the attacker figures out that you are running a VPN, they can just crash (or steal) your system.
Worse, they can steal your hard drive. Even assuming you've encrypted important stuff, this is still a big enough issue to force you to re-do everything (how long will you encryption be good for, until it can be easily broken? 1 year? 10 years?).
With physical access to the machine reasonably possible, you have to make the assumption that any attacker can gain control of your system, if they are willing to break and enter to do so.
You need to think about what else at these locations is not secured, and their relative value. Also consider how many strangers wander these buildings, or is it the same old people all the time.
If there are things of greater business importance than your firewall not secured, I think its an organizational problem. If only your firewalls are in unlocked closets, it sounds like you need some good ol' physical access control. A nice lock, alarm system, and webcam would probably take far less time to setup, and be less dangerous to your network, than disabling everything on your firewall machines. ;-)
