RE: Securing Fedora Core 4

From: Will Yonker (aragonx_at_dcsnow.com)
Date: 09/23/05

  • Next message: Cocobu: "Re: Securing Fedora Core 4" 
    Date: Fri, 23 Sep 2005 14:05:48 -0400 (EDT)
To: charles.heselton@gmail.com

    <quote who="Charles Heselton">
    > Well, those kinds of things should be blocked at your gateway. It's
    > much faster, and just as secure to handle this in a router's ACL,
    > than it is on a per machine basis. This way, you only need to worry
    > about configuring the host firewall for internal or "allowed"
    > threats. I'm defining "allowed threats" as services that you allow
    > through your firewall(s), i.e. DNS, HTTP, SMTP, etc.

    These machines are handling NAT and acting as Internet gateways. These
    sites are rather small (Less than 25 users each) so cost is a real factor.

    >> >> The hosts will receive email for the domain so spam filters
    >> >> are required.
    >> >
    >> > So, every host will be an MTA?
    >>
    >> No but every Linux machine will. The client machines run Windows
    >> XP. There are 3 offices at 3 different sites with 3 different
    >> domain names...
    >
    > Gotcha. I guess I'm probably just missing the whole scope of what
    > you're trying to do. So that makes things difficult to speculate
    > accuracy. I wouldn't expect the clients to be on linux (yet). ;-)

    I should have better defined the roles of these boxes. I didn't want to
    make the email too long or I would have put everyone to sleep. ^^ I have
    a problem at times between being to cryptic and too explanatory.

    > Well, they are basically one and the same. While the users may be
    > ignorant, despite attempts at training ;-), spam, phishing, malware,
    > all comes from "hostiles on the Internet". The question is really
    > (and you don't have to answer this - on list atleast :-) ), "what's
    > your money maker?" Not wanting to get hacked, is not a critical
    > asset. Webservers (containing a company's web presence), development
    > images, money (if you're a bank), personal information of
    > employees/customers, intellectual property.....these are all examples
    > of things that you're trying to protect. Once you identify the
    > systems that contain/manipulate/transfer that data, you can secure
    > it more appropriately.

    Okay, time for me to come clean. The REAL reason I want to secure these
    machines is: To help make a better Internet. Really I'm just trying to
    keep my boxes from being used to annoy other admins. That and it's really
    annoying when someone does hack your box because most root kits leave a
    mess. Stuff stops working correctly...

    There is very little valuable information on these machines that is not
    encrypted from the client side. And even that information is of little
    interest even if someone did get it.

  • Next message: Cocobu: "Re: Securing Fedora Core 4"

    Relevant Pages

    • Re: SSHD revelaing too much information.
      ... hundreds of machines and really don't see this as a problem. ... The 'green' banner does not attract any ... This goes against my security ... > networks) then make sure you're running a known secure version. ...
      (FreeBSD-Security)
    • xp firewall problem.
      ... been unable to access any secure web pages at all. ... I do not have norton on any of my machines and have tried ... is the same with the firewall enabled or disabled. ... and disabling standard Microsoft firewall...still no ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Biometrics
      ... keeping them disconnected and physically secure is sage advice. ... great grasp of the security aspect of protecting computers. ... Use Windows 98 Second Edition Machines as a safety internal protocol ... Maintain certain machines as off-line only in locked and secure rooms ...
      (microsoft.public.security)
    • Re: Wintards say Vista & XP Security is better than OS X while millions of bots spam the planet
      ... Many of those machines are kept up by people that don't know how to secure their machines. ... Microsoft should have taken things like this in to account and tried to work at thinking about security first but features always sell mass consumer products. ... But some people, including some found in this forum, recommend staying away from Vista citing UAC annoyance as one of the reasons. ...
      (comp.sys.mac.advocacy)
    • RE: Lab OS Choices
      ... I've found a few tests that worked against virtual machines but did not ... I also have some routers in my lab. ... to the client how to make their network more secure. ... I think I'd start with an unpatched Windows 2000 server. ...
      (Pen-Test)