Re: nfs exports

["Bryan J. Smith" <b.j.smith@ieee.org>]

On Mon, 2004-11-22 at 11:52, Casey Boone wrote:
> internet<->linux firewall<->local lan<->linux fileserver
> the firewall and fileserver are the ones i am doing nfs exports on

Ouch!  Don't run RPC services on the firewall, even if they are only LAN
facing.  General practice is minimal services on the firewall, and RPC
is one big and bad one!  ;->

If someone gets control of an internal system (typically through a
Windows client initiated exploit), the first thing they will notice is
RPC running on the default gateway.  They'd hit it first and foremost!

> i plan on blocking all traffic from the internet side except inbound
> ssh (actually that is how it is now for both public and private eth
> interfaces, havent made eth1 trusted yet)

And what are you blocking outbound?  2049 should be a must (if you don't
have a "deny all outgoing" default in the first place).

-- 
Bryan J. Smith                                    b.j.smith@ieee.org 
-------------------------------------------------------------------- 
Subtotal Cost of Ownership (SCO) for Windows being less than Linux
Total Cost of Ownership (TCO) assumes experts for the former, costly
retraining for the latter, omitted "software assurance" costs in 
compatible desktop OS/apps for the former, no free/legacy reuse for
latter, and no basic security, patch or downtime comparison at all.



-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.