FC3 Security

[Rick Bilonick]

Scot L. Harris wrote:

>On Tue, 2005-03-08 at 23:58, Rick Bilonick wrote:
>
>  
>
>>Here are some additional details. The local IT for the data center has 
>>no central firewall. Each computer is on it's own and has to run a 
>>firewall. (The data center could use a firewall but it would have to be 
>>maintained by the university - and the data center doesn't want to have 
>>to deal with the university running a firewall for them.) Also, all the 
>>printers are available to anyone who knows their IP address - they don't 
>>sit behind any firewall. (This is SOOOO different from my previous 
>>position in the corporate world where all the computers and printers 
>>were behind a firewall.)
>>
>>    
>>
>
>You mean they are assigning routable IP addresses to all equipment and
>sticking them on a flat network?  No wonder they are paranoid.  They
>have no protection at all, if I understand the situation.
>
>That network must be like the wild west, systems getting owned every
>day.  Wonder how much paper gets wasted once some one stumbles onto an
>unprotected printer?
>
>  
>
>>The data center would go ballistic if I used a router to set up a local 
>>lan with a firewall. (The unversity frowns on connecting routers and 
>>hubs to the network. It  wants one computer for each port/ip address. I 
>>think this is somewhat silly but what can I do?)
>>
>>    
>>
>I can understand that.  I was recommending that you buy them a firewall
>for them to administer and run on your behalf.  But from other things
>you have described they would not know what to do with such a device.
>
>  
>
>>So far, all the yelling and screaming is from the data center directed 
>>at me. (I don't work for the data center - my appointment is in the 
>>department. I just happen to have an office located in what is called 
>>the data center.)
>>
>>The home solution has it's merits. But what is wrong with Verizon 
>>Wireless Broadband? This is an always-on cellular connection - not 
>>wireless ethernet type connection. I'm not sure though whether I would 
>>be able to ssh into the computer although my biggest concern is 
>>connecting to the Internet from the computer. I do know that the 
>>business DSL line, while expensive, would allow me to deliver web pages 
>>and use ssh etc.
>>
>>    
>>
>
>Any kind of wireless connection is subject to snooping.  Cellular is
>more difficult but with the right equipment someone could see every
>packet into and out of your system.  And since it is wireless they could
>do it from out in the parking lot.  And with cellular they could do from
>several blocks away.  ssh and VPN should be used for any kind of
>wireless connection even if it has its own encryption.
>
>Play with kismet a while.  Most likely there are any number of APs in
>the area some of which probably have very lack security.  You will be
>surprised how many user ids and passwords for email accounts and such
>you will see going by in the clear on such wireless connections.
>
>  
>
>>Unfortunately, the data center IT dept. consists only of a couple of 
>>individuals who seem intent on preventing me from doing my work. They 
>>were very irritated that I bought computer equipment without consulting 
>>them and that I contacted the university IT people. (The university IT 
>>have no concerns about me connecting my computer. I had no problem 
>>getting an IP address from them and they will sell me a port if I want 
>>one.) Why they care is beyond me since I'm not funding them through my 
>>grant so any "help" they would give would be at their expense.
>>
>>    
>>
>
>Like I suggested before make friends with the those in charge of the IT
>department, if possible.  Try to demonstrate that the system will be run
>in a secure manor, iptables enabled, only required services exposed,
>etc.
>
>Other than that move they system home and use it there.  From the sounds
>of it you would have better protection there using a $40 linksys NAT
>router than putting anything on the university network.
>
>  
>
>>Thanks for your thoughts.
>>
>>Rick B.
>>    
>>
>
>
>  
>
No one is allowed to install routers. (Although I know some people are 
doing it.) I have no problem with one port and one computer. I've 
explained that the system would be as secure or more secure than their 
Windows boxes but of course that only makes them more angry. They don't 
like Linux (they tried it once five years ago and they said they got 
hacked). The IT dept. CANNOT set up their own firewall. The university 
won't allow it. The university could set up a firewall for the data 
center but the university would manage the firewall. The data center IT 
people don't like the university IT people and don't want to have be 
subject to having the university manage the firewall.

Rick B.