Полезная информация

Practical UNIX & Internet Security

Practical UNIX & Internet SecuritySearch this book
Previous: 21.4 Setting Up the GateChapter 21
Firewalls
Next: 21.6 Final Comments
 

21.5 Special Considerations

To make the firewall setup effective, the gate should be a pain to use: really, all you want this computer to do is forward specific kinds of information across the choke. The gate should be as impervious as possible to security threats, applying the techniques we've described elsewhere in this book, plus more extreme measures that you would not apply to a general machine. The list below summarizes techniques you may want to implement on the gate machine:

Finally, look back at the guidelines listed under Chapter 17 they are also useful when setting up a gate. When you configure your gate machine, remember that every service and program that can be run presents a threat to the security of your entire protected network. Even if the programs appear safe today, bugs or security flaws may be found in them in the future. The purpose of the gate is to restrict access to your network, not to serve as a computing platform. Therefore, remove everything that's not essential to the network services.

Be sure to monitor your gate on a regular basis: if you simply set the gate up and forget about it, you may let weeks or more go by before discovering a break-in. If your network is connected to the Internet 24 hours a day, 7 days a week, it should be monitored at least daily.

Even if you follow all of these rules and closely monitor your gate, a group of very persistent and clever crackers might still break through to your machines. If they do, the cause will not likely be accidental. They will have to work hard at it, and you will most likely find evidence of the break-in soon after it occurs. The steps we've outlined will probably discourage the random or curious cracker, as well as many more serious intruders, and this is really your goal.


Previous: 21.4 Setting Up the GatePractical UNIX & Internet SecurityNext: 21.6 Final Comments
21.4 Setting Up the GateBook Index21.6 Final Comments