🚀 go-pugleaf

In aus.computers.linux on Mon, 18 Jan 1999 14:08:21 +1100
Brendan Crawford <brendan@hemlock.newcastle.edu.au> wrote:
>I'm pretty certain that we will have an airgap firewall, since
>authorization from a "higher authority" is necessary to actually put this
>machine on the www.


Umm.. the net is not the www.

There is more to life than http.

Decide if anyone anywhere needs to be able to connect from outside
that room.  To anything.  If not, then no outside cables required
and you can be as open on that server as you want.

If it does (such as that server needing to get stuff from outside) 
then either lock it up tight as you can, or only plug it into the
outside world when you need to.

remove all services from inetd.conf that you don't need, which means all
of them.  You do not need tftpd in inet.conf if you don't want people
tftping into the box for example.

Don't use telnet, use ssh, and set that up so only the lab machines can
connect.

Set up your box on the idea that "everything not specifically allowed
is forbidden" and make sure nothing whatsoever is running unless you
know what it is, what it does, and it's nailed down tight.

Then log everything for a couple of weeks and check again.

Zebee

--
SAGE-AU: The System Administrator's Guild. www.sage-au.org.au
  To advance the profession of System Administration by raising 
  awareness of the need for System Administrators, and educating 
  System Administrators in technical as well as professional issues.