🚀 go-pugleaf

Dominik Fretz <roboto@linuxfreak.com> wrote:
> nat�rlich wollen wir auch ein gewisses mass an sicherheit (wir m�chten
> ja nicht gleich alle gesch�ftsgeheimnisse ausplaudern) und somit sollten
> wir auch ne firewall haben.

There are many ways to construct a firewall, from none to massive filtering.
The massivest (?) is probably to have two networks, one connected to the
Internet and firewalled, and one not connected at all, except for mail & news,
through a serial connection.

Some enterprises only have Internet access in one room. Thus allowing to
enable java/activeX/viruses without any risks (other than reinstalling
the computers automatically at every logoff).

> wie sicher ist ne software firewall mit linux?

probably, as secure as the system manager did configure it.

> sind solche firewalls �berhaupt im praktischen einsatz in firmen?

Yes. CFF/SBB/FFS to my knowledge, Ikea, and me. That makes three
companies already :)

> gibts scripte die einem das konfigurieren erleichtern (denn das hat
> sicher schon mal einer gemacht)?

Yes. SuSE Linux comes with an automatic firewall configuration, you
just need to read the documentation and install the right package. However,
I strongly suggest you take half a day to read all the security HOWTOs,
such as Firewall-HOWTO.

Also, a firewall can also be partly done on the router and by the ISP.

> ober kennt jemand ne hardwarefirewall die nicht so hyper teuer ist?

To my knowledge, some CISCO routers have advanced firewalling possibilities.
Never tried, never bought ($$). Also, some companies sell Linux firewalls
either embedded in hardware (Apex router), or in software (US$70
configuration diskette from MS-*, generates a Linux boot diskette).

In your case I would suggest you write a small specification, with the
Internet access needs (who accesses what, from inside and from outside).

If people mostly use news/mail, why bother allowing full TCP/IP access ?
If people do WWW, just proxy their request with an application proxy.

You only need real packets going through the interface for special
needs (ICQ, UDP protocols, etc).