🚀 go-pugleaf

Allen Todd (spcapt1@psyche.spc.uchicago.edu) wrote:
: In article <4e866r$riv@superb.csc.ti.com>,
: Bob Peterson <peterson@csc.ti.com> wrote:
: >In article <31052904.225B@boeing.hq.nasa.gov>, Chris Kleiman <ckleiman@boeing.hq.nasa.gov> writes:
: >|> H J Lu wrote:
: >|> ><snip>
: >|> > 4. To access our Class C network from the outside, we should be able to
: >|> >    login on the firewall machine and go from there.
: >|> >
: >|> > H.J.
: >|> 
: >|> quite frankly, I'd be reluctant to let any access through the firewall.
: >
: >  Agreed.
: 
: 
: 
: 
: The only way I would allow outside access though our firewall would
: be using one-time passwds -- we use SecurID, but there are several 
: other solutions including the freely available S-Key.
: 
: allen@botcc.com

This *still* doesn't address session hijacking.  Remember when you pass 
out, the outside machine is vulnerable to a hijack (unless it's FTP, and 
you're moving executables to run on the inside, then you're both 
vulnerable).  Inbound telnet means that anyone with a successfuly session 
hijack attack gets the command prompt on the inside host.  As far as I 
know, only well-managed encryption is adaquate protection against this.  
One-time passwords make sense on dial-in, under some security models, 
over IP, it's a fair risk.

Paul.

: >  Another option, appropriate in some situations, is to establish a
: >server connected to the Internet completely separate from the company's
: >internal LAN.  This can support some needs, such as demonstrations, but
: >probably won't suffice for checking email.  An "outdial" capability on

If you sync'd the e-mail, and protected it with encryption, it wouldn't 
seem to me to be too bad.  An inside mail host could be made to forward 
mail after PGP encrypting it, and then one of the commercial PGP enabled
mail programs could get it for the users.  In this situation, a one-time 
password would probably not be a bad thing.

Your paranoia may vary,

Paul.
-- 

-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280