🚀 go-pugleaf

dglaude@vub.ac.be (GLAUDE DAVID) wrote:



>	I have some question about connexion/security of a Novell 4.1
> (and its client) on the internet.

>I see some possibility to have TCP/IP connectivity on the Novel client
> (mostly Win 3.1 and Win 95). I am unsure about the risk associated with
> those solution and some of them I am not even sure if they are working.

>Our connexion is throught a 64k Leased Line ussing a Cisco 2501. The
> part of network connected is a thin ethernet cable where standalone PC are
> connected to "browse". We have a class C adresse alocated for us.
>Our lan is also a thin ethernet with the Novell server and all other client.
> All the client are PC Windows (no Unix or alike).
>There is no firewall of any kind (except the possibility of filtering packet
> on the router) on our network connexion.

>1) Direct connexion of the client.

>Put everything on the same ethernet cable and put two stack on the client PC
> (one for TCP/IP and one for IPX). No TCP/IP stack on the Novell server or
> on client that do not need internet connectivity. All client have one unique
> TCP/IP address. Windows 95 client use standard TCP/IP stack, Windows 3.1 use
> Cameleon or Trumpet stack.

>Security issue: Communication to and from the Novell are done in IPX, and
> "browsing" is done ussing TCP/IP stack.

>Security question:
>	What are the risk for PC directly connected to the internet that have
>		no server process of any kind running ? (unlike Unix)
>	What are the risk for PC directly connected to the internet running
>		client application (java, mime attachement,...) ?
>	What are the risk for the Novell server ?

>2) Direct connexion with client using TCP/IP to talk to the Novell server.

>I am not sure about this solution, I think Novell can use a TCP/IP stack for
> client connexion. I think that this solution might be more eassy if only one
> stack is needed on client side. This solution might be more risky because the
> whole internet might want to talk to our Novel server (need for a filtre on
> packet directed to the server ?).

>3) Dual segment with on machine making the firewall/gateway.

>This solution is implemented ussing Nov*ix for internet from Firefox but
> we have trouble running the client stack on Win 95.

>I see some possibility of this kind.
>a) Novell server with two ethernet card on both inside and outside network
>	ussing a special NLM to make adresse stranslation and encapsulation
>	of IP packet in IPX packet.
>b) Novell server with two ethernet card ussing TCP/IP to talk to it's client
>	and routing TCP/IP from it's client to and from the internet.
>c) Other box with two ethernet card and making gateway between the two
>	network. (or maybe changing from Novell to Win NT server).


>I think most of the security is in ussing two diferrent protocole and having
> the Novel not talking TCP/IP at all or only for gatewaying.

>If you know any PRODUCT, PAPER or FAQ on thoses subjects, or if you have a
> experiance in related situation (I am not the only one having to connect
> a Novel Lan to the internet). PLEASE reply to me.

>PS: price is also an issue, but the technical point of vue is really important
>	to me.

>		Thanks very much for reading.

>						David GLAUDE.

Right now the workstations may not be running any type of servers but
the systems are known as Personal Computers for a reason.  If you've
spent any time the web then you have probobly visited sites that are
running on desktops.  Just because they aren't running servers now
doesn't mean they won't be later.  That's how many systems get broken
into.

Suppose that one of your workstations is breached.  How do you keep
them off of the Novell server now?  How do you keep them from
attacking other systems?  How do you deal with the password caching
issues?

I recommend that you don't conenct the PCs directly to the Internet.

That said.  If you decide to run dual stacks, get a firewall.  If you
want to run one stack get an IPX/IP gateway but don't run it on your
Novell server.  Use a seperate dedicated box.  Instant Internet,
CyberJunction and Internet Junction are just a few.  They all have 32
bit clients that work and even FireFox recommends that you run a
seperate server (check the tech notes not the sales person).

The Novell server can run IP and you can remove IPX from the network
but you will see (maybe) an 8% performance drop (not much on many
networks).  But IPX requires little management and if you aren't
having network congestion issues than it might be more trouble
replacing IPX than its worth.

The IPX/IP gateways work but there are the software issues that you
facing today.  The IP solutiuon requires a little more management but
fewer software issues.

I hope I helped instead of just confusing things.  I'm sure that I'm
good at at least one of them :-)