Re: FC3 Security

From: Rick Bilonick (rab_at_nauticom.net)
Date: 03/09/05

  • Next message: spmirowski: "Re: nvidia TNT 2 Model 64" 
    Date: Tue, 08 Mar 2005 23:58:06 -0500
To: For users of Fedora Core releases <fedora-list@redhat.com>

    Scot L. Harris wrote:

    >On Tue, 2005-03-08 at 23:10, Rick Bilonick wrote:
    >
    >
    >>I'm have a half-million dollar grant for research and with some of this
    >>money I recently assembled a computer with dual opteron processors, 2gb
    >>of memory, 240 gb of hard drive, and 500 gb for a raid disk array. The
    >>computer will be doing some heaving duty number crunching (using R and
    >>other open source software). I installed FC3 (64-bit) without any
    >>problems, applied to the university computer dept. for an IP address
    >>(and received an IP) for one of the ports in my office and started
    >>working. The next day the "local" IT dept. (such as it is) for the "data
    >>center" told me I had to disconnect from the port as my computer was a
    >>"risk" to their data center. First they said that because my computer
    >>was connected to the same subnet as the data center that this computer,
    >>if hacked, would pose a threat to their computers. They consider my
    >>computer to be a "server" because I was using ssh to connect remotely to
    >>it. When I said I would eliminate ssh, then they said that they don't
    >>support Linux systems and won't allow it to be connected. If they don't
    >>control the computer (by installing Windows XP), then the computer is a
    >>threat to their system because it is on the same subnet. (The university
    >>gives out IP addresses and actually owns the network. Various
    >>departments and groups rent ports.)
    >>
    >>
    >
    >Any system if hacked poses a threat to the data center. ssh is
    >recommended to use when accessing system over say telnet so that
    >reasoning does not make sense.
    >
    >
    >
    >>Is there any truth to what the IT people are saying or are they simply
    >>insane (or control freaks or both)?
    >>
    >>
    >>
    >
    >Sounds like who ever is telling you this is either parroting "official
    >policy" or does not understand how to setup a network.
    >
    >
    >
    >>In the next couple of days I will be speaking with the department head
    >>(the data center is a small part of the department and my grant is
    >>totally independent of the data center). If I can't get her to see
    >>reason and force the data center to act reasonably, I think I have the
    >>following options for connecting my FC3 computer to the Internet:
    >>
    >>1) get a separate project office outside of the data center
    >>(inconvenient to have two offices blocks or farther apart),
    >>
    >>2) get a DSL data line installed (about $130/month for 512K - kind of
    >>expensive),
    >>
    >>3) use Verizon Wireless Broadband (very fast [512K], $80/month - not
    >>cheap but I could take the PC 5220 card out and use in the evenings and
    >>weekends),
    >>
    >>4) take the computer and 20 in lcd monitor home, connect it to the DSL
    >>line, and do the work at home.
    >>
    >>What would you recommend? If I'm going to complete this project on time,
    >>I can't have any more time wasted. So I need to get this resolved.
    >>
    >>
    >
    >The quickest solution is to take the system home and work from there.
    >
    >The IT department should, if they are so concerned about security, setup
    >a LAN that is firewalled off from the data center where they can connect
    >users systems. On that LAN they would need to provide some minimal set
    >of services which could be handled by one server and a firewall. The
    >server would provide DHCP, NTP, DNS, and other basic network services.
    >The firewall would provide the connection out to the Internet and
    >separate their data center from "suspect" systems.
    >
    >I would only consider wireless if you can make sure you use ssh or VPN
    >type connections. WEP is not secure enough IMHO.
    >
    >In your place I would make friends with upper management in the IT
    >department and get the low down on their internal processes. Possibly
    >offering to buy a firewall that would be used to setup a secured LAN for
    >your use or something along those lines. Just make sure you run
    >iptables and only install services exposed to the network that you
    >really need and use. Possibly explain the security you are using on the
    >system to your new friend in IT would help as well.
    >
    >As I said, in the short term working from home is going to be the
    >quickest solution. Working through the bureaucracy can take a lot of
    >time until you make friends with the right person. And yelling and
    >screaming will not get you any where. It may actually make them even
    >less willing to work with you.
    >
    >
    >
    Here are some additional details. The local IT for the data center has
    no central firewall. Each computer is on it's own and has to run a
    firewall. (The data center could use a firewall but it would have to be
    maintained by the university - and the data center doesn't want to have
    to deal with the university running a firewall for them.) Also, all the
    printers are available to anyone who knows their IP address - they don't
    sit behind any firewall. (This is SOOOO different from my previous
    position in the corporate world where all the computers and printers
    were behind a firewall.)

    The data center would go ballistic if I used a router to set up a local
    lan with a firewall. (The unversity frowns on connecting routers and
    hubs to the network. It wants one computer for each port/ip address. I
    think this is somewhat silly but what can I do?)

    So far, all the yelling and screaming is from the data center directed
    at me. (I don't work for the data center - my appointment is in the
    department. I just happen to have an office located in what is called
    the data center.)

    The home solution has it's merits. But what is wrong with Verizon
    Wireless Broadband? This is an always-on cellular connection - not
    wireless ethernet type connection. I'm not sure though whether I would
    be able to ssh into the computer although my biggest concern is
    connecting to the Internet from the computer. I do know that the
    business DSL line, while expensive, would allow me to deliver web pages
    and use ssh etc.

    Unfortunately, the data center IT dept. consists only of a couple of
    individuals who seem intent on preventing me from doing my work. They
    were very irritated that I bought computer equipment without consulting
    them and that I contacted the university IT people. (The university IT
    have no concerns about me connecting my computer. I had no problem
    getting an IP address from them and they will sell me a port if I want
    one.) Why they care is beyond me since I'm not funding them through my
    grant so any "help" they would give would be at their expense.

    Thanks for your thoughts.

    Rick B. 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: spmirowski: "Re: nvidia TNT 2 Model 64"

    Relevant Pages

    • Re: [fw-wiz] Is NAT in OpenBSD PF UPnP enabled or Non UPnP?
      ... >> I start by not giving logins and SSH access to users I don't trust. ... a network topology which goes around the ... >> firewall and thus is a serious hole to network security. ... >> have access via UPnP to, well, anything that device might happen to ...
      (Firewall-Wizards)
    • Re: Workgroup is not accessible.
      ... The only network connection with the ... firewall set was the dial-up connection, ... Even when it accesses the workgroup, ...
      (microsoft.public.windowsxp.network_web)
    • RE: Lost Internet Connectivity
      ... use network diagnostic tools, i.e. ipconfig, ping, etc. ... Firewall, McAfee Personal Firewall, VS, two-PC network, Motorola modem, ... PCI 10/100 Ethernet Connection. ... Windows Firewall/ICS Service not running, ...
      (microsoft.public.windowsxp.network_web)
    • Re: 32-bit TCP/IP Connection
      ... try the uninstall on MCAfee yet. ... Regarding my Network conncections though - first off, ... When I right-click on AOL only the AOL connection setup screen pops-up. ... have the Microsoft XP Firewall turned on, I do use SpyBot S & D, AdAware SE ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Questions on some wierd /var/log entries
      ... How do I find out if I'm on an ipv6 network? ... That is because I prefer using iptables directly. ... then you should start learning about its firewall ... Another important restriction for ssh is to authenticate by certificate ...
      (comp.os.linux.misc)