Re: restrict implicit binding to addresses
- From: David Schwartz <davids@xxxxxxxxxxxxx>
- Date: Thu, 30 Oct 2008 03:18:51 -0700 (PDT)
On Oct 30, 1:40 am, Wolfgang Draxinger <wdraxin...@xxxxxxxxxxxxxxxx>
wrote:
Well, iptables will do the job, it just _must_ be configured
correctly.
That's true of any solution. Since you want to allow some things and
not others, somewhere there is going to have to be a configuration of
what's allowed and what isn't. I don't see that you have an
alternative.
The human factor is the problem: The system will be run mostly by
students, which don't care about such things. Important thing
is, that their simulation programs (running on the cluster in
one of the private networks) do their job. And on the data hub
they can install their own deamons for data selection and
proxying. A security nightmare, those programs won't be checked
for exploits and similiar stuff. The problem is, that the data
hub also needs reasonably fast connection to the local backbone
(Münchner Wissenschaftsnetz), either to transfer the data to the
supercomputer in the LRZ, the group sometimes get computing time
on it, or to feed a grid.
You probably want a firewall that is not administered by the students.
You need to configure allowed and un-allowed services,
obviously, so why not do it in the iptables? You can do it by
user, by port, or by any other method iptables allows.
Tonight I figured, I could filter for programs pid, gid and
command line for outgoing packets. Then put a small helper
program around the daemon, that opens the firewall for the
programs that are started by it. Hmm, thinking about it, I could
also ptrace for bind and open the ports in the iptable on demand
(think about protocols, that are as brain dead like FTP...).
You really can't do it by port?
DS
.
- References:
- restrict implicit binding to interfaces
- From: Wolfgang Draxinger
- Re: restrict implicit binding to interfaces
- From: David Schwartz
- Re: restrict implicit binding to addresses
- From: Wolfgang Draxinger
- Re: restrict implicit binding to addresses
- From: David Schwartz
- Re: restrict implicit binding to addresses
- From: Wolfgang Draxinger
- restrict implicit binding to interfaces
- Prev by Date: Re: how can I modify the network packet payload?
- Next by Date: Re: restrict implicit binding to interfaces
- Previous by thread: Re: restrict implicit binding to addresses
- Next by thread: Re: restrict implicit binding to interfaces
- Index(es):
Relevant Pages
|
