> > > Firewalling should be implemented on the hosts, perhaps with
> > > centralized
> > > policy management. In such a situation, there would be no
> > > reason to filter
> > > on funny IP options.
> > That's madness. If you have to implement your firewalling
> > on every host,
> > what do you do when someone wants to run a new OS? Forbid it?
> No a standard management interface would be followed by every host. Not
> unlike configuring your ipaddress with DHCP.
How does a standard interface help?
Perhaps you don't understand the problem -- someone wants to use a new
operating system that you no information about. You are willing to let it
run on your network if and only if you can be assured it won't violate your
firewall policy.
So how does an interface guarantee that an unknown implementation of that
interface will correctly implement it? And what about printers? Embedded
systems? Legacy equipment? What about systems that have to run software that
isn't as trusted as the implementation of the firewalls has to be?
The net effect of having to trust every host to enforce your security
policy is that you can't give anyone not trusted to enforce your security
policy root access on any machine on your network. Or, to put it another
way, you have to trust every machine on your network and every person who
controls them as much as you trust your firewall. That's simply unacceptable
in many applications.
DS
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/