Linux-kernel mailing list archive 1998-31,: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

# Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Brandon S. Allbery KF8NH (allbery@kf8nh.apk.net)
Tue, 04 Aug 1998 21:41:59 -0300

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Matthew D. Pitts: "Re: gcc 2.7.2.3 vs gcc 2.8.1"
- Previous message: Michael H. Warfield: "Re: gcc 2.7.2.3 vs gcc 2.8.1"
- Maybe in reply to: Zachary Amsden: "[PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Next in thread: David S. Miller: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"

In message <Pine.LNX.3.96dg4.980804181150.28083w-100000@twinlark.arctic.org>
, D
ean Gaudet writes:
+-----
| On Tue, 4 Aug 1998, Brandon S. Allbery KF8NH wrote:
| > Because it's a deliberate tradeoff: it allows you to provide limited
| > Internet access from inside the firewall without opening everything up ---
| > important when "everything" includes commercial database servers of unknown
|
| > security [...]
|
| Explain to me how a firewall is protecting your database, to which you
| have no source, from buffer overflow attacks. I missed that part.
+--->8

I'm assuming the Linux box we're discussing is a firewalling router. If
it's an internal machine, the packet filter is too little too late.

I see the packet filter (which you've been calling a "firewall", which it is
only minimally) as being best placed at the border between your internal
network and the outside world. Once they get inside that, you can
packet-filter individual machines but you'll have to do a lot more work to
secure those hosts from other internal hosts which might be vulnerable to
outside attack (WinXX hosts, network printers, etc.). It'll take more than
just a packet filter to help you there: it's nearly worthless.

(That said, I'm using it as such on some ECE cluster machines --- but only
because we can't use a firewalling router, we need to allow pretty much
unrestricted outside access to large parts of the network. But I can do
everything in my power to keep the script-kiddies out of the cluster.)

The packet filter on the internal host is a last-ditch blockade and possibly
a backup for the *real* forewall. It's not something I would want to count
on to secure my entire network.

Running without a firewall is generally a bad idea... but may be inescapable
for various reasons (see parenthetical above). If so, just about anything
goes --- but realistically, the battle has pretty much been lost already
unless you packet-filter to prevent *all* incoming connections (like I run
the machine I dial up from --- backed up by running no servers :-)

    --
    brandon s. allbery	[os/2][linux][solaris][japh]	 allbery@kf8nh.apk.net
    system administrator	     [WAY too many hats]	   allbery@ece.cmu.edu
    electrical and computer engineering
    carnegie mellon university			   (bsa@kf8nh is still valid.)

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Matthew D. Pitts: "Re: gcc 2.7.2.3 vs gcc 2.8.1"
- Previous message: Michael H. Warfield: "Re: gcc 2.7.2.3 vs gcc 2.8.1"
- Maybe in reply to: Zachary Amsden: "[PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Next in thread: David S. Miller: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"