On Mon, 27.10.08 17:04, seth vidal (skvidal@xxxxxxxxxxxxxxxxx) wrote:
>
> On Mon, 2008-10-27 at 21:49 +0100, Lennart Poettering wrote:
> > > Disabling firewalls on individual systems be they desktops or servers is
> > > a BAD idea. Full stop.
> >
> > That is nonsense.
> >
> > Firewalls on a desktop make no sense, and David is right is that it is
> > a relic and not much more. It's paranoia at best to keep this
> > installed by default.
>
>
> I don't know what kind of desktops you're referring to but desktops are
> the soft-squishy inside that gets large corporate networks in deep
> trouble when there is an border fw breach. This is why it is important
> to have a multi-layered security policy/infrastructure.
> 1. border fw
> 2. host-based fw - including desktops
> 3. deny-all policies at the system level
> 4. well-audited apps that are runnable
> 5. restrictive policies on what can be run at all.
>
> If you want to argue that enhancing the firewall technology that we are
> currently using to allow a more nuanced user-interaction other than 'on'
> or 'off' that's fine by me - but relying on selinux to solve all
> network-border issues seems like the wrong tool for the job.
You're missing the point. It makes no sense to split items 2-5. If a
user wants to run an application then he will sit down and reconfigure
all the firewalls he has control over until things work for him. (If he is not
capable of that then he will file a bug and cry). And hence, having
those four levels of defense is just pointless. A user will circumvent
that anyway if he wants to run his app. The firewall hence simply
works as an annoying extra step. It's like a message box asking you:
"Hey, you just started application 'foo'. Are you really sure you
want to do that? I mean *really*?"
And if the users says "yes", then it will show another box:
"I don't believe you, but I will allow you to do it if you solve
the following difficult math problem!"
Having desktop firewalls is security theatre. Having 20 levels of
false and inappropriate security is worse then having a single level
of security that is appropriate for the task.
Lennart
--
Lennart Poettering Red Hat, Inc.
lennart [at] poettering [dot] net ICQ# 11060553
http://0pointer.net/lennart/ GnuPG 0x1A015CC4
--
Fedora-desktop-list mailing list
Fedora-desktop-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-desktop-list
