Subject: RE: primary purpose of firewalls

From: "Michel Py" <[email-masked]>
Date: Thu, 19 Jun 2003 20:58:36 -0700

Keith,

> Keith Moore wrote:
> I believe you should buy or write applications that ensure their
> own security and protect the security of the machines on which
> they are hosted. I believe you should buy computing platforms
> that provide facilities to isolate applications from one another,
> so that a single compromised application doesn't compromise your
> entire platform.

On this one half of the mailing list can read what's in the back of your
mind, that can be summarized in a few words: Windows is not a real OS.
Don't try to say that's not what you think, everyone would laugh.

Keith, we are building the Internet for everyone, including the innocent
users that access a web server across the world that happens to run IIS.
Even you think that the person that chose to implement IIS on top of w2k
is stupid because s/he had half a brain s/he would have chosen apache on
top of unix, that's not the user's problem and if there is something I
can do as the firewall guy to shield that IIS server, I will.

> read what I wrote again.

I did and I pasted it again:

> the reason I disagree is that fundamentally, there's no way
> that a firewall can reliably distinguish legitimate traffic
> from illegitimate traffic,

Yes there is a way as I just demonstrated; a firewall with up-to-date
code can reliably distinguish legitimate traffic from illegitimate
traffic the same way an anti-virus can reliably detect viruses. And if
Microsoft sucks as much as you say it is fortunate that it can, because
a web server compromised by a nasty worm is bad for the entire
community. As of myself, I try to do my part of keeping a clean
Internet, which is configuring firewalls in front of web servers,
instead of saying that people should buy web servers that can't be
hacked.

Michel.

---

From: Keith Moore <[email-masked]>
Date: Fri, 20 Jun 2003 00:25:32 -0400

> Don't try to say that's not what you think, everyone would laugh.

you know, I'm happy to say that I don't really know enough about Windows
internals (for any version of Windows) to know for sure whether it provides
those facilities or not.  my honest guess is that recent versions do provide
them, and that the reason Windows boxes are insecure is because of poor
application implementation more than poor OS implementation.  

still, pretending that a firewall can make up for a lack of security on the
host (ANY host) or in the apps is simply unrealistic, no matter who wrote the
host OS.  and nothing we do in IETF can change that.

> traffic the same way an anti-virus can reliably detect viruses.

no, you demonstrated that it can do so in some cases, but not with reliability
- which would mean that you have the ability to rely on the firewall doing the
right thing.  for instance, "doing the right thing" often means being able to 
know which applications are enabled on a host, and to decide whether an
application peer has valid credentials, etc.  and the firewall simply can't do
that.  the app has to protect itself.

> And if Microsoft sucks as much as you say it is fortunate that it can,
> because a web server compromised by a nasty worm is bad for the entire
> community. 

you're the one who brought up Microsoft.  if you can't understand things that
I actually did say, don't delude yourself into thinking you understand things
that you think I thought but didn't say.

Keith

---

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 19 Jun 2003 23:59:42 -0500

Thus spake "Keith Moore" <[email-masked]>
> application implementation more than poor OS implementation.

Perhaps.  Most "server" applications on any commercial OS run as the
superuser, which by its nature can't be contained in the event of a security
breach.  The obvious next question is, why do most daemons run as superuser,
and is there a way to either configure or rewrite portions of those daemons
such that they can run as containable "normal" users and still provide 100%
of the functionality?

I also wonder if such containment even has much use.  Generally any
sensitive information a hacker wants to capture or destroy will be stored
inside the containment area of the hacked application.  Containment only
protects one application from another on the same machine, while large
servers typically have one or more machines dedicated to each application;
in many cases containment will only protect the OS from damage while the
sensitive _data_ is freely captured or destroyed.

>  for instance, "doing the right thing" often means being able to

The biggest problem I've seen in Enterprise environments is that people
running Internet-accessible servers (e.g. in the DMZ) often have no interest
or motivation to follow security policy; security is secondary to
functionality.

US DoD defines a trusted system as any system which is capable of breaking
your security policy.  Placing trusted systems in the hands of people you
don't or can't trust (in the normal sense) is a recipe for disaster, IMHO.
If you don't trust the owner, you have no reason to trust the machine, and a
trusted firewall is the only place left to enforce security policies.

S

Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking

---

From: David Morris <[email-masked]>
Date: Sat, 21 Jun 2003 17:17:54 -0700 (PDT)

On Fri, 20 Jun 2003, Keith Moore wrote:

> host OS.

That statement is simply not true. Based on policies that reject inbound
connections to all computers except those carefully hardended and
sequestered an their own 'DMZ' will dramatically reduce the potential of
compromize from many risky applications ranging from TELNET on Solaris to
SMB on Windows.

More sophisticated firewalls examine data flow for viruses, and other
problematic code.

Securing networks and hosts requires a whole quiver of arrows. A competent
firewall is a significant set of arrows but can't solve the whole problem.
But it will makeup for many security flaws in the hosts and/or
applications. Potential problems can be reduced to almost 0 if careful
users avoid risky behaviors and live behind a solid firewall.

Sure there will be things they can't do, but there are a wealth of things
then can safely do thanks to the Internet accessed thru a firewall.

Dave Morris

---

From: S Woodside <[email-masked]>
Date: Sat, 21 Jun 2003 21:59:02 -0400

On Saturday, June 21, 2003, at 08:17  PM, David Morris wrote:

> Based on policies that reject inbound

It would be just as hard to traverse that firewall, then (for voice), 
as it would be to traverse a NAPT, no?

simon

--
www.simonwoodside.com -- 99% Devil, 1% Angel

---

From: David Morris <[email-masked]>
Date: Sat, 21 Jun 2003 20:49:03 -0700 (PDT)

> as it would be to traverse a NAPT, no?

In the case of the product I use, 'NAPT' is a default behavior, but
alternate configurations are possible including no NAT. Opening inbound
connections to arbitrary hosts is always a risk since there are many
reasons that one can't trust the security status of desktop machines for
at least some percentage of the user population. I'm certainly not ready
to allow connection to any application I know of from outside of my
firewall when I can't control the machine.

So I guess my short answer is I hope so.

Dave Morris

---

From: Keith Moore <[email-masked]>
Date: Sun, 22 Jun 2003 23:31:40 -0400

> > still, pretending that a firewall can make up for a lack of security on
> > the host (ANY host) or in the apps is simply unrealistic, no matter who
> > wrote the host OS.
> 

actually, it sounds like you're agreeing with me.  you're having the firewall
completely block traffic except to those hosts that you trust to provide
adequate security.  my only question would be whether there are threats behind
your firewall, e.g. any machine that runs windows and is used to read email.

> applications.

yes indeed.  my point is that it's still not good enough to make those hosts
secure.  and sometimes those sophisticated firewalls break protocol
interoperation even when they're trying to permit the traffic.

> Potential problems can be reduced to almost 0 if careful

all I can say is I'm glad I don't have to depend on you to secure my networks.

Keith