Thomas Charron said:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > Let's digress.... "Neither SSH nor VPN"? I wasn't aware that there
> > was a "VPN" protocol. If there is, please correct me and sent an
> > RFC reference and I will be more than happy to look at it as well
> > as admit my
> > ignorance. If not, and you mean Virtual Private Network in a
> > generic sense, then you would need to be more specific
>
> I think his point is, that riding unsecured data streams inside a
> secured transport, be it a secured stream or a secured virtual
> network, doesn't address the issues that exist with the initial
> unsecured stream. SSH or a VPN of any sort are examples of this.
Huh? Securing the system doesn't address securing the system? I haven't a
clue as to what you're saying here. I know FTP/HTTP/etc are unsecure.
However, riding them over a secure protocol/system is the equivelent of
building in the security. If no one can tap that secure stream (because it's
properly secured), why not run unsecure data in it? In fact, at the most
basic level, ALL security is about wrapping what you want to protect inside a
secure package. So yes, it does address the issues. It says take the
working, but unsecure system, and run it inside a security container. End
result - a working, secure system.
>
> > IPSec has the ability to
> > create an end-to-end encrypted tunnel using session keys, *AND*
> > encrypt the individual packets that are sent through that tunnel. I
> > will grant you that many people utilize "tunnel-mode" which does
> > exactly what you say, tunneling insecure protocols through a secure
> > tunnel. However, when you tunnel an insecure protocol inside of a
> > constant stream of garbage data that is encrypted using 2048 (or
> > 4096)-bit keys, you would have to first penetrate the stream. By
> > the time you do that, the session key has changed, and you have to
> > start over again. I would say that IPSEC is the most secure (and
> > probably the most complex) protocol out there, and there are
> > several sub-protocols that make it up (ESP, AH, SHA, etc.). Now, if
> > you are talking about PPTP, or an SSH-based VPN, then I would
> > agree.
>
> Yep, but now your talking at an environment level, and not an
> application level. An application cannot mandate it run under a
> secured environment.. :-)
OK, I see the smiley there. Yep, applications cannot and should not mandate how
they're run. That's the environment's responsibility, in accordance with rules set up
by the site. This is the underlying basis of most security - you DON'T trust the
apps, or the data. Layer the security, with the security pieces carefully separated &
checked. One good thing about this is that you don't need to check everything, only
the security pieces.
This is how capabilities, RSBAC, Type Enforcement, the Rainbow Series of security, etc
all run. Even IPSEC fundamentally tunnels the unsecure data through a secure IP layer.
jeff
-----------------------------------------------------------------------
Jeffry Smith Technical Sales Consultant Mission Critical Linux
[EMAIL PROTECTED] phone:603.930.9739 fax:978.446.9470
-----------------------------------------------------------------------
Thought for today: cruftsmanship /kruhfts'm*n-ship / n.
[from cruft]
The antithesis of craftsmanship.
**********************************************************
To unsubscribe from this list, send mail to
[EMAIL PROTECTED] with the following text in the
*body* (*not* the subject line) of the letter:
unsubscribe gnhlug
**********************************************************
