Again,
I don't think I'm getting my point across - I am *NOT* letting DMZ map drives into my
network - nothing in the DMZ can access anything in my internal
network. I can't map drives, I can't ping, I can't telnet, nothing at
all. What I have open in the DMZ that I can reach from my LAN is there
for the very reason you're trying to educate me in - because it's stuff
needed from both the LAN and the WAN. But I can't take any of the
machines in the DMZ and reach my LAN. It's like saying my whole
network is compromised because my users on the LAN can hit a webserver on
the WAN. That doesn't mean that webserver on the WAN can hit anything
in my LAN.
I
never said the DMZ has full access (or even any) into my LAN. It's all
one way traffic.
How is
this any different than had I had rules prohibiting my LAN from touching the
DMZ? The access from the web to the DMZ would be the same, and from
the DMZ to anywhere would still be the same.
John
-----Original
Message-----
From: John
Tolmachoff [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June 18, 2002 12:39
PM
To:
[EMAIL PROTECTED]
Subject: RE: [SonicWALL]- [SonicWall]
backup the DMZ
I
understand what you are saying, but there is a basic premise
here:
A
DMZ is like a no mans land, not to be trusted. Only have out there what is
needed.
Think of it this
way, where did the name come from, War. It is an untrusted zone, to be
treated with questions and suspicions.
Yes,
you may let only those things necessary into the DMZ from the Internet. But
you would not let those into your network, correct?
The
connection from the LAN to and from the DMZ is supposed to be hardened and
more secure than that of the Internet to and from the DMZ. What you are
purposing is the opposite, trusting that the security from the Internet into
the DMZ is strong enough.
I am
sorry, I do not buy that. I am going to allow a certain amount of traffic
into the DMZ. I am going to further restrict and lessen that into the
LAN.
Another analogy
if I may:
The
Internet is like a 50 lane supper highway with bikers, trucks, vans, busses,
cars, fire, police etc. You do not want all that coming into your house,
correct? Well, there are off ramps and streets. A DMZ is like your
neighborhood. Quite, not a lot of traffic. (In theory anyways.) So, you have
cut down on most of the traffic. But you still do not want all those people
coming into your house. So you have a door with a lock. And you look to see
who is there before opening the door.
Remember,
security is not supposed to be convenient. The easier you make it to do
something yourself, the easier it is for someone else.
John
Tolmachoff
IT
Manager, Network Engineer
RelianceSoft,
Inc.
Fullerton,
CA 92835
www.reliancesoft.com
-----Original
Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
[EMAIL PROTECTED]
Sent: Tuesday, June 18, 2002 9:49
AM
To:
[EMAIL PROTECTED]
Subject: RE: [SonicWALL]- [SonicWall]
backup the DMZ
Again,
my point being, if the protocols required to be able to do any of that don't
work from the LAN, what is the issue? That's the whole point of a
firewall - to block things you want blocked. I can't sit outside of my
network and do any of the things I can do from the LAN to the DMZ - it's all
disabled that way... I know that shares are frequent targets - but if a
firewall isn't capable of doing this, why do we even purchase them?
Why wouldn't we just never have a public server?
Just
because something works from the LAN to the DMZ doesn't equate to the fact
that it works from the WAN to the DMZ - that's the whole point of setting up
rules and securing the firewall, isn't it?
J
-----Original
Message-----
From: John
Tolmachoff [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June 18, 2002 10:19
AM
To:
[EMAIL PROTECTED]
Subject: RE: [SonicWALL]- [SonicWall]
backup the DMZ
http://www.blackhat.com/presentations/win-usa-01/Shultz-LeBlanc/w2k-01-shultz-leblanc-Foiling-JD.ppt
http://searchwin2000.techtarget.com/searchWin2000/downloads/Implementing_a_Secure_ISA_Server.ppt
http://www.xinetica.com/tech_explained/general/hacking_dmz/wp_hacking_dmz.htm
http://www.lbl.gov/ICSD/Security/guidelines/iis-server.html
If
was as easy and secure as mapping drives from internal to DMZ, don't you
think everyone would be doing that?
Mapped drives
require shares. Shares are easy and frequent targets. (I am sure you are not
mapping to default $.) A mapped drive, if I am not mistaken, is an always
available connection. That would seem to be inviting a
hack.
If
it so easy for you to set it up, that translates into easy for someone else
to do the same, is it not?
Of
course, I could be way off base, being that I am still green, having only
been in Networking for about 1 � years now.
I am
sure someone else can clear the air.
-----Original
Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
[EMAIL PROTECTED]
Sent: Tuesday, June 18, 2002 7:56
AM
To:
[EMAIL PROTECTED]
Subject: RE: [SonicWALL]- [SonicWall]
backup the DMZ
Maybe
I'm missing something - not sure how it'd be "asking for
trouble".
Netbios is enabled
from LAN to DMZ. Disabled everywhere else. Default rules from
WAN are disallow, only a few services opened up in rules.
Machines in DMZ
can't map drives back out to LAN, only from LAN can map a drive.
Machines in DMZ are standalone servers, not part of the domain, no accounts
anywhere even close to any accounts on the domain in the LAN.
Passwords are all 15 character randomly generated alpha numeric with other
printable characters thrown in.
Don't
need an LMHOSTS file because I've got static entries in my WINS servers for
machine names / IP's in the DMZ that the LAN clients leverage for name
lookups to the external addresses.
If I'm
missing something obvious, please point out the trees for the forest to me.
J
J
-----Original
Message-----
From: John
Tolmachoff [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June 18, 2002 9:37
AM
To:
[EMAIL PROTECTED]
Subject: RE: [SonicWALL]- [SonicWall]
backup the DMZ
NetBIOS enabled
in the DMZ? Is that asking for trouble?
Why
not use a LMHOSTS file instead?
John
Tolmachoff
IT
Manager, Network Engineer
RelianceSoft,
Inc.
Fullerton,
CA 92835
www.reliancesoft.com
-----Original
Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
[EMAIL PROTECTED]
Sent: Tuesday, June 18, 2002 7:23
AM
To:
[EMAIL PROTECTED]
Subject: RE: [SonicWALL]- [SonicWall]
backup the DMZ
Just
thought I'd update this - using Veritas Backup Exec 8.5, I am able to go
from a machine internally on the LAN to a machine in the DMZ. I have
static entries in my WINS database for my DMZ machines with their public
IP's so the internal clients can get at them via name, and the netbios
enabled from LAN to DMZ.
J
-----Original
Message-----
From: Jason
Alba [mailto:[EMAIL PROTECTED]]
Sent: Monday, June 10, 2002 4:10
PM
To:
[EMAIL PROTECTED]
Subject: [SonicWALL]- [SonicWall]
backup the DMZ
Is anyone backing up a server on
the DMZ through the firewall on the LAN? How?
Jason Alba
IT Manager
tel: 208.232.8599
x323
fax:
208.232.6068
http://www.varsitycontractors.com
