Again, I
don't think I'm getting my point across - I am *NOT* letting DMZ map drives into my network - nothing in the
DMZ can access anything in my internal network. I can't map drives, I
can't ping, I can't telnet, nothing at all. What I have open in the DMZ
that I can reach from my LAN is there for the very reason you're trying to
educate me in - because it's stuff needed from both the LAN and the WAN.
But I can't take any of the machines in the DMZ and reach my LAN. It's
like saying my whole network is compromised because my users on the LAN can hit
a webserver on the WAN. That doesn't mean that webserver on the WAN can
hit anything in my LAN.
I never
said the DMZ has full access (or even any) into my LAN. It's all one way
traffic.
How is
this any different than had I had rules prohibiting my LAN from touching the
DMZ? The access from the web to the DMZ would be the same, and from the
DMZ to anywhere would still be the same.
John
-----Original Message-----
From: John Tolmachoff
[mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June
18, 2002 12:39 PM
To: [EMAIL PROTECTED]
Subject: RE: [SonicWALL]-
[SonicWall] backup the DMZ
I
understand what you are saying, but there is a basic premise here:
A
DMZ is like a no mans land, not to be trusted. Only have out there what is
needed.
Think
of it this way, where did the name come from, War. It is an untrusted zone, to
be treated with questions and suspicions.
Yes,
you may let only those things necessary into the DMZ from the Internet. But you
would not let those into your network, correct?
The
connection from the LAN to and from the DMZ is supposed to be hardened and more
secure than that of the Internet to and from the DMZ. What you are purposing is
the opposite, trusting that the security from the Internet into the DMZ is
strong enough.
I am
sorry, I do not buy that. I am going to allow a certain amount of traffic into
the DMZ. I am going to further restrict and lessen that into the LAN.
Another
analogy if I may:
The
Internet is like a 50 lane supper highway with bikers, trucks, vans, busses,
cars, fire, police etc. You do not want all that coming into your house,
correct? Well, there are off ramps and streets. A DMZ is like your
neighborhood. Quite, not a lot of traffic. (In theory anyways.) So, you have
cut down on most of the traffic. But you still do not want all those people
coming into your house. So you have a door with a lock. And you look to see who
is there before opening the door.
Remember,
security is not supposed to be convenient. The easier you make it to do
something yourself, the easier it is for someone else.
John
Tolmachoff
IT
Manager, Network Engineer
RelianceSoft,
Inc.
Fullerton, CA 92835
www.reliancesoft.com
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf
Of [EMAIL PROTECTED]
Sent: Tuesday, June
18, 2002 9:49 AM
To: [EMAIL PROTECTED]
Subject: RE: [SonicWALL]-
[SonicWall] backup the DMZ
Again,
my point being, if the protocols required to be able to do any of that don't
work from the LAN, what is the issue? That's the whole point of a
firewall - to block things you want blocked. I can't sit outside of my
network and do any of the things I can do from the LAN to the DMZ - it's all
disabled that way... I know that shares are frequent targets - but if a
firewall isn't capable of doing this, why do we even purchase them? Why
wouldn't we just never have a public server?
Just
because something works from the LAN to the DMZ doesn't equate to the fact that
it works from the WAN to the DMZ - that's the whole point of setting up rules
and securing the firewall, isn't it?
J
-----Original Message-----
From: John Tolmachoff
[mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June
18, 2002 10:19 AM
To: [EMAIL PROTECTED]
Subject: RE: [SonicWALL]-
[SonicWall] backup the DMZ
http://www.blackhat.com/presentations/win-usa-01/Shultz-LeBlanc/w2k-01-shultz-leblanc-Foiling-JD.ppt
http://searchwin2000.techtarget.com/searchWin2000/downloads/Implementing_a_Secure_ISA_Server.ppt
http://www.xinetica.com/tech_explained/general/hacking_dmz/wp_hacking_dmz.htm
http://www.lbl.gov/ICSD/Security/guidelines/iis-server.html
If
was as easy and secure as mapping drives from internal to DMZ, don't you think
everyone would be doing that?
Mapped
drives require shares. Shares are easy and frequent targets. (I am sure you are
not mapping to default $.) A mapped drive, if I am not mistaken, is an always
available connection. That would seem to be inviting a hack.
If
it so easy for you to set it up, that translates into easy for someone else to
do the same, is it not?
Of
course, I could be way off base, being that I am still green, having only been
in Networking for about 1 � years now.
I am
sure someone else can clear the air.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf
Of [EMAIL PROTECTED]
Sent: Tuesday, June 18, 2002 7:56
AM
To: [EMAIL PROTECTED]
Subject: RE: [SonicWALL]-
[SonicWall] backup the DMZ
Maybe I'm
missing something - not sure how it'd be "asking for trouble".
Netbios
is enabled from LAN to DMZ. Disabled everywhere else. Default rules
from WAN are disallow, only a few services opened up in rules.
Machines
in DMZ can't map drives back out to LAN, only from LAN can map a drive.
Machines in DMZ are standalone servers, not part of the domain, no accounts
anywhere even close to any accounts on the domain in the LAN. Passwords
are all 15 character randomly generated alpha numeric with other printable
characters thrown in.
Don't
need an LMHOSTS file because I've got static entries in my WINS servers for
machine names / IP's in the DMZ that the LAN clients leverage for name lookups
to the external addresses.
If I'm
missing something obvious, please point out the trees for the forest to me. J
J
-----Original Message-----
From: John Tolmachoff
[mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June 18, 2002 9:37
AM
To: [EMAIL PROTECTED]
Subject: RE: [SonicWALL]-
[SonicWall] backup the DMZ
NetBIOS
enabled in the DMZ? Is that asking for trouble?
Why
not use a LMHOSTS file instead?
John
Tolmachoff
IT
Manager, Network Engineer
RelianceSoft,
Inc.
Fullerton,
CA 92835
www.reliancesoft.com
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf
Of [EMAIL PROTECTED]
Sent: Tuesday, June 18, 2002 7:23
AM
To: [EMAIL PROTECTED]
Subject: RE: [SonicWALL]-
[SonicWall] backup the DMZ
Just
thought I'd update this - using Veritas Backup Exec 8.5, I am able to go from a
machine internally on the LAN to a machine in the DMZ. I have static
entries in my WINS database for my DMZ machines with their public IP's so the
internal clients can get at them via name, and the netbios enabled from LAN to
DMZ.
J
-----Original Message-----
From: Jason Alba
[mailto:[EMAIL PROTECTED]]
Sent: Monday, June 10, 2002 4:10
PM
To: [EMAIL PROTECTED]
Subject: [SonicWALL]- [SonicWall]
backup the DMZ
Is anyone backing up a server on the
DMZ through the firewall on the LAN? How?
Jason Alba
IT Manager
tel: 208.232.8599 x323
fax: 208.232.6068
http://www.varsitycontractors.com
