In some mail from Ben, sie said:
[...]
> > remain relatively secure. However, I am I'm not saying that adding
> > firewalling capabilities would make the system invincible. I *am*
> > saying that it would provide the system with more security than it
> > currently has and would help to reduce (not eliminate) some risks
> > associated with networking.
>
> But what does it mean to add 'firewalling capabilities' to an O/S? By
> definition, a firewall is supposed to stop the spread of 'fire' by being
> the sole mechanism for the interchange of packets.
>
> If you're referring to making a hardened OS that can protect itself
> through the use of well written code, memory protections, etc. then, yes
> by all means add it to your OS, but these shouldn't be luxuries in that
> they're thought of as 'firewalling' features. Rather these things should
> be compulsory in the development of OS's.
[...]
IPSEC will be interesting for firewalls...
For one, proxy application services are going to "get in the way" of IP
level authentication, assuming this is permitted.
But, I don't see IPSEC doing away with firewalls.
For one thing, the firewall provides a mechanism for defining a network
perimter that is more tanglible than "that side of the router is in our
network, the wire on the other is out". This mechanism also allows you
to more easily determine who and/or what can use your network from the
other side. Without the firewall, you're forced to implement (and make
some assurance about the implementation) policy on every machine that is
accessible from the Internet. I'm not justifying the "squishy centre"
here, but the firewall gives you more breathing room when considering the
outside world as the source of criminal activity.
For example, IPSEC won't help you if you've got "+" in /etc/hosts.equiv
or similar.
IPSEC does, however, reduce the risk of IP spoofing, TCP connection
hijacking and boosts the strength of host based authentication.
darren
|
|
