+ From: Colin Campbell <sgcccdc @
citec .
qld .
gov .
au>
+ Subject: Re: Remote management of firewalls internationally
+ To: firewalls @
GreatCircle .
COM
+ Date: Wed, 2 Jul 1997 12:31:48 +1000 (EST)
+
+ Hi,
+
+ Lots of solutions offered which work fine when the machine
+ is up. What happens if it crashes and won't go past a point
+ where networking is not enabled?
+
Or, if you can't change configuration without taking it down to 'single user'?
A solution:
This takes -two- firewall machines, and a 'secure server' behind each one.
you run a secure, encrypted, channel from the management location to either
'secure server', as needed. The 'secure server' connects, via _serial_ port,
to the *other* firewall box's console port.
Voila! you've got a 'trusted path' to the console port, that does _not_ go
through the firewall.
Obviously, this solution is _NOT_ inexpensive -- but it *does* allow for
'unmanned' remote operation, at least for all but "very basic" hardware-
related problems (e.g., "blown fuse").
A less expensive solution is to have someone _local_, _who_speaks_the_same_
_language_ (*fluently*!) as support -staff-, who can be called on to play
"voice actuated terminal", for those occasions where 'secure remote access
_through_ the box' fails. This person merely needs the ability to follow
directions _precisely_, and observe and report *accurately*. The risk here
is mostly an added exposure to a 'social engineering' attack.
Follow-Ups:
|
|
