Henry Hollenberg wrote:
>
> A debate has arisen regarding using loadable modules for a linux based
> firewall system and I'm trying to sort thru the issues involved.
>
> I thought I had read somewhere perhaps here that if at all possible
> loadable modules should be avoided on a firewall system....ie everything
> needed by the kernel and only what is needed should be compiled in.
>
> But now I've run into strong opinion that the kernel should use loadable
> modules.
>
> Am I off base to insist on _not_ using loadable modules.
>
> I'd be intrested in any experience anyone could share.
>
> Thanks
>
Personally, I go with the "minimum no modules" approach. for two
reasons: Speed and Security.
Speed:
The leaner the kernel is as far as the firewall is concerned, the
quicker it is able to handle packet forwarding/etc.
Security:
Having module support on a firewall machine invites the possibility
that one of the modules can be compromised through a trojan. A
compromised module that is loaded on the next reboot would make the
firewall useless. It would not be hard to write a trojan module that
hooks onto the real one (or even replace the real one).
In some environments, the "compromise/risk" may come from either side of
the firewall network connection.
[I go for the no modules, physically take out floppy drive, set boot to
HDD only, password cmos {if possible}, etc... approach]
--
---
Sami Yousif
mailto:syousif @
iname .
com
mailto:syousif @
swbell .
net
http://www.mav.net/teddyr/syousif
http://teddyr.home.ml.org
ftp://teddyr.dyn.ml.org
[eMail sent to any of my addresses is subject to the Conditions outlined
in http://www.mav.net/teddyr/emailtos.shtml]
[Note: I no longer support ARNet as an ISP nor WTAMU as an educational
institution nor LEK as a Computer Supplier.
http://www.mav.net/teddyr/access]
[heard somewhere: "You have the right to remain clueless. Anything you
know may be used against you in a court of law"]
Another day, so many more LARTS to go. [BOFH, BUFH]
<time is on my side>
Follow-Ups:
References:
|
|
