Tag Info

Hot answers tagged

69

You basically have three options here. Disconnect your office/users from the internet If they can't get to "the public cloud," they can't upload anything to it. Compile a blacklist of specific services you're worried about users accessing. This is going to be absolutely massive if it's meant to be even remotely effective. Tech-savvy users will always ...


28

There is no way to block it completely, of course, unless the corporate network were to be disconnected from the Internet. If you really want something that should work most of the time while being mostly transparent, you'll need to deep-sniff packets. Set up a man-in-the-middle SSL/TLS proxy, as well as one for unencrypted communication, and block all ...


23

What HopelessN00b said. I just wanted to add that: I have a friend with a job at a government agency where she isn't allowed to bring a cellphone with a camera to the office. She usually phrases that as, "I'm not allowed to own a cellphone with a camera," because, well. If she can't take her cell with her, why own one? She has trouble finding cellphones ...


19

Actually, there is a simple solution provided you don't also expect your internal network to be exposed to the Internet at the same time. Your PCs simply need to be completely blocked from accessing the Internet. All USB ports blocked, etc. To get on the Internet, people then need to either use a different computer - connected to a different network - or ...


18

Cisco firewall or not, if I cross-connected two corporate networks without the knowledge and explicit permission of the network owners, I'd be in seriously hot water. So what you need to do is to get those parties involved. If it's going across their networks, then they need to talk: Step 1. Establish the owners of both said corporate networks. I mean, ...


11

There are many schools of thought when it comes to system level firewalling. One conservative approach that is often seen is to use connection tracking to match and explicitly accept incoming RELATED or ESTABLISHED traffic. All other incoming traffic is dropped by default. Explicit rules are added as necessary for various services to accept unmatched ...


11

First give a -p option like -p tcp or -p udp. Examples: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j DROP iptables -A INPUT -p udp --dport 53 --sport 1024:65535 -j ACCEPT You could also try -p all but I've never done that and don't find too much support for it in the examples.


11

You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN. Cisco's IP phones can be set up to use a VPN, and someone even put together a handy doc around common issues with this setup that you might want to take a look at.


10

Yes, of course. The job of a monitoring system is to ensure that the business requirements are currently being met by the IT infrastructure, whatever those requirements are. My gut feeling is that there's no easy limit (well, 65535) to the number of ports you're monitoring to ensure that they don't suddenly become open, and that the best way to achieve ...


10

First of all, as an escapee from academia, you have my sincere condolences. Unlike the commenters above, I have no trouble whatsoever believing you have no campus firewall. The simplest, most elegant way to do this would be, alas, to have a campus firewall. The next best solution, depending on whom you want to have access to your lab, would be to have ...


9

I wouldn't trust that machine anymore, and would reinstall and probably scan for rootkits (some rootkits even survive formatting of a drive). If you care about security, my personal advice would be to restart fresh.


9

Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an authenticated service (Hopeless N00b.*'s answer), so you're stuck with stock TFTP. RFC 1350 makes it fairly clear, in section 1, that authentication is not an ...


8

i have setup networking using virtual switch on one of the NIC 10.0.0.20. i a have assigned a static ip to Ubuntu 10.0.0.20 VM same as the IP of the Virtual switch. So… you've assigned the same IP to two different devices on the network and you still expected it to work? That dog won't hunt, son.


7

Protocol (-p) is required if you use --dport. Example: -p tcp


7

Danger! Please please do not just turn off your firewall here and think it's a solution. You were on the right track, except you turned a debugging step into a solution. What should we do instead? How do I truly fix this? Well you were right that you were only accepting everything from the lo interface. So we just need to allow this port to be accessed ...


7

The reason for preferring an ASA (or something) over the windows firewall is extremely unclear in this case. The appropriate thing to do is to assess whether there is any reason that data should not flow from the node on one side of the (crossover) cable to the node on the other. The answer is a continuum somewhere between two extremes: Neither computer ...


7

Put simply, the local firewall on your machine acts as a gatekeeper for actual traffic that will be passing through your operating system's network stack. So, it'd go as such: Software -> Network Stack (In/Out) -> Firewall -> Network It does not prevent port bindings as the kernel handles this. It will however prevent traffic on the port(s) if configured ...


7

I don't know about 'gen2' vs 'gen3', but what I can tell you is this: SPI firewalls filter on Session 'States' This firewall keeps track of the State of a TCP or UDP session. This provides an advantage over simpler firewalls for example If a malicious user were snooping the traffic between two nodes, he could send traffic to node A with the spoofed IP ...


6

Your best solution is to have your customers move to a firewall solution they can manage to allow access to your services. Failing that, your next best option is to serve up your services on well-known ports that you can expect to be allowed access through virtually every firewall, which is http/https (80/443). (Yippie, IIS.) As pointed out in the ...


6

The risks you're taking should covered by the service level agreement you have with that major cloud server company. Are you getting "a managed firewall" with certain capabilities, where a model is an indication of those capabilities and depending on the SLA the service provider is responsible for the configuration, maintenance and life cycle management? ...


6

You can limit the IP addresses permitted through the ESXi firewall. http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vcli.examples.doc_50%2Fcli_manage_networks.11.11.html That is really all you need to harden it. Locking your management down to specific IP addresses is very secure. Naturally follow the other best practices re passwords etc ...


6

We've already detected spear-fish emails sent to people high in the organisation. Is there a way to defend against these attacks short of creating an air gap between the network these documents are on and the internet? Spear-phishing suggests to me that you need to focus on defending your PCs from their users, which unfortunately is not a technical ...


5

The difference is the amount of bits that are masked. The number after the slash is CIDR notation and represents a mask address which, combined with the address before the slash, is used to represent a range of addresses. the "/32" will mask all 32 bits of the address effectively meaning a range of 1 single IP address , eg. 282.72.129.206 -> 282.72.129.206 ...


5

You can use the ssh ProxyCommand functionality for this. Assume serverA is your jump host, and serverB is the ultimate server you want to connect to. Add the following to your ~/.ssh/config file: Host serverB Hostname serverB.example.com User jimbob ProxyCommand ssh serverA.example.com nc %h %p 2> /dev/null Then from your workstation, just ...


5

Yes, sort of, you have to save the current ruleset service iptables save This will write to the file /etc/sysconfig/iptables.


5

You know that old joke that, if you and a halfling are chased by an angry dragon, you don't have to run quicker than the dragon, you only have to be quicker than the halfling? Assuming non-malicious users*, you don't have to restrict their access to the public cloud, it is enough to make the usability of the public cloud lower than the usability of whatever ...


5

To follow up on what @KatherineVillyard said, if you need to access your NAS or other systems from the campus in general, here's what I'd do: Campus connections Talk to whoever manages the campus router, and ask them to reserve you a block of 256 IP addresses, which I'll call A.B.C.0/24. The values of A, B, and C are specific to your campus. If you can't ...


5

You don't block "LAN Address", you need to block "LAN Subnet". Do the following: Add a rule as the first rule: PASS, 172.16.1.1 -> ANY Add a rule as the second rule: DENY, LAN subnet -> ANY


5

There are (for all practical purposes) two different layers in play with what you're asking. An app asking for a port binding is at a different level than where the firewall operates. An app will talk directly to the TCP/IP stack to get a binding. That happens completely independently of any firewall, regardless of if the firewall is local to the app host ...


5

First one has to ask whether the packet actually originated from your host in the first place. Source IP spoofing happens all the time, and without context that log entry says nothing about the authenticity of the source IP. Next question is if you are running a DNS server on that host. If there is no DNS server on that host, then the packet they logged is ...



Only top voted, non community-wiki answers of a minimum length are eligible