Security Basics mailing list archives
Re: Sharing internet through Citrix (or better solution) in isolated network?
From: Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>
Date: Mon, 5 Nov 2007 17:46:42 +0100
On 2007-11-05 Hamid . K wrote:
I`m preparing solution for providing internet-access to internal users . What I`m looking for is a solution that completely isolate internet usage and internal systems.
If you want complete isolation of internet from intranet access you need separate computers on a separate network running over separate network hardware.
I`m thinking about publishing internet through Citrix based solution, and keep everything restricted on citrix server/sessions. But I though there must be better solutions ,as using Citrix p.server for such case have it`s own security risks , some of them hard to skip ! The good point about terminal based solution IMO is keeping user workstation clean and (almost) isolated, as it will act like a sandbox for running browser . Any comments?
This scenario is known as a "graphical firewall". It's common practice for allowing internet access from the workplace while keeping it in an isolated environment. It's reasonably secure as long as you keep the terminal server locked down (i.e. terminal server in a DMZ, no shared files/printers between terminal server and LAN hosts, etc.)
As always , open-source solutions (if any) are more welcome :)
VNC would be another option for building a graphical firewall, but it's heavier on the resources than a Citrix (or Windows) terminal server. Regards Ansgar Wiechers -- "All vulnerabilities deserve a public fear period prior to patches becoming available." --Jason Coombs on Bugtraq
Current thread:
- Sharing internet through Citrix (or better solution) in isolated network? Hamid . K (Nov 05)
- Re: Sharing internet through Citrix (or better solution) in isolated network? Ali, Saqib (Nov 05)
- Re: Sharing internet through Citrix (or better solution) in isolated network? infolookup (Nov 06)
- RE: Sharing internet through Citrix (or better solution) in isolated network? TVB NOC (Nov 05)
- RE: Sharing internet through Citrix (or better solution) in isolated network? Сергей Цапок (Nov 05)
- Re: Sharing internet through Citrix (or better solution) in isolated network? Ansgar -59cobalt- Wiechers (Nov 05)
- RE: Sharing internet through Citrix (or better solution) in isolated network? Craig Wright (Nov 07)
- RE: Sharing internet through Citrix (or better solution) in isolated network? Mohamed Farid (Nov 13)
- <Possible follow-ups>
- re: Sharing internet through Citrix (or better solution) in isolated network? Hamid . K (Nov 08)
- re: Sharing internet through Citrix (or better solution) in isolated network? Hamid . K (Nov 08)
- RE: Sharing internet through Citrix (or better solution) in isolated network? Nhon Yeung (Nov 08)
- Re: Sharing internet through Citrix (or better solution) in isolated network? Ali, Saqib (Nov 05)