Re: X server in a Firewall

["R. DuFresne" <dufresne () sysinfo com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 24 Jan 2006, Chuck Swiger wrote:

> John M wrote:
> > On remote access:
> > > Web servers tend to increase the risk, as does any
> > > remote technology.
> >
> > OK. But what is your recommendation to a fortune 500
> > company? :)
> >
> > That is, if Coca-Cola wanted a unix based firewall and
> > _wanted manage it trough a graphical interface_, what
> > would you suggest? A X server running in a firewall
> > sounds bad, but a web server or ssh server could be
> > even worse (key logger on the management station or
> > buffer overflow in the ssh or web daemon and both run
> > as root, so to have permission to change the fw rules)
>
> In terms of their security history, OpenSSH isn't perfect, but comparing it to
> X11 is pretty amusing.  Which one would you rather audit for poorly written
> code, potentially exploitable buffer overflows, and other security vulnerabilities:
>
> 5-pi% cd /usr/ports/distfiles && ls -lh openssh-4.2p1.tar.gz xorg/X11R6*
> -rw-r--r--  1 root  wheel   893K Sep  1 02:30 openssh-4.2p1.tar.gz
> -rw-r--r--  1 root  wheel    31M Feb 25  2005 xorg/X11R6.8.2-src1.tar.gz
> -rw-r--r--  1 root  wheel   3.8M Feb 25  2005 xorg/X11R6.8.2-src2.tar.gz
> -rw-r--r--  1 root  wheel   9.9M Feb 25  2005 xorg/X11R6.8.2-src3.tar.gz


Still missing a good chuck of ssh in there, where's the openssl tarball? 
Granted not as large as the X tarballs, but, folks should never have the 
impression that ssh stands alone.  In fact there are a few more tarballs 
that should be in this mix, zlib, and likely a few crypto ones as well.

While still lopsided in code weight, not as lopsided as making the erros 
that ssh is a stand alone....

Thanks,

Ron DuFresne
- -- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

                -Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFD2pbSst+vzJSwZikRAmLEAKCyy+xfG6dXqyPc6eph78bn92GRzACeMsRc
xoyrUOzQagEzSdsU7C+sVoU=
=FvEb
-----END PGP SIGNATURE-----
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards