Re: worm + VPN + firewall

[Bennett Todd <bet () rahul net>]

2003-08-18T07:11:43 Paul Robertson:
> Let's face it- VPNs should be more restricted than internal users
> for most, if not all implementations.

When using VPNs for remote access, the above statement is certainly
dead on target.

I think VPNs are a very poor choice for remote access, as is direct
unencrypted ppp dialin. Anything extending IP connectivity from the
company net to users' home systems is fraught. Remote access is best
delivered via thin clients; ssh (configured to block all
forwarding) for people who work shell, web portals for the rest, all
with suitable token auth (SecurID or Opie have worked well for me).

VPNs on the other hand are often a reasonable choice as an
alternative to a leased line for branch offices; in that context,
firewalling the VPN termination is no more or less appropriate than
any other balkanizing of the internal net.

-Bennett

Attachment: _bin
Description: