Unix Web servers and FireWall

Unix Web servers and Firewall PP 200 and P387 to 411 – Web Security by Lincoln D. Stein

Unix Server (..continue..) ,[object Object],[object Object]

Monitor the integrity of Systems Files and Binaries ,[object Object],[object Object],[object Object],.sys and .win

Back up the system ,[object Object],[object Object],Tar is a Unix command

Server Security Checklist (1) ,[object Object],[object Object],[object Object],[object Object],[object Object],From administrator’s viewpoint

Server Security Checklist (2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Summary on Unix Web servers ,[object Object],[object Object],[object Object],[object Object],Learnt last week

Web servers & Firewall - Overview ,[object Object],[object Object],[object Object],[object Object],[object Object],This week

Two firewalls with the Internet – restrict some incoming and outgoing traffic based on rules incoming traffic outgoing traffic

What is a firewall? - 長城 ( 防人牆 ) from http://ljq.free163.net/shgc/wlcc.htm block incoming traffic 山海関 port 80 allow traffic through port

Waterwall – prevent enemy, protect castle from edtech.floyd.edu / ~ lnewby/feudal_japan.htm

What is a firewall? ,[object Object],[object Object],[object Object]

The location of a firewall ,[object Object]

Two basic Firewall Systems ,[object Object],[object Object],[object Object]

Dual-home gateway firewall ,[object Object],[object Object],block

Screen-hosted gateway ,[object Object],[object Object],In fact, there is no effective difference between dual-home and screen-host

Notes about firewall ,[object Object],[object Object],[object Object]

Select a firewall system (1) ,[object Object],[object Object],[object Object]

Select a firewall system (2) ,[object Object],[object Object],[object Object]

Select a firewall system (3) ,[object Object],[object Object]

Products No need to memorise Available a a software-only package or as a turnkey combination. Gauntlet Packet filtering an stateful inspection for NT and Unix Firewall-1 Uses application and circuit level proxy and is available for NT and Unix machines Eagle Unix to support packet filtering, application and circuit-level. CyberGuard A Unix-only system for both application-level and packet-level BorderWare Uses a combination of packet filters, application level proxies and circuit-level AltaVista Feature Product

How to configure a firewall? ,[object Object],[object Object],[object Object],[object Object]

A simple example – packet filter – IE and FTP ,[object Object],important ftp - incoming ACK * * 21 * Allow ftp - outgoing * 21 * * [internal user] Allow ie- Incoming ACK * * 80 * Allow Browse outside (iexplorer – outgoing) * 80 * * [internal user] Allow Block all * * * * * Block Comment Flags Port Dest Port Src Action

Explanation ,[object Object],[object Object],[object Object],[object Object],[object Object]

Another simple example – block IE and allow FTP ,[object Object],important ftp - incoming ACK * * 21 * Allow ftp - outgoing * 21 * * [internal user] Allow Block all * * * * * Block Comment Flags Port Dest Port Src Action

Picture – Gopher protocol is blocked, the table is in the Proxy

A simple example – application level – outgoing, linux environment ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],No need to memorise , step by step, but have to understand

Explanation ,[object Object],[object Object],[object Object]

Incoming Web access ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Judas – combine Proxy and Web server ,[object Object],[object Object],[object Object],Not a good idea

The Sacrificial Lamb ,[object Object],[object Object],Access by outsiders

The Private Affair Server ,[object Object],[object Object],Filter all first

The Doubly Fortified Server ,[object Object]

Running a reverse Web proxy ,[object Object],[object Object],[object Object]

Flow of Information – Bastion (firewall) 1 2 3 4

Hybrid Server ,[object Object],[object Object]

Hybrid approach – Bastion (firewall here)

Summary ,[object Object],[object Object],[object Object],[object Object],[object Object]

Unix Web servers and FireWall

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (9)

Similaire à Unix Web servers and FireWall

Similaire à Unix Web servers and FireWall (20)

Plus de webhostingguy

Plus de webhostingguy (20)

Unix Web servers and FireWall