Subject: wu-ftpd/sockd topology question...

From: [email-masked] (Tom Lojewski)
Date: Thu, 02 Mar 1995 13:50:06 -0800 (PST)

Hello All,

I'm in the process of building an Internet firewall using a dual homed
SOCKS server.  My question is: Do you see any problem with using that
same host as the anonymous wu-ftpd server?  (Financially, this is the
most desirable.)  Or should I put the anon server on the inside
subnet?  Or the outside subnet?  Thanks is advace.

--------------------------------------------------------------------------
Tom Lojewski  -  ACUSON Corp  -  Mountain View, CA - ([email-masked])

---

From: [email-masked] (Russell Street)
Date: Wed, 8 Mar 1995 20:11:25 +1300 (NDT)

> subnet?  Or the outside subnet?  Thanks is advace.

"It depends on what you are trying to do" (famous last words of
firewalls, those)

One school of thought goes: If you are trying to protect your internal
network from the Internet, then it is a bad thing.  You should try to
aim to keep your firewall machine as clean as simple as possible.
Running complex programs like an FTPD or HHTPD directly on the machine
runs counter to that.  Putting the real archive somewhere on the
inside of your network and running a 'plug-gw' program that makes it
transparently accessable from the outside via your SOCKS host would be
the way to go.

If you can live with the (potential) risks of having the server on
your firewall machine then the two work happily together on the same
server.

We run our FTPD on our SOCKS server happily, and have firewalls made
with packet filtering routers.  We are also a University, so there is
as much danger from "inside" as there is from "outside" :-( :-(

Probably a bad idea to have the FTP machine outside your firewall.  

Read the Cheswick and Bellovin book (Internet Security: Repelling the
Wiley Hacker) and subscribe to the Firewalls mailing list would be a
good way to find out more about this.

Hope this is of some help...

Russell
-------------------------------------------
Russell Street [[email-masked]]
http://www.auckland.ac.nz/cc/People/RS.html
(.samtsirhC rof sdrawkcab gnipyT)

---

From: [email-masked] (Tom Lojewski)
Date: Wed, 08 Mar 1995 10:59:11 -0800 (PST)

Hi Russell,

Thanks for the reply to my posting.

> as much danger from "inside" as there is from "outside" :-( :-(

I think that's the way we'll go.  How do you handle UDP (specifically
DNS?) to the internet.  Do you have any experience with UDP relay?

> good way to find out more about this.

I have that book.  I'm in the process of trying to integrate ideas
from that book and about three other books I have.  Can you tell me
how to subscribe to the Firewalls mailing list?  Thanks for the help.

---

From: [email-masked] (Russell Street)
Date: Thu, 9 Mar 1995 13:02:24 +1300 (NDT)

> DNS?) to the internet.  Do you have any experience with UDP relay?

We just let general UDP straight out.  Alas, we only use the SOCKS
server for accounting purposes on our central UNIX system.  The PCs
are allowed straight out.

Specifically for DNS we let it straight out (and in). We have the PCs
and UNIX systems set to resolve (PC) or forward (UNIX) to one of the
central machines.

> how to subscribe to the Firewalls mailing list?  Thanks for the help.

send the message
	subscribe firewalls-digest
to
	[email-masked]

Cheers
Russell

 -------------------------------------------------------------------
 Russell Street ([email-masked]) +64 (9) 373-7599 extn 6487
   UNIX Systems Programmer, Computer Centre, University of Auckland
	     http://www.auckland.ac.nz/cc/People/RS.html

	   It's something to do with the shortage of money
	       and the holidays in the South of France.