4:04 p.m.
Hey,
So I know we've had long threads about this on fedora-devel but it
isn't clear to me anything came out of them. Maybe we can be more
specific.
Does our current firewall policy for the desktop install make sense?
Does a firewall add any value at all?
Should we have a bidirectional firewall?
Other thoughts? I'd be interested to know if we at least have rough
agreement between people who have written or maintain network
listening services like David, Lennart, Colin, and Owen.
Thanks,
Jon
4:23 p.m.
On Tue, 04.05.10 17:04, William Jon McCann (william.jon.mccann(a)gmail.com) wrote:
Hey,
So I know we've had long threads about this on fedora-devel but it
isn't clear to me anything came out of them. Maybe we can be more
specific.
Does our current firewall policy for the desktop install make sense?
Does a firewall add any value at all?
Should we have a bidirectional firewall?
Other thoughts? I'd be interested to know if we at least have rough
agreement between people who have written or maintain network
listening services like David, Lennart, Colin, and Owen.
There was a private discussion about that by email by a few folks,
initiated by Bastien IIRC, a few weeks ago. It died after a while.
However, I think some of the folks involved agree with me that for the
long run we should have a firewall that focuses on "profiles" instead of
activating seperate services individually, which has been suggested
quite often and is particularly pushed by some baseos people.
In more detail:
I want a minimal system where I can activate one of the predefined
firewall profiles "Internet Cafe", "Corporate Network" and
"Trusted/Home
Network" (or similarly named), plus any others defined by the admin, and
which can be attached to the various interfaces and are activated for
them when they go up, and only for them for each iface.
Bastien suggested the various apps should be able to show hints like
"You need to enable service 'mDNS/DNS-SD' to use this service, please
click here to enable it" in the UI for the various programs, when they
are blocked by the fw. I am more arguing for a UI that would show "Your
current firewall 'Internet Cafe' does not allow service 'mDNS/DNS-SD' to
work. Please change to profile 'Corporate Network' or 'Trusted Network'
if you want to use this service and you are in a suitable network."
Rationale behind this: systems are mobile, hence if you enable "mDNS" in
one network it should not mean it is from then enabled in every network
you move your machien to. And secondly, I doubt we could reasonably
explain the differences between the various browsing services to people
(i.e. SMB, mDNS, uPNP), and hence I'd argue that when you enable one of
those service it should be ok to enable the other ones mentioned here as
well. On a network where uPnP is OK to be used, mDNS is too. Something
similar applies to other protocols.
It would be a great step ahead if the discussions we have every now and
then on fedora-devel whether some specific software should be enabled in
the fw would become more specific: instead of asking whether avahi
should be whitelisted in the default fw, I'd like to move those
discussions in the direction that people ask whether avahi should be
enabled in the "Corporate Network" profile or not.
I think Windows has a similar profiles system now, too.
Lennart
--
Lennart Poettering Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/ GnuPG 0x1A015CC4
4:36 p.m.
On Tue, 2010-05-04 at 23:23 +0200, Lennart Poettering wrote:
On Tue, 04.05.10 17:04, William Jon McCann
(william.jon.mccann(a)gmail.com) wrote:
> Hey,
>
> So I know we've had long threads about this on fedora-devel but it
> isn't clear to me anything came out of them. Maybe we can be more
> specific.
>
> Does our current firewall policy for the desktop install make sense?
>
> Does a firewall add any value at all?
>
> Should we have a bidirectional firewall?
>
> Other thoughts? I'd be interested to know if we at least have rough
> agreement between people who have written or maintain network
> listening services like David, Lennart, Colin, and Owen.
There was a private discussion about that by email by a few folks,
initiated by Bastien IIRC, a few weeks ago. It died after a while.
However, I think some of the folks involved agree with me that for the
long run we should have a firewall that focuses on "profiles" instead of
activating seperate services individually, which has been suggested
quite often and is particularly pushed by some baseos people.
In more detail:
I want a minimal system where I can activate one of the predefined
firewall profiles "Internet Cafe", "Corporate Network" and
"Trusted/Home
Network" (or similarly named), plus any others defined by the admin, and
which can be attached to the various interfaces and are activated for
them when they go up, and only for them for each iface.
Bastien suggested the various apps should be able to show hints like
"You need to enable service 'mDNS/DNS-SD' to use this service, please
click here to enable it" in the UI for the various programs, when they
are blocked by the fw. I am more arguing for a UI that would show "Your
current firewall 'Internet Cafe' does not allow service 'mDNS/DNS-SD' to
work. Please change to profile 'Corporate Network' or 'Trusted Network'
if you want to use this service and you are in a suitable network."
Rationale behind this: systems are mobile, hence if you enable "mDNS" in
one network it should not mean it is from then enabled in every network
you move your machien to. And secondly, I doubt we could reasonably
explain the differences between the various browsing services to people
(i.e. SMB, mDNS, uPNP), and hence I'd argue that when you enable one of
those service it should be ok to enable the other ones mentioned here as
well. On a network where uPnP is OK to be used, mDNS is too. Something
similar applies to other protocols.
It would be a great step ahead if the discussions we have every now and
then on fedora-devel whether some specific software should be enabled in
the fw would become more specific: instead of asking whether avahi
should be whitelisted in the default fw, I'd like to move those
discussions in the direction that people ask whether avahi should be
enabled in the "Corporate Network" profile or not.
I think Windows has a similar profiles system now, too.
Lennart
--
Lennart Poettering Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/ GnuPG 0x1A015CC4
I like where this is going. I think it's easier to ask the user what
type of network environment they are in rather than if they want to
allow foobarfroz service to run. The latter is a major laughing point
of windows users, even mocked in Apple commercials. We do not want to
repeat their mistakes. However the basic idea of prompting the user to
confirm something does have merit, and it seems to me it would be easier
to answer "I trust those around me" vs "I do not trust those around
me"
than to make informed decisions about each and every service that may be
ran.
Hopefully it goes without saying that it would take a certain role
within PK rights to be able to manipulate which firewall profile to
load...
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
5:54 p.m.
On Tue, 2010-05-04 at 17:04 -0400, William Jon McCann wrote:
Hey,
So I know we've had long threads about this on fedora-devel but it
isn't clear to me anything came out of them. Maybe we can be more
specific.
Does our current firewall policy for the desktop install make sense?
No.
Does a firewall add any value at all?
A little.
Should we have a bidirectional firewall?
We really only block incoming communications right now, and it's
probably as much of a security risk as opening all the ports, as far as
I'm concerned.
Other thoughts? I'd be interested to know if we at least have
rough
agreement between people who have written or maintain network
listening services like David, Lennart, Colin, and Owen.
I'm already discussing this behind closed doors with a few people,
including some RH security people. I'll restart the "negotiations" this
week.
Cheers
5:54 p.m.
On Tue, 2010-05-04 at 23:23 +0200, Lennart Poettering wrote:
On Tue, 04.05.10 17:04, William Jon McCann
(william.jon.mccann(a)gmail.com) wrote:
> Hey,
>
> So I know we've had long threads about this on fedora-devel but it
> isn't clear to me anything came out of them. Maybe we can be more
> specific.
>
> Does our current firewall policy for the desktop install make sense?
>
> Does a firewall add any value at all?
>
> Should we have a bidirectional firewall?
>
> Other thoughts? I'd be interested to know if we at least have rough
> agreement between people who have written or maintain network
> listening services like David, Lennart, Colin, and Owen.
There was a private discussion about that by email by a few folks,
initiated by Bastien IIRC, a few weeks ago. It died after a while.
However, I think some of the folks involved agree with me that for the
long run we should have a firewall that focuses on "profiles" instead of
activating seperate services individually, which has been suggested
quite often and is particularly pushed by some baseos people.
In more detail:
I want a minimal system where I can activate one of the predefined
firewall profiles "Internet Cafe", "Corporate Network" and
"Trusted/Home
Network" (or similarly named), plus any others defined by the admin, and
which can be attached to the various interfaces and are activated for
them when they go up, and only for them for each iface.
Bastien suggested the various apps should be able to show hints like
"You need to enable service 'mDNS/DNS-SD' to use this service, please
click here to enable it" in the UI for the various programs, when they
are blocked by the fw. I am more arguing for a UI that would show "Your
current firewall 'Internet Cafe' does not allow service 'mDNS/DNS-SD' to
work. Please change to profile 'Corporate Network' or 'Trusted Network'
if you want to use this service and you are in a suitable network."
Huh. That's not quite what I said. I said that:
- you need to give feedback to the user
- network profiles were probably part of the solution, but cannot be the
only solution.
If I have to get somebody to launch system-config-firewall to make video
sharing work, then I've already lost.
<snip>
I think Windows has a similar profiles system now, too.
And the Windows firewall user experience is laughable.
We need to do better than that...
6:04 p.m.
On Tue, 04.05.10 23:54, Bastien Nocera (bnocera(a)redhat.com) wrote:
<snip>
> I think Windows has a similar profiles system now, too.
And the Windows firewall user experience is laughable.
Well, all I wanted to say is that they seem to have a profile system
like the one I suggested, i.e. distuingishing Home and Internet Cafe
profiles and similar....
http://3.bp.blogspot.com/_gvuiuxortv8/SmV4wPaD4tI/AAAAAAAAGPQ/DxjDXCn4xRM...
I am pretty sure their UI in general sucks, but to put the fw in
those profiles Is certainly a good thing I believe.
Lennart
--
Lennart Poettering Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/ GnuPG 0x1A015CC4
4:05 a.m.
On Wed, 2010-05-05 at 10:24 +0200, Yaakov Nemoy wrote:
2010/5/5 Bastien Nocera <bnocera(a)redhat.com>:
> I'm already discussing this behind closed doors with a few people,
> including some RH security people. I'll restart the "negotiations"
this
> week.
Why is this discussion happening in private?
Because it's already painful enough as it is. I'm not interested in a
mega-thread with everybody contributing, but nobody taking charge. I
want to have something concrete to present before asking for comments.
3:46 p.m.
On Wed, 2010-05-05 at 10:05 +0100, Bastien Nocera wrote:
On Wed, 2010-05-05 at 10:24 +0200, Yaakov Nemoy wrote:
> 2010/5/5 Bastien Nocera <bnocera(a)redhat.com>:
> > I'm already discussing this behind closed doors with a few people,
> > including some RH security people. I'll restart the
"negotiations" this
> > week.
>
> Why is this discussion happening in private?
There's nothing wrong with consulting with experts in private, coming up
with solid plans on your own, and then presenting those plans - or even
better, an implementation of those plans - to the community for review.
I think we'd all be better served if more ideas were developed this way:
research, then prototype, *then* discuss.
Starting with the discussion seems to get us nowhere, and you know what
they say about Design by Committee..
-w
12:54 a.m.
Do what thou wilt
shall be the whole of the Law.
On 5/5/10, Bastien Nocera <bnocera(a)redhat.com> wrote:
On Wed, 2010-05-05 at 10:24 +0200, Yaakov Nemoy wrote:
> 2010/5/5 Bastien Nocera <bnocera(a)redhat.com>:
> > I'm already discussing this behind closed doors with a few people,
> > including some RH security people. I'll restart the "negotiations"
this
> > week.
>
> Why is this discussion happening in private?
Because it's already painful enough as it is. I'm not interested in a
mega-thread with everybody contributing,
<sarcasm>nope. you don't want too many contributions.....</sarcasm>
but nobody taking charge.
doesn't seem to be a problem here.
I
want to have something concrete to present before asking for
comments.
charles zeitler
Love is the law, love under will.
2:04 a.m.
2010/5/6 Christoph Wickert <christoph.wickert(a)googlemail.com>:
Am Dienstag, den 04.05.2010, 23:54 +0100 schrieb Bastien Nocera:
> We really only block incoming communications right now, and it's
> probably as much of a security risk as opening all the ports, as far as
> I'm concerned.
Why is closing ports a security risk?
you understood it wrongly... actually only filtering incoming ports is
a one sided thing. a real firewall setup filters both direction.
turning filtering off completly though is even for a desktop a touch
decision. there are still people who do not have a nat router but are
connected to the net directly. and filtering off by default will be a
security issue for their desktops... i am curious what argumentation
chain will come up to disable filtering completly by default and how
it doesent help those users in having a more secure box by default,
even if they turn on some services for virtual machines or other
crosslinked boxes. lets see.
kind regards,
Rudolf Kastl
rhce rhca rhcss rhcx
Regards,
Christoph
--
desktop mailing list
desktop(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/desktop
2:05 a.m.
2010/5/6 Rudolf Kastl <che666(a)gmail.com>:
2010/5/6 Christoph Wickert <christoph.wickert(a)googlemail.com>:
> Am Dienstag, den 04.05.2010, 23:54 +0100 schrieb Bastien Nocera:
>
>> We really only block incoming communications right now, and it's
>> probably as much of a security risk as opening all the ports, as far as
>> I'm concerned.
>
> Why is closing ports a security risk?
you understood it wrongly... actually only filtering incoming ports is
a one sided thing. a real firewall setup filters both direction.
turning filtering off completly though is even for a desktop a touch
i meant tough of course. *slowly wakes up*
decision. there are still people who do not have a nat router but
are
connected to the net directly. and filtering off by default will be a
security issue for their desktops... i am curious what argumentation
chain will come up to disable filtering completly by default and how
it doesent help those users in having a more secure box by default,
even if they turn on some services for virtual machines or other
crosslinked boxes. lets see.
kind regards,
Rudolf Kastl
rhce rhca rhcss rhcx
>
> Regards,
> Christoph
>
> --
> desktop mailing list
> desktop(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/desktop
>
3:48 a.m.
2010/5/5 Bastien Nocera <bnocera(a)redhat.com>:
On Wed, 2010-05-05 at 10:24 +0200, Yaakov Nemoy wrote:
> 2010/5/5 Bastien Nocera <bnocera(a)redhat.com>:
> > I'm already discussing this behind closed doors with a few people,
> > including some RH security people. I'll restart the "negotiations"
this
> > week.
>
> Why is this discussion happening in private?
Because it's already painful enough as it is. I'm not interested in a
mega-thread with everybody contributing, but nobody taking charge. I
want to have something concrete to present before asking for comments.
I can definitely understand why you want to do things this way. Given
alot of the 'discussion' going on around several mailing lists, i
think that in order to solve the problems you're looking to solve,
it's probably more efficient to do it this way. That said, it seems to
go completely against what we talk about about how open source
development should be done as much in the open as possible. I don't
mean to be critical of you, or that you're willing to Get Shit Done
(tm), but it really makes me wonder that if you have to resort to
internal to RH development to avoid having your time grossly wasted,
what are we doing wrong in Fedora in general.
-Yaakov
12:05 p.m.
On Wed, 2010-05-05 at 01:04 +0200, Lennart Poettering wrote:
On Tue, 04.05.10 23:54, Bastien Nocera (bnocera(a)redhat.com) wrote:
> <snip>
> > I think Windows has a similar profiles system now, too.
>
> And the Windows firewall user experience is laughable.
Well, all I wanted to say is that they seem to have a profile system
like the one I suggested, i.e. distuingishing Home and Internet Cafe
profiles and similar....
http://3.bp.blogspot.com/_gvuiuxortv8/SmV4wPaD4tI/AAAAAAAAGPQ/DxjDXCn4xRM...
I am pretty sure their UI in general sucks, but to put the fw in
those profiles Is certainly a good thing I believe.
The UI isn't great, but perhaps we can do better. But honestly I don't
know how to make it significantly better, and I'm not a UI expert.
But until we know how to make it better, there's no technical reason we
couldn't do what Windows does.
Dan
5086
days inactive
5099
days old
desktop@lists.fedoraproject.org
14 comments
10 participants
participants (10)
-
Bastien Nocera -
Charles Zeitler -
Christoph Wickert -
Dan Williams -
Jesse Keating -
Lennart Poettering -
Rudolf Kastl -
Will Woods -
William Jon McCann -
Yaakov Nemoy