public inbox for gentoo-dev@lists.gentoo.org
 help / color / mirror / Atom feed
* Re: [gentoo-dev] NAT iptables info
@ 2001-10-04 14:48 Sherman Boyd
  0 siblings, 0 replies; 14+ messages in thread
From: Sherman Boyd @ 2001-10-04 14:48 UTC (permalink / raw
  To: gentoo-dev

Not in agreement with what?  I'm simply asking a question.  I understand what you are saying, but I think you are still stuck on your original thread with the guy who actually wants a one button firewall.  You assume too much if you think that I am looking for the same thing.  Nobody wants to make gentoo into a zero knowledge distro, so it's real easy to score some cheap shots making comparisons to Microsoft and Redhat.  
 
Configuration is obviously in the domain of a package.  Ideally the default configuration is conservative and secure.  The fact is Gentoo is making policy decision every day, and even deals with optional configurations.  Take /etc/rc.d/config/basic where we have the choice of using either achim's, drobbin's or pete's favorite console fonts.  I like that.  Why?  Because even though I have a preference to what my console font is I really don't give damn.  I'm not going to waste too much time researching different console fonts.  So I really appreciate a suggested configuration.  This solution is cool, but it gets more complicated when we get into desktops.  So what I was suggesting was a higher level tool to handle configurations.  Should gentoo provide one default configuration for GNOME?  Or should there be a choice of configurations?  Maybe separation of installation and configuration would be a good thing?  I think a configuration tool moves toward gentoo's goal of being a meta-distribution.  
 
Now I'm not suggesting a configuration tool that can replace the need for manual configuration, at least in most cases.  Just a tool that can manage multiple optional configurations.  I'm with you when you say that an admin (or user) should understand netfilter before implementing it, and I disagree with the original poster who wants a easy (but insecure) way to NAT his network.  However there comes a time when you may want the benefit of someone else's experience.  You probably did not write a firewall script from scratch, or your XFree configuration, and on and on.  Chances are you used a suggested configuration that you modified to suit your purposes.
 
Anyway it is simply an idea, maybe even a bad one.  I'm not terribly attached to it.  I was hoping to open a logical discussion not some hot-blooded "debate".  Nobody is going to turn gentoo into a Mandrake or Redhat.  Documentation is a lot more important than optional configuration packages.  Please tone down the emotion and carefully consider what I am saying next time.  It sounds like we agree on a lot, and even if we disagree I think it is to everyone's advantage to keep an open mind.
 
-sherman
 
 

	-----Original Message-----
From: Donny Davies <woodchip@gentoo.org> 
Sent: Wednesday, October 03, 2001 12:35 PM
To: <gentoo-dev@cvs.gentoo.org>
Subject: [gentoo-dev] NAT iptables info



	Nope. Sorry. Im not in agreement in this at all. Of course, its open to debate, 
Im not saying I know everything, nor Im 100% right. Go ahead, debate away. 
But I dont want any part of it, Ill tell you that! 

	If you dont understand the ramnifications of packet filetering, NAT, etc then 
you have *no* business running this software. We are not Microsoft or Wingate, 
opening yuor machine to a wider world. 

	What if somebodys iptables script is made into an ebuild, and said script turns 
out to be flawed, perhaps seriously? Then its "hey, yeah those guys at gentoo 
have a firewall setup like swiss cheese.". What interfaces are yuo going to 
configure this ebuild for? eth0 and eth1? how about ppp? maybe an isdn 
interface? How do yuo choose? Im going to say this again, it is %100 
configuration. This is *not* the domain of a package. It is the domain of 
a system administrator. This is 1 file we're talking about here people, not 
a series of docs, scripts, config files. *most* of them anyway. There *are* 
some that come with external configs. But thats all beside the point. The 
script needs to be edited. This whole thing started because we basically had 
a post to the devel list of the flavour: "I need an iptables HOWTO". 

	What are you going to do about the kernel modules? Did you know that 
the netfilter modules are built at the kernel level? How are you going to 
DEPEND on that? 

	This is bad policy. A distribution should *not* be dictating *policy*. To 
not understand that is a big mistake. Listen, Redhat and Mandrake are 
the kinds of distros doing this stuff! Making Linux into a 1 click affair. 
This is not our primary intention. Not at this stage anyway! 

	So feel free to debate it all you want, I wont be having *any* part in it 
Ill tell you that! 

	Cheers! 
   
Donny 



	_______________________________________________ 
gentoo dev mailing list 
gentoo dev@cvs.gentoo.org 
http://cvs.gentoo.org/mailman/listinfo/gentoo dev 




^ permalink raw reply	[flat|nested] 14+ messages in thread
* RE: [gentoo-dev] NAT iptables info
@ 2001-10-03 13:53 Sean Mitchell
  2001-10-04  4:54 ` Djamil ESSAISSI
  0 siblings, 1 reply; 14+ messages in thread
From: Sean Mitchell @ 2001-10-03 13:53 UTC (permalink / raw
  To: gentoo-dev

> From: Donny Davies [mailto:woodchip@gentoo.org]

> Nope. Sorry. Im not in agreement in this at all. Of course, 
> its open to debate,
> Im not saying I know everything, nor Im 100% right. Go ahead, 
> debate away.
> But I dont want any part of it, Ill tell you that!
> 
> If you dont understand the ramnifications of packet 
> filetering, NAT, etc then
> you have *no* business running this software. We are not 
> Microsoft or Wingate,
> opening yuor machine to a wider world.

<snip rest of post>

I have to agree in principle here, FWIW. The answer to this problem of
making the functionality available to everyone is to make sure things are
clearly and thoroughly documented. I think we are best served by following
the OpenBSD example of a secure default install and then let the users
change configuration to suit.

Cheers,

Sean



^ permalink raw reply	[flat|nested] 14+ messages in thread
* [gentoo-dev] NAT iptables info
@ 2001-10-03 13:39 Donny Davies
  2001-10-03 13:46 ` Michael M Nazaroff
  0 siblings, 1 reply; 14+ messages in thread
From: Donny Davies @ 2001-10-03 13:39 UTC (permalink / raw
  To: gentoo-dev

Nope. Sorry. Im not in agreement in this at all. Of course, its open to debate,
Im not saying I know everything, nor Im 100% right. Go ahead, debate away.
But I dont want any part of it, Ill tell you that!

If you dont understand the ramnifications of packet filetering, NAT, etc then
you have *no* business running this software. We are not Microsoft or Wingate,
opening yuor machine to a wider world.

What if somebodys iptables script is made into an ebuild, and said script turns
out to be flawed, perhaps seriously? Then its "hey, yeah those guys at gentoo
have a firewall setup like swiss cheese.". What interfaces are yuo going to
configure this ebuild for? eth0 and eth1? how about ppp? maybe an isdn
interface? How do yuo choose? Im going to say this again, it is %100
configuration. This is *not* the domain of a package. It is the domain of
a system administrator. This is 1 file we're talking about here people, not
a series of docs, scripts, config files. *most* of them anyway. There *are*
some that come with external configs. But thats all beside the point. The
script needs to be edited. This whole thing started because we basically had
a post to the devel list of the flavour: "I need an iptables HOWTO".

What are you going to do about the kernel modules? Did you know that
the netfilter modules are built at the kernel level? How are you going to
DEPEND on that?

This is bad policy. A distribution should *not* be dictating *policy*. To
not understand that is a big mistake. Listen, Redhat and Mandrake are
the kinds of distros doing this stuff! Making Linux into a 1-click affair.
This is not our primary intention. Not at this stage anyway!

So feel free to debate it all you want, I wont be having *any* part in it
Ill tell you that!

Cheers!
--
Donny





^ permalink raw reply	[flat|nested] 14+ messages in thread
* RE: [gentoo-dev] NAT iptables info
@ 2001-10-03 13:15 Sherman Boyd
  0 siblings, 0 replies; 14+ messages in thread
From: Sherman Boyd @ 2001-10-03 13:15 UTC (permalink / raw
  To: gentoo-dev

What about a configuration packages?  I think that the default settings of an ebuild should be conservative and secure, but when you start talking about ebuilds with lots of configuration options you see a need for a what Chad is talking about.  How about:
 
emerge rusty_impervious_firewall.x.y.z.econf
 
or maybe it should be a separate tool:
 
econfig tonys_sweet_gnome_setup.x.y.z.econf
 
That way we can keep configuration and installation in separation.
 
-sherman
 

	-----Original Message-----
From: Chad Huneycutt <chad.huneycutt@acm.org> 
Sent: Monday, October 01, 2001 7:30 PM
To: <gentoo-dev@cvs.gentoo.org>
Subject: Re: [gentoo-dev] NAT iptables info



	Donny Davies wrote: 

	>To provide some kind of gentoo firewall is, hmm, well silly. Its %100 
>configuration. This is not the domain of a 'package', 'rpm' or ebuild. 
> 
I don't completely agree with this.  While questions like "How do I set 
up a firewall?" are not completely germaine to this mailing list, the 
above statement is your opinion and open for discussion here.  I think 
that it is a very good idea to provide several basic scripts for common 
configurations.  If they are already out there, then great!, we should 
include them in an ebuild.  It is a much better policy to have the 
network default to a secure state (such as the Rusty's script that 
allows no incoming connections) than to leave it wide open, and let the 
potentially newbie sysadmin get hacked. 

	It would be nice to bring up a semi secure,  masquerading (or whatever 
they are calling it these days)  firewall box with little effort.  From 
there, one can learn about iptables and such things to customize it further. 

	Just some thoughts from someone who hasn't delved into iptables yet, 

	   Chad 


	_______________________________________________ 
gentoo dev mailing list 
gentoo dev@cvs.gentoo.org 
http://cvs.gentoo.org/mailman/listinfo/gentoo dev 




^ permalink raw reply	[flat|nested] 14+ messages in thread
* [gentoo-dev] NAT iptables info
@ 2001-10-01 15:02 Donny Davies
  2001-10-01 20:29 ` Chad Huneycutt
  2001-10-02  4:13 ` Djamil ESSAISSI
  0 siblings, 2 replies; 14+ messages in thread
From: Donny Davies @ 2001-10-01 15:02 UTC (permalink / raw
  To: gentoo-dev

Please search freshmeat for iptables scripts. Please understand that they're
mostly just that-- scripts. Mostly they work top-down, with a few variables
you can edit applicable to your setup. Its easy enough to understand. There
are a zillion things you can do with the netfilter framework, its very robust.
To provide some kind of gentoo firewall is, hmm, well silly. Its %100
configuration. This is not the domain of a 'package', 'rpm' or ebuild. It is the
domain of a system administrator. If you are operating a Linux box then you
are automatically a system administrator. Cool huh!? :-)

This list is not the place for this type of stuff IHMO. This is not a howto-list.
I mean no disrespect. Please dont take any offense.

What gentoo provides is a nice framework for inserting your firewall script
into the init system. At least on rc5 there was an initfile specifically for that
purpose. Actually we neednt provide any more than just that! Ie: provide
a slot for a firewall script to run. I think the rc5 one ran after all non-local
interfaces were brought up, its been so long since I changed my firewall
box that I cant remember anymore :) The nice thing about that approach
is that you could always just source it, and run the function it was enclosed
in if you needed to run it again. Simple, slick, sufficient.

Please read up on packet filtering. Microsoft Internet Connection sharing
is not a simple hack. Its a lot of work to provide a simple, robust interface
to newbies who want to share an internet connection. I would remind you
that they basically *didnt* even write it. They bought out the company that
*did* write it. It used to be a product called NAT1000 for Windows NT,
and sure enough, it started to sell like hotcakes. Naturally, Micro$loth
being the anti-competitive juggernaut that it is, swallowed them up, and
started tossing it in with Windows 98 Second Edition.

There is simply sooo many different variants of these 'firewall scripts' on
freshmeat that it would be silly to try to come up with a 'here, this does it
for everybody'. It is the obligation of the system administrator. Again, like
I said, it is %100 configuration, with many peices in the *kernel*. This is
not the domain of a 'package'. If it helps you, Im personally using a
modified version of something I grabbed from freshmeat. Good Luck.

Of course Id be willing to send you a copy if you wish.

Cheers
--
Donny





^ permalink raw reply	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2001-10-05 16:27 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2001-10-04 14:48 [gentoo-dev] NAT iptables info Sherman Boyd
  -- strict thread matches above, loose matches on Subject: below --
2001-10-03 13:53 Sean Mitchell
2001-10-04  4:54 ` Djamil ESSAISSI
2001-10-04 13:29   ` Daniel Robbins
2001-10-04 14:31     ` Nathaniel Grady
2001-10-05  3:47     ` Djamil ESSAISSI
2001-10-05 10:28       ` Daniel Robbins
2001-10-03 13:39 Donny Davies
2001-10-03 13:46 ` Michael M Nazaroff
2001-10-03 18:12   ` Collins Richey
2001-10-03 13:15 Sherman Boyd
2001-10-01 15:02 Donny Davies
2001-10-01 20:29 ` Chad Huneycutt
2001-10-02  4:13 ` Djamil ESSAISSI

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox