help-cfengine
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: OK, Now I see what the firewall issues are with Cfengine in our envi


From: Bill.Hall
Subject: RE: OK, Now I see what the firewall issues are with Cfengine in our environment
Date: Thu, 24 Jun 2004 13:57:34 -0700

There should be away to set your firewalls to accept all traffic from any port 
once a connection is established to 5038. Have you tried this yet? What 
firewalls are you using?

Bill

-----Original Message-----
From: address@hidden
[mailto:address@hidden Behalf Of
ext address@hidden
Sent: Thursday, June 24, 2004 1:40 PM
To: address@hidden
Cc: address@hidden
Subject: Re: OK, Now I see what the firewall issues are with Cfengine in
our environment




On 24 Jun, Scott Omar Burch wrote:
> OK,
> 
> Based on our firewall policy which generally is the following:
> 
> 1) Return traffic from an application is allowed by a rule on a specific 
> port through a firewall to a machine on the other side of the firewall. 
> When an applications source port changes at random then that becomes a 
> serious problem for firewall policy...basically the only way to write a 
> rule for Cfengine is allow all ports to talk back to the policy server 
> sitting on the other side of the firewall.
> 
> When using simply snoop to analyze a session between the policy server 
> and a client the following is observed (the snoop session is on the client).
> 
> 1) The client connects from a random source port to port 5308 on the 
> policy server (this is the problem).
> 2) The policy server responds from 5308 to the randomly chosen source 
> port (this is not a problem because we allow all traffic from inside 
> along the management interface.).
> 
> So to make Cfengine work we would need a firewall rule that allows all 
> ports on particular interface to pass through the firewall to the policy 
> server. Seems like it wouldn't be to hard to tell cfagent to use a 
> specific source port rather than randomly choosing a port number (but 
> I'm probably oversimplifying the situation). I don't believe this is 
> possible now, but if not any thoughts on changing that aspect of Cfengine?


Scott, 

is there a reason why you can't just allow random tcp ports from a 
restricted address range into your firewall? CFservd also has its own
firewall-like features to eliminate unwanted traffic.

I don't know if it is possible to fix the sender port in a tcp 
connection. It seems to me that it is not the port number that
matters here, but rather the IP source address of the caller.

Mark

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Work: +47 22453272            Email:  address@hidden
Fax : +47 22453205            WWW  :  http://www.iu.hio.no/~mark
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



_______________________________________________
Help-cfengine mailing list
address@hidden
http://lists.gnu.org/mailman/listinfo/help-cfengine




reply via email to

[Prev in Thread] Current Thread [Next in Thread]