Subject: [LON-CAPA-dev] firewall question (a monthly periodical?)

From: Scott Harrison <[email-masked]>
Date: Wed, 18 Sep 2002 19:40:04 -0400

Dear Guy:

http://help.loncapa.org/cgi-bin/fom?file=210

Pending question:

Firewall - other than possibly interfering with needed internet ports,
will iptables significantly slow up LON-CAPA network connectivity?

.
.
.

Since "firewalls?" gets asked on the list every month...
now could be the time to FAQ it.

I have had really good experiences with iptables (ipchains on the other hand is
abominable and almost deprecated).  But I'm not sure if it would be
CPU-expensive, or bottlenecks the network connection during server peak usage
points.

Should we make iptables part of the default installation?
So long as its correctly configured, it can only make security
better as well as keeping track of which network ports
really are needed.

Regards,
Scott

-- 
Scott Harrison, [email-masked]

---

From: Guy Albertelli II <[email-masked]>
Date: Mon, 23 Sep 2002 02:47:14 -0400 (EDT)

Hi Scott,

> I have had really good experiences with iptables (ipchains on the
> other hand is abominable and almost deprecated).  But I'm not sure
> if it would be CPU-expensive, or bottlenecks the network connection
> during server peak usage points.

It supposedly has little impact on performance. I can't find any
extensive testing, but the small tests I have found seem to indicate
that it is fairly light weight.

> Should we make iptables part of the default installation?

RedHat 7.3 does, and it mainly gets it wrong.

I don't think we will gain muc by doing this, I think it better just
to require as few services as possible and to lock these down as tight
as possible.

> better as well as keeping track of which network ports

But will cause even more headaches as users get it wrong.

Additionally I'd like to continue to reduce the amount of control we
exercise over the machine.

I like that we have stopped trying to configure appletalk, etc, and
now add ourselves to Apache rather than try to own it.
-- 
[email-masked]          BM: n^20 t20 z20 qS 
Guy Albertelli -7-8-2-  O-
    I would love to but . . . I'm in training to be a household pest.

---

From: Scott Harrison <[email-masked]>
Date: Mon, 23 Sep 2002 11:29:32 -0400

> RedHat 7.3 does, and it mainly gets it wrong.

The trick for getting iptables working with RedHat 7.3 is to completely
disable ipchains.  iptables never works even after
/etc/rc.d/init.d/ipchains stop.  The system must boot up without
ever launching ipchains.

The simplest is to:
                      rpm -e ipchains

Then iptables works perfectly in my experience.
(This is consistent with other's experiences on various mailing lists.)

> to require as few services as possible and to lock these down as tight

Yes.

> exercise over the machine.

Agreed.

I would suggest though, that this should not obliterate the ability for
system admin's to freely collaborate.

In other words, if a LON-CAPA sysadmin wants to set up a firewall,
providing help is not a totally bad thing (there could be a general firewall
recommendation).  However recommendation can never be presented as an
endorsement then...

LON-CAPA could be helpful but decidedly neutral.  Similar to what we
now do with samba and appletalk.

---

From: Guy Albertelli II <[email-masked]>
Date: Mon, 23 Sep 2002 12:04:38 -0400 (EDT)

Hi Scott,

> Then iptables works perfectly in my experience.

I didn't mean wrong as in not working, I meant wrong in that the
default installed setup interferes with the proper operation on
LONCAPA, (I.E. it blocks ports 5663 etc)

> now do with samba and appletalk.

If you want to write a nice iptables rule set to include, go right
ahead.

-- 
[email-masked]          BM: n^20 t20 z20 qS 
Guy Albertelli -7-8-2-  O-
    I would love to but . . . it wouldn't be fair to the other Beautiful
    People.

---

From: Martin Siegert <[email-masked]>
Date: Mon, 23 Sep 2002 12:08:10 -0700

Hi Guy, Scott,

> now add ourselves to Apache rather than try to own it.

I second this. LON-CAPA should use standard packages instead of its own
version of standard packages. It also should not try to overwrite
configuration files, etc., of other packages or change settings of
other services (still with the latest version a LON-CAPA update screws
up ntp on dalton.chem.sfu.ca every time). If you wish to help sysadmins
with the configuration of iptables, ntp, etc., then include example
configuration files instead of overwriting existing settings.

> _______________________________________________
> LON-CAPA-dev mailing list
> [email-masked]
> http://mail.lon-capa.org/mailman/listinfo/lon-capa-dev

Cheers,
Martin

---

From: Scott Harrison <[email-masked]>
Date: Mon, 23 Sep 2002 15:36:37 -0400

Dear Martin:

http://bugs.lon-capa.org/show_bug.cgi?id=810
"Place ntp configuration in a helpful but not destructive place."

Done.  I will do the same thing for krb.conf.  Are there any other
instances you can think of?

> "still with the latest version a LON-CAPA update screws
>  up ntp on dalton.chem.sfu.ca every time"

???

The configuration files ARE NOT overwritten
(take a look at Makefile.configinstall).  Out of curiosity,
what happens to screw up ntp?

Regards,
Scott

---

From: Martin Siegert <[email-masked]>
Date: Mon, 23 Sep 2002 12:46:40 -0700

> what happens to screw up ntp?

LON-CAPA for reasons unknown to me seems to change the ownership of the
/etc/ntp directory to root (under ar least RH 7.3 it needs to be owned
by ntp, so that it can write drift files, etc.).
Sorry, I still haven't enter a bug report yet ...

Cheers,
Martin

---

From: Scott Harrison <[email-masked]>
Date: Mon, 23 Sep 2002 16:08:42 -0400

Hi Martin,

> Sorry, I still haven't enter a bug report yet ...

Problem fixed.
http://bugs.lon-capa.org/show_bug.cgi?id=811

As a side note, the LON-CAPA installation-upgrade-configuration
mechanism is VERY easy to predictably and accurately change.
Please do not hesitate to point out future, easy-to-fix glitches.

Regards,
Scott