Linux firewalled webserver protocol security question

[TSMJ]

Phew... I had to think hard about that title!

I have got Smoothwall running on an old machine, and unfortunatley it will not let me set up an orange interface that I could put my Windows 2000 server web server on. In the meantime (ie the time between now and when I can be bothered to try another PC) I have put it on the Green interface and port forwarded port 80 and 21 to it (for HTTP & FTP). I need to access the HDD's in the server from the LAN to update my website and add files to the FTP area, so I need "Client for Microsoft Networks" and "File and print sharing for Microsoft networks" enabled for this. Now I know the server is behind a Linux firewall (and there are only 2 possible ports available to the WWW) but are these protocols still a security problem? Smoothwall is also behind a hardware firewall in the router.

Cheers

 

[SgtB]

As long as the NetBIOS protocols are filtered at the firewall you should be safe from external threats on those ports. Its not safe from internal threats though, but that probably isn't an issue for you...unless another pc on your LAN is compromised, then the webserver could be in trouble...along with the rest of your LAN.

I'll see your DMCA and raise you a First Amendment.

http://www.anti-dmca.org

 

[TSMJ]

Anyone know weather smoothwall does this?

 

[SgtB]

Does what? Protect your LAN? Its a firewall, so yes, it does...as long as you configure it properly.

I'll see your DMCA and raise you a First Amendment.

http://www.anti-dmca.org

 

[TSMJ]

No, does smoothwall firewall the netbios protocols running on the webserver behind it, with internet access to ports 21 and 80 only?

 

[pansophic]

The answer to your questions are, yes and yes.

Yes the firewall will be protecting your NetBIOS ports from hosts on the internet, because you haven't put in a rule to allow that traffic. You would have to allow port forwarding for the NetBIOS ports in order to expose them to the internet at large.

And yes, both of those ports that you are allowing through the firewall suffer security vulnerabilities from time to time. The best that you can hope to do is patch as frequently as possible, and hope that you don't get caught in the gap.

I have one server that gets updated nightly, and SSH was still compromised, and the server rooted. You can never protect against a 0 day exploit (one that has not been identified and fixed yet). But most of the time, there is a lag between the exploit and when someone actually finds your specific server. That is why patching is so important.


pansophic

 

[TSMJ]

Thanks