On Sun, 21 Oct 2001, Lars O. Grobe wrote:
Hi List!
I would like to hear your opinion on our fileserver installation, as I see a big difference between the de facto installations and the ones described in security how-tos and lists.
As far as I can see, most university networks constist on computers with valid ip's directly connected to the net. These are Suns, PCs and Macs, with their own fileservices. I understand that this is dangerous.
Probably....
On the other hand, howtos and lists talk about DMZs, firewalls and very few protocols on the internet. So, following the advises, every network seams to need a "secure" side for the clients, and a DMZ for every server visible to the outside, and a lot of filters...
I think Universities really do present a special case. In a business, it's possible to centralize each of these functions at least somewhat. But a university deals directly in the currency of ideas and information, and every professor and every class is going to want their own web content, files, mailing lists, etc, to be available to the students. They'll want their research papers to be available to colleagues across the country, they'll want their grad students to be able to instantly-update stuff on their own servers in realtime based on the outcome of experiments within minutes of the experiment's conclusion. With those needs, you can't really centralize the functions and I don't think you could put up an all-university firewall -- if you did, it would be a twenty-four-hours-a-day job to try to keep the configuration changed according to how everybody wanted to use it today. Also, your biggest security threat in a university is internal, not external -- ie, the student body and the small fraction of them prone to malicious mischief. You don't materially increase security by keeping *external* attackers out when at least 3/4 of your potential attacks are going to come from *internal* users. Offhand, I think in a university setting, professors who are willing to do their own administration should probably get their own block of internal or external IP addresses to play with, and it probably doesn't really matter all that much which. The best you can do is to try to make university-wide standards about secure administration, identify crucial machines, and become a real pain-in-the-butt if you don't get regular backups from those machines so you can restore them when (not if) they get hacked. But, if they're coming to *you* to do their configuration and administration for them, you have the responsibility to say, from time to time, "I won't do that for security reasons," When it's true. Bear