Datasheet

“main” (Installation and Administration) — 2004/6/25 — 13:29 — page 647 — #673
i
i
i
i
i
i
i
i
26
Security in the Network
As a consequence of all this, you might experience some problems with a
number of application protocols, such as ICQ, cucme, IRC (DCC, CTCP),
and FTP (in PORT mode). Netscape, the standard FTP program, and many
others use the PASV mode. This passive mode is much less problematic as
far as packet filtering and masquerading is concerned.
26.3.3 Firewalling Basics
Firewall is probably the term most widely used to describe a mechanism
that provides and manages a link between networks while also controlling
the data flow between them. Strictly speaking, the mechanism described
in this section is called a packet filter. A packet filter regulates the data flow
according to certain criteria, such as protocols, ports, and IP addresses. This
allows you to block packets that, according to their addresses, are not sup-
posed to reach your network. To allow public access to your web server,
for example, explicitly open the corresponding port. However, a packet fil-
ter does not scan the contents of packets with legitimate addresses, such as
those directed to your web server. For example, if incoming packets were
intended to compromise a CGI program on your web server, the packet fil-
ter would still let them through.
A more effective but more complex mechanism is the combination of sev-
eral types of systems, such as a packet filter interacting with an applica-
tion gateway or proxy. In this case, the packet filter rejects any packets
destined for disabled ports. Only packets directed to the application gate-
way are accepted. This gateway or proxy pretends to be the actual client
of the server. In a sense, such a proxy could be considered a masquerading
host on the protocol level used by the application. One example for such a
proxy is Squid, an HTTP proxy server. To use Squid, the browser must be
configured to communicate via the proxy. Any HTTP pages requested are
served from the proxy cache and pages not found in the cache are fetched
from the Internet by the proxy. As another example, the SUSE proxy-suite
(proxy-suite) provides a proxy for the FTP protocol.
The following section focuses on the packet filter that comes
with SUSE LINUX. For further information about packet filter-
ing and firewalling, read the Firewall HOWTO included in the
howto package. If this package is installed, read the HOWTO with
less /usr/share/doc/howto/en/Firewall-HOWTO.gz.
647SUSE LINUX Enterprise Server