Firewall security: Problems with simple Samba file share 3607

Well, how else would one access a computer, unless one were sitting at its keyboard? The whole context here is of a network - I must buttume that he simply means "logins via ssh are not allowed" on the safe IPs.

Are you trying to define the kind of access that is permitted (that is, "authorization") from different places and via different protocols? That is a separate question - once one has identifed oneself and been authenticated, then authorization will be given for the appropriate kind of access. That's a given.

I don't really know what you mean by "public" here. All access is public except via direct line, which is keyboard only. If you mean "login via ssh", then please say so! (but ssh is designed to give yu a "private" line over the public internet).

So he has disabled ssh login on his "safe" IPs? Cute. Then how did somebody get hold of this private key? It's only kept on the safe IPs! It seems that somebody doesn't need to log in via ssh in order to gain access to what's on disk in his safe IPs. Possibly a root trojan has been run ... (or his backup has been filched, etc.). Anyway, there is a high probability that his safeIPs are not safe.

To talk about it you have to analyse what you are talking about. The analysis seems to me to reveal that you do not obviously increase your safety by putting up a firewall around ssh - the only thing you guard against is people who already stole the private keys using them to do direct logins from china, and that didn't stop them stealing the private keys, so they likely have been able to get on to your safe IPs in the first place (I think it unlikely that they would not be able to get in once they had access to backups, but I grant you there are diffeernt degrees of access and they may not have sufficient to start with), and once there they can use the private keys to get into your server.

If you want to argue about how they can escalate access to backups of a disk into access to where that disk is installed, well, there is likely to be something that one can figure after checking the configuration. For example they might see that samba is enabled, and reads its data from NIS.

Very good analysis. And I also recommend you to "Secrets and Lies", by Bruce Schneier.

I have seen nothing "knocked down"! Is this some politically derived tactic? Claiming that you have answered when you have not?

Unfortunately, that doesn't do much - the aim of the firewall is to protect you from a result, namely the stealing of private info (for example - there are other clbuttic results, namely changing private info or adding new info). It didn't stop the most private info of all being stolen! Now you claim that its use is to stop that private info being used to log in (as though they needed it the first time). Well, OK, but now the use is to prevent a breach being escalated.

It's like this - if you have a machine gun that only stops burglars entering when it detects that they are carrying your family jewels, then the machine gun is evidently not effective by design, because its only use is when it has already failed to protect you.

Personally, the only thing I'd bother with the zipper for is to attach a silent alarm to it, so I could watch the pickpocket trying.

I don't see it covered. But the page is very good.

I see no "conditions".

I believe *I* am the one who suggested that they can get the data from backups or via listening to a bluetooth keyboard, etc. I have heard nobody else refer to such mechanisms, except maybe in the last post or two, and therefore nobody has "pointed it out to me".

If they have that information, they have enough to be getting on with. It's likely there is enough there to reveal backdoors or allow "social" pressure to be applied. But I'm very dubious of this whole setup - why is ssh permitted only from IPs that nobody may log in to? What kind of setup is that? The usual use of ssh is to permit a "private" connecton accross the internet, using secure identification. The implication is that the intended use is "from anywhere":

ssh(1)

It is intended to replace rlogin and rsh, and provide secure encrypted communications between two untrustÐ ed hosts over an insecure network.

It does when her pocketbook is made of hardened zircon diamond and contains an interdimensional timelock that only a gamelan from Beta Centauri might have a chance of remembering the combination to. That's the degree of difficulty of breaking ssh by a frontal buttault - there is not the slightest sense in forbidding people from china from trying! Let them try! Pickpockets, welcome all!

In what way?

State the disagreement.

Peter