Avira's firewall

[gufus]

Hi Grant,

Sunday April 11 2010, Grant Taylor writes to All:

> I'm not so much filtering the same thing that the edge
> firewall is filtering. Rather, I'm filtering other things
> that other servers behind the edge firewall could attack.

With only /basic/ networking experience, I can't /see/ anything wrong with
this theory, It can only increase security, what if a employee infects via a
CD.
....
IMHO (In my humble opinion)
AKA: gufus

--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Get off my back, I can't swim either!

[gufus]

Hi Ansgar,

12 Apr 10, Ansgar -59cobalt- Wiechers writes to Gypsy BBS:

> From: usenet-2010@planetcobalt.net

> Wrong. Running an additional firewall means running
> additional code that can contain additional exploitable

No comment (for now)

> misconfiguration, which in turn may inadvertently
> open attack vectors.

Brief your employees.

> What if? That employee's computer still needs to be able to
> access the server, meaning the server's ports still need to
> be open, meaning that the personal firewall won't help
> anything at all.

Agreed.. anti-viral /should/ be install on the network, obviously stopping this
first.


--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Can I blame my spelling on line noise?

[gufus]

Hi Ansgar,

12 Apr 10, Ansgar -59cobalt- Wiechers writes to Gypsy BBS:

> make a mistake or overlook something. You could brief them
> all day long and still not prevent this from happening.

Tell me about it... good-bad employees. :(

--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Evangelists do more than lay people.

[gufus]

Hi Ansgar,

12 Apr 10, Ansgar -59cobalt- Wiechers writes to Gypsy BBS:

> You missed the point again. Even the best employees are

I beg to differ. Sir.

Employees /need/ to understand the system, especially when I have MS-DOS
workstation(s), try getting MS-DOS talking to a Win NT server. <grin>

>> -+- SoupGate-Win32 v1.05
>> + Origin: Calgary Organization CDN Fidonet-Internet Gateway
>> (1:342/77.10)

--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Nothing is ever a complete failure; it can always serve as a bad example.

[gufus]

Hi Ansgar,

13 Apr 10, Ansgar -59cobalt- Wiechers writes to Gypsy BBS:

> From: usenet-2010@planetcobalt.net
>> Employees /need/ to understand the system,

> True, but besides the point. Repeating myself: even the best
> employees are still human and *will* make mistakes here and

Agreed... and you don't have to repeat your self, there will always be human
error in life. Thats life.

gufus
--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Dr. Scott!" " Janet!" " Brad!" "Rocky!" "Uhhh!

[gufus]

Hi Grant,

12 Apr 10, Grant Taylor writes to All:

> Conversely if the web servers were running a software based
> firewall, they could easily filter SNMP and / or RPC traffic
> so that only the management station(s) could access them.
> There by protecting them from the program running locally on
> the compromised server.

> These types of side attacks (if you will) are what I'm
> saying that a software based firewall will help prevent.

I still think your way is more secure. IMHO.

gufus
--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Up your accumulator.

[gufus]

Hi Ansgar,

13 Apr 10, Ansgar -59cobalt- Wiechers writes to Gypsy BBS:

>> I still think your way is more secure. IMHO.

> That's simply because you entirely failed to understand the
> implications.

Have fun hashing it out with Grant. :)

--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... Take the bull by the hand and avoid mixed metaphors.

[gufus]

Hi Grant,

13 Apr 10, Grant Taylor writes to All:

>> True, but besides the point. Repeating myself: even the
>> best employees are still human and *will* make mistakes

> I agree. The human element of a network is (at times) one
> of it's weakest links.

Hmmmm... sounds like an echo here. <grin>

With only basic networking skills, I'm taking notes on you discussion with
Ansgar, interesting to-say-the least.

gufus

--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... A man without a religion is like a fish without a bicycle.

[gufus]

Hi Grant,

Wednesday April 14 2010, Grant Taylor writes to Gypsy BBS:


> Ansgar seems to have a very strong opinion on what we are
> discussing. Further, Ansgar is presenting logical points to
> support his / her opinion. With no insults going back and

Nice... yes no insults, I guess with myself he/her didn't like what my opinion
was about this thread, which started about a server having a firewall, but
with that, I do understand, /first/ firewall the network boundary, then if
wanted/needed firewall everything behind it.


> That being said, Ansgar has presented a couple of compelling
> points:
> 1) The code of the firewall its self could be a
> weakness.
> 2) There is little point in protecting one server from
> another when both can be attacked the same way that
> successfully exploited the first.

Good points! Agreed!

Kind Regards.
--
K Klement

Enhance your marketing at http://www.gypsy-designs.com
mailto:info@gypsy-designs.com
Gypsy Designs Fax: (403) 242-3221

.... It is annoying to be honest to no purpose.

[gufus]

Hello, All!

Is any one here using Avira's firewall? it's is included with Avira's
Security Suite. I want to upgrade my servers firewall.
If not... any suggestions for a good firewall would be great.
--
With best regards, gufus. E-mail: stop.nospam.gbbsg@shaw.ca

[Jimmy Jiiimz]

"gufus" <stop.nospam.gbbsg@shaw.ca> wrote:
> Hello, All!
>
> Is any one here using Avira's firewall? it's is included with Avira's
> Security Suite. I want to upgrade my servers firewall.
> If not... any suggestions for a good firewall would be great.

I wouldn't recommend a software based firewall on a server! Go out and
buy a hardware device like from WatchGuard, Fortinet, Juniper etc...

--
Jimmy

[Benji Z-Man]

On 08/04/10 14:31, Jimmy Jiiimz wrote:
> "gufus"<stop.nospam.gbbsg@shaw.ca> wrote:
>> Hello, All!
>>
>> Is any one here using Avira's firewall? it's is included with Avira's
>> Security Suite. I want to upgrade my servers firewall.
>> If not... any suggestions for a good firewall would be great.
>
> I wouldn't recommend a software based firewall on a server! Go out and
> buy a hardware device like from WatchGuard, Fortinet, Juniper etc...
>

^ This.

On a personal computer, however, Avira is... alright. Just be prepared
for some issues if you have programs that you'd like to give routine
permissions to, or opening ports.

I'd personally recommend Sygate except that they got absorbed into the
Symantec oozeball.

[schtebo]

On Apr 8, 12:19*am, "gufus" <stop.nospam.gb...@shaw.ca> wrote:
> Hello, All!
>
> Is any one here using Avira's firewall? it's is included with Avira's
> Security Suite. I want to upgrade my servers firewall.
> If not... any suggestions for a good firewall would be great.
> --
> With best regards, gufus. *E-mail: stop.nospam.gb...@shaw.ca

Hi Gufus,

as far as i know Avira Premium Security Suite ist not for Servers.
If you try to install you should be notified that Microsoft Server ist
not supported.
I think default Firewall from Microsoft should do it for us all.

[Benji Z-Man]

On 08/04/10 21:50, schtebo wrote:
[ Snip ]
> I think default Firewall from Microsoft should do it for us all.

Ktchk- are you insane?

[Jon Solberg]

On 2010-04-08, Benji Z-Man <khormin@bigpond.com> wrote:
> On 08/04/10 21:50, schtebo wrote:
> [ Snip ]
>> I think default Firewall from Microsoft should do it for us all.
>
> Ktchk- are you insane?

No, just Microsoftcentric. A common disease these days.

--
Jon Solberg (remove "nospam." from email address)

[Ansgar -59cobalt- Wiechers]

Benji Z-Man <khormin@bigpond.com> wrote:
> On 08/04/10 21:50, schtebo wrote:
> [ Snip ]
>> I think default Firewall from Microsoft should do it for us all.
>
> Ktchk- are you insane?

This coming from someone who recommended Sygate, of all things. A
firewall with well-known critical design flaws, like running an
interactive service with SYSTEM privileges.

The Windows Firewall is perfectly fine for blocking inbound connections.
Outbound connections can't be controlled reliably anyway, not to mention
that once they happen, the system already has been compromised.

cu
59cobalt
--
"Personal Firewalls are crap. Throw away any personal firewall. Personal
Firewalls are bad[tm]."
--Malte von dem Hagen on security-basics

[Benji Z-Man]

On 08/04/10 23:27, Ansgar -59cobalt- Wiechers wrote:
> Benji Z-Man<khormin@bigpond.com> wrote:
>> On 08/04/10 21:50, schtebo wrote:
>> [ Snip ]
>>> I think default Firewall from Microsoft should do it for us all.
>>
>> Ktchk- are you insane?
>
> This coming from someone who recommended Sygate, of all things. A
> firewall with well-known critical design flaws, like running an
> interactive service with SYSTEM privileges.

Honestly did not know that. Anything else you can point out about it,
then? And where I can verify that?

[Rick]

Jimmy Jiiimz wrote:
> "gufus"<stop.nospam.gbbsg@shaw.ca> wrote:
>> Hello, All!
>>
>> Is any one here using Avira's firewall? it's is included with Avira's
>> Security Suite. I want to upgrade my servers firewall.
>> If not... any suggestions for a good firewall would be great.
>
> I wouldn't recommend a software based firewall on a server! Go out and
> buy a hardware device like from WatchGuard, Fortinet, Juniper etc...
>

i have heard that recommendation many times and do not dispute it, but
assuming that the s/w firewall comes up first during boot up, WHY would
you insist on not having a s/w firewall on a server?

[gufus]

Hello, Jon!

You wrote on Thu, 8 Apr 2010 13:16:07 +0000 (UTC):

>>> I think default Firewall from Microsoft should do it for us all.
>>
>> Ktchk- are you insane?
|
| No, just Microsoftcentric. A common disease these days.

Unworthily... I guess. :-)

--
With best regards, gufus. E-mail: stop.nospam.gbbsg@shaw.ca

[gufus]

Hello, Benji!

You wrote on Thu, 08 Apr 2010 05:01:44 GMT:

| for some issues if you have programs that you'd like to give routine
| permissions to, or opening ports.

I do.

| I'd personally recommend Sygate except that they got absorbed into the
| Symantec oozeball.

I /don't/ do Symantec. <grin>

--
With best regards, gufus. E-mail: stop.nospam.gbbsg@shaw.ca