poll: which firewall distro u use?

Hi all, folks i am curious about the firewall distro you use either at your work or at home. I will like to know about the following questions,
- Are you running any type of proxies on it (squid, dns, pop, smtp and ftp proxy)?
- Is this possible to port forward (from local to internet)?
- Can you use your firewall as nat router?
- Why you choose this distro instead of any other?
- How much easily you can configure it?
- Support for VPN?
any other strong point which forced you to use the distro??

If the distro you are using is not listed here you can mention it.

Thanks

Waiting to here some good points.

(Edited: to change 'u' to 'you' and 'ur' to 'your')

First off, www.webster.com

U need 2 clean up ur akt. That is pathetic. You look like a skiddie wannabe who is too ignorant to make a clearly communicated request.

Second...what do you mean by 'distro'? As in, distribution? As in, linux embedded distribution? These all look like open source, GPL'd types of firewall app's. I am not certain, but if I'm right that's not much of a definitive list. Where's the CISCO, Check Point, NetScreen, Juniper, and Sonic Wall firewalls? Are you asking for software firewalls only? Open source software firewalls only? Open source GPL and blessed by his holy grace ERS software firewalls only?

Smoothwall..

www.smoothwall.org

Have IPcop, but havent tested/played with it enough to deploy anywhere..

what zencoder said.


but to answer some questions.

Work = Nokia CheckPoint FW1 NG w/AI

Home = smoothwall

Home: Computers -> Router (nat) -> Smoothwall -> DSL Modem -> Internet

Been rigged this way for two years and am quite pleased. And just for shitz and grins, Sygate on the Computers.

~cheers~

smoothwall

Work: Sidewinder G2
- Yes, it runs proxies for all of our services.
- Yes, it is possible to port forward
- Yes, it can be perform NAT duties
- Because it offers the required level of assurance for our needs and featured the best fitting ROSI.
- We were able to easily configure it to meet our needs, not sure what you mean beyond that
- Yes, it supports VPN
- It is the fighest assurance firewall appliance on the market

Home: None
- Yes, it can run proxies
- Yes, it can port forward
- Yes, it can perform NAT duties
- Because it met my needs most exactly
- Yes, it was very easy to configure
- Yes, it supports VPN
- Again, because it met my needs most exatly

cheers,

catch

Currently using Bastille
Edit: using firestarter, forgot it was there... hehe

Oh Bastille... (which isn't a firewall by the way, it is a suite of OS hardening/reporting tools)

http://www.argus-systems.com/public/...epaper.osh.pdf

cheers,

catch

IPcop for me, but if you make your own, Catch is right on, bastille is a great set of scripts to point you in the right direction, then try firewall-builder on top and lock it down.


-Maestr0

Heh, I guess you didn't look at the link I posted. ;)

System hardening is good, but incomplete. I actually don't care for Bastille, nor do I care for any firewall that resides upon a full featured OS. Exceptions of course being multilevel systems or those using type enforcement.

cheers,

catch

Quote:

---

Originally posted here by zencoder
First off, www.webster.com

U need 2 clean up ur akt. That is pathetic. You look like a skiddie wannabe who is too ignorant to make a clearly communicated request.

Second...what do you mean by 'distro'? As in, distribution? As in, linux embedded distribution? These all look like open source, GPL'd types of firewall app's. I am not certain, but if I'm right that's not much of a definitive list. Where's the CISCO, Check Point, NetScreen, Juniper, and Sonic Wall firewalls? Are you asking for software firewalls only? Open source software firewalls only? Open source GPL and blessed by his holy grace ERS software firewalls only?

---

Ok i have corrected the mistakes. I am looking for opensource GPL'd (software) types of firewall distributions.

Hey Hey,

When I setup my team in CIPHER I actually used a HDD install of WHAX as the router/firewall.. It worked out well.. and took about 5 seconds to setup.

As far as other distributions I've used. I'd like to vote for one that's not on the list.

FREESCO (FREE ciSCO) which can be obtained from http://www.freesco.org/.

Min Requirements:

Quote:

---

Minimum instal requires a 386sx 16 with 8mb of ram. 16+mb of ram is recommended for enabling servers;

---

I'm actually sort of sad that it didn't make the list, we used it at work on our VLAN.. This was later removed but the person that set the place up wasn't into networking and was a programmer... We had two servers behind it, one was Windows running at the same apache and php with mysql... The other was linux and running file storage. When I started I redid it so that Linux had apache w/ php and mysql and windows was the file storage, however either way FreeSCO worked great for us... It's quick, easy to use and easy to learn (which made it great to pass on from employee to employee in the co-op placements) and it did everything we needed and more.

Quote:

---

Main Page "Sales Pitch"
Ease of use - it's insanely easy to set up
Thoroughly documented - it's more or less self contained, read one doc and you're off and running
Like most players in this field, it runs off one floppy
FREESCO runs in as little as 8 Mb RAM.
Unique Web Control Panel

---

Quote:

---

Facts
FREESCO was developed in the open source tradition as an alternative to routing products offered by Cisco, 3-Com, Accend, Nortel etc. All of these companies offer products that are well made, but they are also proprietary and expensive. Between the cost of the equipment and support, you'll spend a great deal and only address one or two of your networking needs .. Additionally, by being closed source (proprietary), many of these products restrict the user from modifying the source software to better suit their needs and easily fix problems that arise.

FREESCO is based on the Linux operating system and incorporates many of the features of a full operating system into software that fits on a single 1.44 meg floppy diskette. With FREESCO, you can make:

a simple bridge with up to 10 Ethernet segments
a router with up to 10 Ethernet segments
a dialup line router
a leased line router
an Ethernet router
a dial-in server with up to 10 modems (with multiport modems).
a time server
a dhcp server
a http server
a ftp server
a dns server
a ssh server
a print server (requires TCP/IP printing client software)

FREESCO also incorporates firewalling and NAT which are resident within the Linux kernel to help protect you and your network. All of these features can be used in conjunction with each other or individually.

---

Peace,
HT

[Edit]

It also has addon software at http://www.freescosoft.com/home/. Including a VPN daemon, hping2, irssi and others.

[/Edit]

Oh yeah, Argus. Those are the guys that offered the cash reward to anyone who could hack Pitbull then stiffed LSD after they 0wnzored it. Sweet.


-Maestr0

Work: CyberGuard

Home: Smoothwall and Sygate on windoze boxes

Quote:

---

Oh yeah, Argus. Those are the guys that offered the cash reward to anyone who could hack Pitbull then stiffed LSD after they 0wnzored it. Sweet.

---

Unfortunately before that OpenHack... VC people took over and the company dramtically changed... went downhill in my opinion.

cheers,

catch

I have been using ipcop for quite a while...it gets the job done.

At home I use a ripped-to-shreds(r) Slackware install on an old pII333

This does the load-balancing ( via http://l7-filter.sourceforge.net/ ) and stuff for my adsl and cable internet !

Loads of iptables and qos rules that evolved over a couple of years..

Quote:

---

Originally posted here by Maestr0
Oh yeah, Argus. Those are the guys that offered the cash reward to anyone who could hack Pitbull then stiffed LSD after they 0wnzored it. Sweet.


-Maestr0

---

Yeah and there new slogan is "The face you can trust", yeah right after you blatantly burned LSD after the media was gone
They are real shady, whenever someone asks me about there product I tell them to stay away like the plague.

Quote:

---

Yeah and there new slogan is "The face you can trust", yeah right after you blatantly burned LSD after the media was gone

---

Their product is still quite good, better than anything comparable on the market anyhow.

To be fair LSD did not win by the rules they had specified and he only was able to compromise the machine as a result of Sun being amazingly lazy... with an overly zealous configuration coupled with use of their least tested Pitbull (for Solaris x86). Also to be fair, it isn't like LSD did some super amazing hacking or anything like that. The vulnerability had been known for some time. Sun failed to patch it, and Argus failed to consider it. (the system still could have been secure)

At the end of the day, they should have paid LSD... but even more importantly the should have used a real version of Pitbull with a more real world configuration.

It did, on the otherhand stress the importance of a reference monitor. So many people think that you just add some extra controls to UNIX/Linux (TrustedBSD, SELinux, Trusted Linux, Pitbull) and suddenly you have a Trusted Operating System. This couldn't be further from the truth, especially when your "mandatory" controls can be disabled.

Still Pitbull is good, but the company has lost its way abit since Jeff Thompson left. (and the document I linked to, is still spot on)

cheers,

catch

I'd prefer not to share the details of my firewall with those I meet on the interweb. It would seem similar to flaunting your earnings statements in front of the irs....just not a good idea.

If your security system is effected even by complete disclosure... it isn't very good.

cheers,

catch

I never said it was effected. I simply said I don't believe it's a good idea. =p

Bah... make something up then. ;)

"I run a hacked up Zone Alarm via WABI on my NetBSD powered microwave oven."

cheers,

catch

I use ipsec as a port filter. =)

Quote:

---

To be fair LSD did not win by the rules they had specified

---

The rules were to compromise the web server. Thats what they did, fair and square.

Quote:

---

Also to be fair, it isn't like LSD did some super amazing hacking or anything like that. The vulnerability had been known for some time. Sun failed to patch it, and Argus failed to consider it.

---

Great! So even an unskilled lazy attacker can compromise a machine protected by PitBull, sounds like an amazing product, how much does that cost?
The exploit was known in the underground but was not posted on any buqtracking nor was a patch available.


-Maestr0

Wait, so "LSD" got nothing out of it?!

Maestr0... now you're just being ignorant and argumentative.

The rules of the contest were not to just compromise the webserver, otherwise the system would have been open to physical attack. The rules were actually quite clear. The Pitbull system needed to be compromised, it was not. (They still should have paid out... and they did, just not the full amount, which was legal, because technically he didn't win)

Quote:

---

Great! So even an unskilled lazy attacker can compromise a machine protected by PitBull, sounds like an amazing product, how much does that cost?

---

Seriously... go read the details of the system. The used a beta product configured in a totally unrealistic manner. (effectively giving everyone root access)

It is really silly of you to judge the product based on that contest alone... you should prolly look at all the contests before that one, when the system was managed in a sane way and an actual production level system was used. Pitbull is unquestionably the best security package for Linux and Solaris

Quote:

---

The exploit was known in the underground but was not posted on any buqtracking nor was a patch available.

---

The hole had been published on x86 Solaris lists, it was known by Sun and their reply was basically "That isn't really a product we care all that much about supporting." Had the people at Argus not been a bunch of jackasses (all the new people were in at that point) and just followed their own TFM, the bug in question would not have been exploitable.

This is the kind of stupid **** people do on here all the time, I guess it is just because you don't know any better... but anecdotal evidence about system security is completely and utterly meaningless. Counting vulnerabilities or exposed systems? Capture the flag and openhack contests? It's all media bullshit and nothing more. Had Pitbull survived a billion attacks and was never compromised during 10 years of openhacking... would that prove it was secure? Nope. Just like this instance of being compromised (the system was configured in a manner that would be considered compromised out of the gate for a normal system) doesn't prove the system is insecure.

So stop being so obtuse.

catch

Oh,come on... catch, you're peddling the same bullshit you tell everyone to watch out for. I've seen the papers, but like a previous conversation we had, I dont believe in paying to build a castle on a swamp. I am being argumentative but not ignorant, because what you're saying is dumb. First you say how sweet it is, and when I mention LSD hacking it, you say it was no big deal and it was an easy hack. What?????

Quote:

---

The used a beta product configured in a totally unrealistic manner.

---

What?????They used their product, configured and setup by THEM, they only make **** for Linux and Solaris, the platform was x86 Solaris, if the company that builds it and a team of engineers can't configure it correctly IN A RIGGED SETTING, what the hell do I want to buy it for?

Quote:

---

you should prolly look at all the contests before that one

---

Like the one before where Bladez hacked it but also wasnt paid (Face you can trust, huh) because he was four hours late? How much does this cost again?
And read LSD's paper. Hell, read Argus's statements after the contest.

Quote:

---

The Pitbull system needed to be compromised, it was not.

---

"We did manage to find such a vulnerability and additionally to find a bug in Pitbull itself. In result we were able not only to modify one of the virtual websites (what was required according to the challenge rules) but also to completely bypass Pitbull's access control mechanisms and even to turn off the protection system completely."

"Our successful performance was officially accepted and announced by the Challenge committee, consisting of Argus and sponsor representatives (Fujitsu-Siemens)." -LSD

Wait, so the Pitbull Secure Web Appliance doesnt prevent the website from being defaced or prevent Pitbull itself from being disabled, since it wasnt compromised.WHAT???? What the **** does it do then?
You would be able to read the announcments and the rules Argus made except Argus, the face you can trust, seems to have misplaced all that stuff. Get real catch dont say I'm being ignorant just cause you bought into the Trusted OS of the month. I got some **** I'll sell you, you'll never get compromised, promise.

-Maestr0

The Pitbull system in question was not configured to be secure.... well not as secure as it could be. They dilberately gave attackers WAY more access than would ever been seen on a live system just to make a point. This of course backfired on them... but on a normal website, you don't allow users to telnet in and provide the root password. (which was what the Argus team did) It isn't like they were too dumb to configure it.

Had they used normal Solaris the system would have remained secure.

The point is, it wasn't a real world situation... they just got big heads.

The vulnerability was NOT in Pitbull... it was in x86 Solaris, the Argus team allowed attackers access to the OS without being confined to its type enforcement as would normally happen. This of course allowed the attacker to disable Pitbull. Pitbull however worked well within its design and again the Argus team was just a little too full of themselves to allow such a path. The same type of vulnerability coupled with the same type of configuration and every single Trusted extension would fail in the same manner... including SE Linux, LIDS, and Trusted BSD. A real TOS wouldn't have this issues, because its controls cannot be toggled.

The Trusted OS of the month? Pitbull isn't a Trusted OS... it merely adds some trusted functionality to normal systems. This is the same thing people believe about SE Linux and so forth... MAC doesn't make it trusted, you need a reference monitor at the very least.

And again, had they configured the system to be secure and not to make a point ("we can give away root and you still can't hack us! nah nah nu nah nah") the system would not have been defaced as there exist no vulnerabilities (still) that could bypass it.

You are making the grave mistake of assuming that the Pitbull product, which was made by the old Argus team is bad, just because the people who bought the company are a bunch of dicks. Unfortunately this is very flawed logic.

cheers,

catch

PS. Pitbull isn't an appliance. From your posts, it is clear that you are not familair with Pitbull at all... so why don't you either educate yourself or let it drop... arguing with hearsay is really silly.

I am currently trying out Trustix...seems fairly easy to setup and use.
http://www.trustix.net/

catch, the machine LSD hacked was a preconfigured system (ED: The diffrenence was this was x86 Solaris) they used to sell. Pitbull is a line of products not one. Quit being hellbent stubborn and take your own advice, go learn something about it.

*sigh*

-Maestr0

"Everything changed for Argus in April, 2001 with their fifth Hacker Challenge, organized in association with security consulting firm Integralis and hardware vendor Fujitsu Siemens, and timed to coincide with the Infosecurity Europe conference in London. The competition revolved around Argus' then-undefeated Pitbull Secure Web Appliance, a machine running sophisticated security enhancements to the Unix kernel built on the "trusted operating system" model cherished by the Pentagon."

http://online.securityfocus.com/news/1717


Argus Systems Group Develops Cost-Shattering Secure PitBull Appliance


"We provide software that converts Unix-based operating systems into Trusted Operating Systems. For example, we offer a product for the AIX operating system from IBM and a similar product for the Solaris operating system from Sun Microcomputers. We also have products for many Linux-based server systems."

http://www.argus-systems.com/company/faq.shtml

Quote:

---

catch, the machine LSD hacked was a preconfigured system they used to sell.

---

No, it wasn't. External users had the ability to create new system accounts (what the vulnerability relied upon) and perform administrative duties and operate under UID:0.

This is nothing like anything they ship.

Quote:

---

Pitbull is a line of products not one.

---

Sorta... the .com pack and then Pitbull (LX for linux). They were using the .com pack for x86 Solaris.

Quote:

---

Quit being hellbent stubborn and take your own advice, go learn something about it.

---

I have used their products for years and was a consultant on their NT line before it was sold off. What was the last Pitbull system you used?

Pitbull is NOT an appliance, it is an extension for full featured systems that run on standard COTS hardware. (as is stated by their own release about it working with AIX, Solaris, and Linux) Appliances are limited in their functionality and require proprietary hardware.

Pitbull is not a TOS, it uses TOS mechanisms placed on top of a standard operating system. Trusted system must have a reference monitor and the mandatory access controls are exactly that... they cannot be toggled.

Just because the press uses incorrect terms, doesn't mean that we should... as "experts."

cheers,

catch

I like M0n0wall, stick it on a piece of kit like the ones from Soekris, and you have a fine home firewall.

For corp use, Cyberguard is great (at least i think it is) and OpenBSD makes a nice firewall if you are strapped for cash.