I need a good server firewall

[adrian]

This quarter, I have a security class, and we're using 2 Windows Server 2003 OSes in Vmware. Soon, my teacher will let us leave those machines on for the whole week, while he tests our security to those servers.

What's a good server firewall that will help protect my machines?

[lurkah]

What's a good server firewall that will help protect my machines?
Take your pick from choices too numerous to mention (http://www.google.com/search?hl=en&q=server+firewalls). :rolleyes:

[1stwahine]

It sure didn't help me any! There is a security leak! :mad: :rolleyes:

Auntie Lynn

[kamapuaa]

This quarter, I have a security class, and we're using 2 Windows Server 2003 OSes in Vmware. Soon, my teacher will let us leave those machines on for the whole week, while he tests our security to those servers.

What's a good server firewall that will help protect my machines?

So like, you want a solution where you can run host-based packet filtering on the VMware images?

[adrian]

Take your pick from choices too numerous to mention (http://www.google.com/search?hl=en&q=server+firewalls). :rolleyes:
I know that a few of you have servers or whatnot, so what do you guys recommend?

Oh yeah, my teacher can get into the school's network from his computer, so he'll probably hack into our computers when we're not at school.

[1stwahine]

Oh yeah, my teacher can get into the school's network from his computer, so he'll probably hack into our computers when we're not at school.

1-2-3-4-5-6-7-8-9-10
Whack Whack! :eek: :rolleyes:

(State's Evidence #5)

Auntie Lynn

[adrian]

Oh yeah, my teacher can get into the school's network from his computer, so he'll probably hack into our computers when we're not at school.

1-2-3-4-5-6-7-8-9-10
Whack Whack! :eek: :rolleyes:

(State's Evidence #5)

Auntie Lynn
He's like the head tech guy there, so they probably pay him for that.

[1stwahine]

He's like the head tech guy there, so they probably pay him for that.

I don't think it gives "anybody" a right to hack into somebody's computer without their knowledge...especially for their own creepy enjoyments! :eek:

That is so WRONG! :rolleyes: :mad:

Auntie Lynn

[adrian]

I don't think it gives "anybody" a right to hack into somebody's computer without their knowledge...especially for their own creepy enjoyments! :eek:

That is so WRONG! :rolleyes: :mad:

Auntie Lynn
I think I used the wrong word here. The class is about testing the security of the computers we have, and if we don't secure it properly, then the consequence is having the machine totaled (but then the teacher told us to backup the machine, so we'd only be down for a minute or so).

Plus, sometimes it takes hackers to become good security experts. And it could be worse: we could be using regular computers and our teacher and classmates can be breaking into our cases and stealing our components whenever we turn our back.

[zztype]

I don't think it gives "anybody" a right to hack into somebody's computer without their knowledge...especially for their own creepy enjoyments! :eek:

That is so WRONG! :rolleyes: :mad:

Auntie Lynn
No, Auntie, you misunderstand. That's the teacher's assignment: Adrian is supposed to set up a server and make it secure. The teacher is going to test to see if Adrian did it right. If Adrian did right, teacher won't be able to get in and Adrian "wins." If Adrian missed something, teacher will find it and break in. Then Adrian will fail the test.

It's just a school assignment.

Blaine

[Leo Lakio]

That's the teacher's assignment: Adrian is supposed to set up a server and make it secure. The teacher is going to test to see if Adrian did it right. If Adrian did right, teacher won't be able to get in and Adrian "wins." If Adrian missed something, teacher will find it and break in. Then Adrian will fail the test.
And if it's the school's equipment he is using (and not his own personal gear), then the school and instructor have every right to do so; in fact, they probably issued a statement outlining said rights at the start of the class.

[kamapuaa]

I just have to say this once: If you have a windows server on the open internet, you are going to get owned eventually. The last few years should have proven that the blackhat community really has it out for Microsoft. In a corporate environment, there is usually an extensive change control process that you have to go through in order to get permission for production server downtime. This lag is usually enough to get you in trouble before you can get permission to do anything about it.

I know it's not your assignment, but I would suggest having your firewall on a different system. It should be a totally stripped (preferably *nix) distribution, with a good stateful packet filter (eg: linux + iptables). Just my $0.02.

[i-hungry]

This quarter, I have a security class, and we're using 2 Windows Server 2003 OSes in Vmware. Soon, my teacher will let us leave those machines on for the whole week, while he tests our security to those servers.

What's a good server firewall that will help protect my machines?

"Server firewall"? Do you need a software firewall application like ZoneAlarm or a computer that acts as the firewall?

I never tried it yet but the latter can be done with Smoothwall. There's a short article on CNET about it.

http://reviews.cnet.com/4520-10165_7-5465494-1.html?tag=viddet

http://www.smoothwall.org

I'm not familiar with VMware but I hope that helps.

[akashastrega]

Well first of all, you want your server to not be windows based (easily hacked). Linux has a lot of command line stuff, but tends to be less holey. Kaspersky used to make firewalls for servers, but I do not know if they still do. Zone Alarm used to be ok, but it got into bed with some spyware corporations. Outpost and Black Ice are both EXCELLENT firewalls. Depending on what your project is, you can cose it with a personal hack that will detect outside intrusions. The point is for him to hack you and not get through. So you must be really careful about setting up your server. Any server with only a firewall can be hacked in 10 minutes, you need to set up a proxy if possible to stealth your server, and also, as I said, if possible add your own code into it.
I asked a hacker friend, this is his answer:
Michael says:
don't run windows
Jenn (akashastrega) says:
I said that.
Michael says:
i'd set it up running rehad enterprise and security proof it
Michael says:
then stick it behind a pix 550 firewall

Hope this helps.


edit:
Michael says:
a pix550 is a "Cisco Pix550" hardware firewall.. one of the toughest to hack hardware firewalls available on the market.
Michael says:
corporations often use them b/c they're such a bitch to hack.

[adrian]

So far, I haven't been attacked within the network, because this first half has been focusing on physical attacks (people physically going to unlocked machines and hacking/messing with it [the vmware machine, not the physical computer]). But the good news is that in 2 weeks, we'll be networking our computers together and that's when the fun begins! Using what we learned in the first half, we'll be segmenting/routing/switching connections and whatnot till a fight breaks out (okay, not that much, but it'll force some people to either drop out or have white hair).

I believe the router will have a built in firewall, but that's up to the teacher.