Very Computer

by **Phil** » Thu, 16 Aug 2001 05:59:27

All -

I have a Sun e450/Solaris 7 with hme0 and hme1. hme0 goes to a
non-secure network. hme1 goes to a private, secure network that only
has one other device on it.

hme1 *must* have ftp, rlogin and nfs ports open. I definitely do NOT
want those (and other ports) open on the hme0 interface. How can I
accomplish this? Is there a way of having /etc/services and
/etc/inted.conf PER hme#? Some other mechanism? (TCPWrappers is not an
option at this point, but I hope to use it in the future ...).

Please post or email and I will summarize to the group(s).

philc
phil-atnospam-macostech.com

by **Akop Pogosia** » Thu, 16 Aug 2001 07:27:58

Quote:> All -
> I have a Sun e450/Solaris 7 with hme0 and hme1. hme0 goes to a
> non-secure network. hme1 goes to a private, secure network that only
> has one other device on it.
> hme1 *must* have ftp, rlogin and nfs ports open. I definitely do NOT
> want those (and other ports) open on the hme0 interface. How can I
> accomplish this? Is there a way of having /etc/services and
> /etc/inted.conf PER hme#? Some other mechanism? (TCPWrappers is not an
> option at this point, but I hope to use it in the future ...).
> Please post or email and I will summarize to the group(s).
> philc
> phil-atnospam-macostech.com

The best way to do this is to use a packet filter such as IP Filter:
http://coombs.anu.edu.au/~avalon/ip-filter.html

or SunScreen.

-akop

by **Greg Andre** » Thu, 16 Aug 2001 07:29:48

>All -

>I have a Sun e450/Solaris 7 with hme0 and hme1. hme0 goes to a
>non-secure network. hme1 goes to a private, secure network that only
>has one other device on it.

>hme1 *must* have ftp, rlogin and nfs ports open. I definitely do NOT
>want those (and other ports) open on the hme0 interface. How can I
>accomplish this?

A packet filtering router on the hme0 interface is often the
simplest approach.

-Greg
--

I have a map of the United States that's actual size
-- Steven Wright

by **Dave Mine** » Fri, 17 Aug 2001 00:23:10

> All -

> I have a Sun e450/Solaris 7 with hme0 and hme1. hme0 goes to a
> non-secure network. hme1 goes to a private, secure network that only
> has one other device on it.

> hme1 *must* have ftp, rlogin and nfs ports open. I definitely do NOT
> want those (and other ports) open on the hme0 interface. How can I
> accomplish this? Is there a way of having /etc/services and
> /etc/inted.conf PER hme#? Some other mechanism? (TCPWrappers is not an
> option at this point, but I hope to use it in the future ...).

If you were running Solaris 8, I'd tell you to use the built-in IPsec
filtering. But since you're not, I'd concur with others who suggested
either IPfilter or an external filtering router.

Dave

by **Thomas H Jones I** » Fri, 17 Aug 2001 01:36:03

Quote:>All -

>I have a Sun e450/Solaris 7 with hme0 and hme1. hme0 goes to a
>non-secure network. hme1 goes to a private, secure network that only
>has one other device on it.

>hme1 *must* have ftp, rlogin and nfs ports open. I definitely do NOT
>want those (and other ports) open on the hme0 interface. How can I
>accomplish this? Is there a way of having /etc/services and
>/etc/inted.conf PER hme#? Some other mechanism? (TCPWrappers is not an
>option at this point, but I hope to use it in the future ...).

for ftp and rlogin, xinetd would allow you to configure services per
interface.

for nfs, youd need a kernel level packet filter like ipfilterd.

-tom
--

"You can only be -so- accurate with a claw-hammer." --me

Very Computer

limiting service access by hme#

limiting service access by hme#

limiting service access by hme#

limiting service access by hme#

limiting service access by hme#

limiting service access by hme#