Very Computer

Any voices of experience out there who are using proxy firewalls to provide
internet access via http proxy to Solaris desktops?  I am very interested
in what the potential risks to UNIX filesystems may be associated with
such a configuration.

Is it possible to filter out JAVA applets from the internet proxy feed while
allowing the use of JAVA in the intranet?

Thanks for any wisdom you might be willing to share.

There are some proxy firewall  type products which claim to do this
  Mine sweeper ?? (does email as well)
also
  SurfinGate   http://www.finjan.com/

I am not shure how the Proxy Firewall  could effect the security of
your UNIX NFS Environment (unless yopu tell the proxy to do things with
NFS and the Internet).
I guess your firewall is protecting your NFS filesystems

Hope this is of some use

--
Richard Westlake

Crystallography Dept. , Birkbeck College, Malet Street, London WC1E 7HX
Tel: 0171-631-6859

-----BEGIN PGP SIGNED MESSAGE-----

I think it's called MIMEsweeper.

An alternative approach is the Digitivity CAGE (N.B. I work for
Digitivity).  Rather than simply filtering out applets from outside
the intranet, it can be configured to run applets on a sacrificial
host in the DMZ, with a GUI pipe to the desktop.

If your firewall is correctly configured, then applets running on the
CAGE host won't be able to access your NFS files, even if there's a
bug in the VM (you can't say that for applets run in a browser, where
the Java runtime is your only protection).

It doesn't prevent you running intranet applets within the browser -
in fact, that's how we're configured internally.

<URL:http://www.digitivity.com/> for the full score.  [Text-only
version at <URL:http://www.digitivity.com/text/>].

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQB1AwUBNCkdL+dsuUurvcRtAQGbsAL+NK8FW7iDqa3O6IohwIMCsvfrYKJWWzXL
BrmZdvGCJ4nOROzYgQEavcVeaNDTVgVsUW3kciMQgpneDY4f9Z3o8xalysBK4V42
axqwqiheQaxhEmsl1EPkSV64N37zRKhe
=8fGi
-----END PGP SIGNATURE-----

--
----------------------------------------------------------------------
Thomas H. Ptacek                                Secure Networks, Inc.
----------------------------------------------------------------------
                                              "mmm... sacrilicious..."