jails, ipfilter & stunnel

[Uwe Doering]

Pawel Jakub Dawidek wrote:
> On Tue, Jul 15, 2003 at 09:12:53AM +0200, Uwe Doering wrote:
> +> >My advice is simple: every jail and main host should have its own IP 
> +> >address.
> +> 
> +> This is certainly the best solution, if you have multiple IP addresses 
> +> at your disposal.  What I was trying to point out is that there is no 
> +> _technical_ reason for separate IP addresses with regard to FreeBSD's 
> +> jail implementation.  In cases where you cannot easily get additional IP 
> +> addresses, on a rented server in a data center, for instance, running 
> +> multiple jails on the same IP address (with the necessary safety 
> +> precautions like binding daemons to IP addresses explicitly) is still 
> +> far better than no jails at all.  The difference is that it takes at 
> +> least some skill and insight into FreeBSD internals to compromise the 
> +> system as a whole in the former case, while in the latter each and every 
> +> script kiddy can take over your entire server in no time.
> 
> IMHO security solutions that are "harder to break", aren't security
> solutions.

Sure, everybody should afford an opinion.  However, as you are certainly 
aware there is no absolute security, no magic bullet.  Security is like 
an onion, with multiple layers.  You grab as many layers as you can 
under the given circumstances and try to make the best of it.

If the person responsible for server security is willing to add third 
party code to the kernel (as you suggest) he might be rewarded with an 
additional layer.  I say "might" because there is always the risk of 
introducing instability with changes like these.  If he would rather not 
touch the kernel he has to put up with a lower degree of security.

In the end it boils down to an assessment of how much security you 
really need with regard to what you are trying to protect.  Otherwise 
you quickly end up in overkill (to the delight of the security industry, 
undoubtedly).

     Uwe
-- 
Uwe Doering         |  EscapeBox - Managed On-Demand UNIX Servers
gemini at geminix.org  |  http://www.escapebox.net