Captain Crunch's New Boxes, Part II

micsaund writes: "It looks like the infamous Captain Crunch has been toiling away for 3 years on a firewall now known as the Crunchbox. It runs OpenBSD and is administered via a web-based interface. Steve Wozniak is quoted as saying it's 'next to un-crackable.' Check it out at ShopIP. The Register also has an article on it. As an aside, since the Linux Router Project (LRP) appears to have been sold-out and GnatBox is a tad expensive, is anyone aware of some kind of 'packaged' firewall with a slick interface available for free?" We mentioned Draper's venture into firewalls last year, but there's been some progress since then.

Comments

Just make sure

[javaaddikt]

that you don't have a modem in your crunchbox
:)

If you send it an MP3 of the correct frequency

[Twister002]

Can you get into it?

Safe?

[spt]

How many backdoors are there in it?

Re:Safe?

[MisterBlister]

Just the one.

Free Firewall

[L053R]

Check Out www.bbiagent.com cool, free, easy to use...

Re:Free Firewall

[bleckywelcky]

Does anyone know if there are similar floppy-sized firewalls that will allow you to use 2 internet connections in one machine (as well as the LAN connection, so 3 NICs total - or 2 NICs and a modem, etc). In order to use one connection as a backup in case the other connection fails. Or, even better yet, use both connections at all time and piggy-back the bandwidth. I've looked into trying to do this with just Win XP, but the only way I would be able to get anything to work was to just install all three NICs and alternately disable whichever connection I did not want to use. And my luck with Linux hasn't been great in the past, so I left it at that for now - whether you could set something up like that there, I am not sure. It would be really useful to be able to piggy-back the bandwidth of the two connections, and even more useful to do it off a similar floppy firewall setup that I've seen on some of these pages.

Re:Free Firewall

[Shanep]

Check these guys out, along with these guys.

Really nice headerless SBC with 3x 100TX, BIOS supports serial console, etc and OpenBSD whittled down to fit into 32MB CF card `disk'.

Re:Timothy

[MisterBlister]

me too.

Smoothwall

[ViceClown]

Installs in a snap, free download, stupendous interface, good support. I've used it for months now without a hickup. Just my $0.02

Smoothwall

Cheers :-)

Re:Smoothwall

[GSloop]

I've never used smoothwall, and I haven't gotten any support, so I am giving "hearsay" here...

But, from what I gather, and I have done some searching, Dick (aka Richard Morrell) seems to have a few screws loose. From all accounts, he is cranky and sometimes more than downright nasty.

His product is FREE though, you should just don your asbestos suit should you go looking for support. (View a few IRC logs etc. to get a feel for how "Dick" seems to view newbies and/or non-paying customers.)

Frankly, I'd rather do some extra work myself, than deal with people who are unsociable.

All standard disclaimers, YMMV etc.

Cheers!

Re:Smoothwall

[Anonymous Coward]

Well, I'm glad that you had nice experiences, but the general consensus seems to be that good support is a rare thing from Smoothwall (hence IPCop.org, I guess). They certainly carve bold new diretions for customers service! They'll swear at you, not answer emails, and not rarely answer specific questions (instead, cut-n-pastes are regular).

I'm not willing to post my emails between the developers, I, and other people in the company. I really don't want to be hassled by Smoothwall anymore. The funny thing is that I'm quite sure I'm unidentifable in the masses of people who might say such a thing ;)

(and this comes from a paying customer of Smoothwall Corp. - not a freeloader).

I *strongly* recommend any other distro. I didn't think customer service mattered much until I found a bug in their product and wanted them to fix it.

Re:Smoothwall

[xtremex]

Dick Moran is an asshole. I once asked him on IRC how I can upgrade software on the firewall myself, I got flames to no end, and my IP banned from the IRC server.

Re:Smoothwall

[TellarHK]

Yep, Morrell is definitely someone to watch out for. He threatens, harasses, and insults practically anyone that doesn't tell him Smoothwall's the greatest thing since using the GPL as a way to fork off to a commercial product after getting overenthusiastic community ego boosting.

He's gone so far as to make legal quasi-threats against me and other critics of his treatment of Smoothwall users. He's driven away enough developers that the IPCop project was formed and seems to have done quite a good job at proving themselves to have intentions of being more than just another forked project. IPCop has performed just wonderfully for me since my abandonment of Smoothwall.

For the morbidly curious, I have an archive of my emailing back and forth with Richard on this webpage.

Re:Smoothwall

[mnot]

From all accounts, he is cranky and sometimes more than downright nasty.

You just described just about everyone who produces open security software. Hmm... what does that say?

Re:Smoothwall

[Halster]

Yup, I too have been giving IPCop a spin over the last few weeks on an old machine I've got on the floor at home. IPCop is about to take over serving the dialup of our office at work, and I know of a local business that's been plugging it to some of his clients who want to securely share a connection.

IPCop is a nice piece of work. And, as stated elsewhere, is sans the problems associated with Smoothwall's co-creator.

Shame, because Smoothwall is also a good product, and Lawrence Manning (the nicer co-creator) is a really nice and damn smart guy.

Re:Smoothwall

[Waffle Iron]

His product is FREE though, you should just don your asbestos suit should you go looking for support. (View a few IRC logs etc. to get a feel for how "Dick" seems to view newbies and/or non-paying customers.)

I think this guy has finally found a way to make money on free software: Forget selling licenses; forget selling service and support. Just sell protection from ridicule and verbal abuse.

Preserving some semblance of self-esteem has clear value in the marketplace. I think this business plan will be successful.

Re:Smoothwall

[ahde]

His email was hardly unsolicited, and his response was far from unprovoked. You should maybe have learned by his example. It's really very simple:

cat >> ~/.procmail
:0
* ^From.*richard@smoothwall.org
/dev/null
^C

Re:Smoothwall

[Keezdriver]

Try IPCop they produce a free gpl fork of smoothwall and they intend on releasing a new version with more features based on the 2.4 kernel and maintain it as gpl. Ask them a support question and they actually are friendly when they answer. Even the users are nice and everyone tries to help when others have problems, Strange idea eh? Works for me, I switched to IPCop and never looked back. Michael T

Re:Smoothwall

[nomadic]

But, from what I gather, and I have done some searching, Dick (aka Richard Morrell) seems to have a few screws loose. From all accounts, he is cranky and sometimes more than downright nasty.

An ill-mannered, non-social programmer? Impossible!

Re:Smoothwall

[dalutong]

Umm... he asked for "free." Now, I agree that 2 cents isn't a lot... but maybe this guy is on a tight budget...

Re:Smoothwall

[jazman_777]

Try OpenBSD. It's rock-solid secure. It'll give you what you want. And, compared to Morrell, Theo de Raadt (sp?) is a model of civility and diplomacy.

Re:Smoothwall

[stickyc]

I will not endorse a product that holds support hostage for 'donations' in the manner Smoothwall has.
I've got no issues with donating for a product I can servicably use, but when even basic "how to get it running" support is denied, that's just bad customer relations.

There's too many other similar products out there to be treating your customers like that.

Re:Smoothwall

[Caraig]

Look, a lot of y'all are ragging on TellarHK for bringing up his troubles with Smoothwall's Richard. I'd just like to point out a couple of things:

o TellarHK already said -- a lot of times -- that there were things he could have done better. That's cool, that's reasonable. I don't hear Richard saying the same thing. Hell, all I've heard about Richard is him saying how if you don't pay the cash your tech support equals nothing.

o The tech support available to admins in this industry is bad enough. When I was still wrangling networks, it could take forever to get support, with some very rare exceptions. Any company that gives shoddy support, or is rude to potential customers, has NO CONCEPT of what it means to deal with people. Nothing pisses off an admin than shoddy support for an otherwise good product. And being told 'pay the money for it!' is all well and good, but if the person's been rude to you and your server room crew, what's the garauntee that they'll be nice and polite after you dump nnn dollars into their account?

o Quick lesson in marketing: how do you get your foot in the door of a potential customer? You respect them. I threw out more unsolicited junk mail when I was a netadmin than I care to remember. But when I was evaluating software for implementation, I got more from a reasonably courteous, polite tech-guy or sales-guy than anything else. I just would not want to deal with a company who would put rude, obnoxious people on their phones to talk with me. (And before you ask, yes, I *was* polite to them through and through, even when they were being less than polite.) Now, compare it to what Smoothwall has: the *author* of the software and one of the top honchos at the company is mouthing off potential users. The hell?! This just is not done in the real world, people. At least, it's not done if the company wants to attract any customers. At the very least, I'd expect any employee who has a vested interest in that company to get Richard OFF of IRC and OFF the phones and OUT of the public eye. Put someone who can deal with people on the front lines.

o That brings me to this point: open source software is on a tightrope as it is. It's bad enough that OSS has no marketing budget to go against commercial closed-source software producers. The only thing that OSS has to go on get accepted is that it's free, and the support you get from the software authors. I am all for commercial OSS projects. But actions like Richard's ruin the reputation of all OSS projects. If Smoothwall was the first OSS implementation a company made, and Richard was even half as rude as he is to most people, then I garauntee you, that company will NOT ever implement anything open-source ever again. Why? Because there is no tech support for a commercial, closed-source product that will be rude to a customer, or even to a potential customer.

o "Oh, but TellarHK shouldn't have pushed it! It'd tax my patience, too!" Oh, wah. If you can't handle the heat of doing tech-support and answering sometimes-oddball tech questions, get off the phone or uninstall your IRC client. It's part and parcel of doing tech support. Okay, maybe Richard has answered too many questions, and maybe he's pulling hundred-hour weeks (quite a feat, that, actually) and if he really is and it's all for this product, fine, I'm happy for him, he's to be commended for that much. But if he's using that as his excuse for being rude and demeaning and obnoxious to potential *paying* users, then he's got to lay off dealing with people outside the company and delegate that to someone else, someone who can deal with *people.* I don't care if Richard could hack the Linux kernel to make it self-aware, write up a VWM that's easier than frickin' *Aqua* to use, and by lunch write the killer Linux office suite. If he can't deal with people, *all* people, then he shouldn't be trying to run a commercial enterprise.

o Sales of a software product is all about dealing with other people and convincing them to use your product instead of a competetor's, so that they will pay you and give you their money and you can pay your employees' salaries and have enough to pay the rent yourself. You don't get more customers by routinely alienating them. You don't get people wanting to pay for support if you're rude to them first.

TellarHK didn't do anything to warrant the verbal fusilade from Richard, let alone anything to warrant getting harrassed. Instead of getting TellarHK to say (again!) that he could have handled it better, why can't anyone expend this much effort to get Richard to admit that he's got to chill out and relax and not alienate more of his potential user base?

Re:Smoothwall

[lightfoot jim]

just so you know, it's Theo deRaadt

Re:Smoothwall

[istartedi]

View a few IRC logs etc. to get a feel for how "Dick" seems to view newbies and/or non-paying customers

Now there's a business model I hadn't considered: Give the product away for free, charge people to be nice to them.

Re:Smoothwall

[cmkrnl]

Thus speaks an idiot who has only ever firewalled off a modem connection.

Curmudgeon.

Re:Smoothwall

[reneky]

Ah, so you didn't read the faq. Here's the relevant part:

On Not Reacting Like A Loser

Odds are, you'll screw up a few times, on hacker community
forums -- in ways detailed in this article, or similar. And
you'll be told exactly how you screwed up, possibly with
colourful asides. In public.

When this happens, the worst thing you can do is whine
about the experience, claim to have been verbally assaulted,
demand apologies, scream, hold your breath, threaten
lawsuits, complain to people's employers, leave the toilet
seat up, etc. Instead, here's what you do:

Get over it. It's normal. In fact, it's healthy and appropriate.

Written by Eric S. Raymond. It's good advice. Move on.

Re:Smoothwall

[saintlupus]

You just described just about everyone who produces open security software.

With one notable exception, of course; you're forgetting Theo's reputation for being so friendly and cuddly, much like a kitten.

--saint

Re:Smoothwall

[zaqattack911]

close look at the system configuration reveals the horrific. Here we have configurations files hanging around on the firewall, freely readable and partially writable: The password for the DSL access was in plain text in an unprotected file, even the secret key for a VPN connection wasn't particularly well protected. Furthermore, SmoothWall doesn't use Shadow-Passwords, a security feature included in all modern Linux distributions, which protects the password file from direct user access, consequently protecting from dictionary attacks. The PPP-Daemon complains in the log file, every start, about the permissive reading rights to its password file, hard to imagine that the developers missed this one. Of course nobody except the Administrator should be anywhere near the system, so these problems don't present a direct threat. But, the purpose of a Firewall is to protect the system against all eventualities-and not to override existing protection mechanisms. Ultimately a mistake in an installed program such as the Web Proxy could eventually lead to the access to local data from other computers-and easily accessible files with passwords or secret keys increase the risks unnecessarily. Further investigations show that the systems security isn't taken very seriously. The CGI scripts used to Administrate do not verify user data satisfactorily. When a group of developers- more than ever one active in the spirit of GPL-want to successfully distribute a good product, they are usually interested in feedback, in order to improve their product. My concrete indications of security problems within SmoothWall found sheer disinterest with Richard Morrell, developer and project initiator. "That doesn't matter" was about the politest of all comments comment. Trust in the developer's competence and integrity is a basic pre-requisite for the usage of security relevant software. Morell has thoroughly destroyed mine. (ju)

LRP "sold out" ?

[maggard]

How so? They took offerings from VA Linux?

The mailing list is active, there are any number of distributions though few on the latest kernels, all appears kosher if not frantically active.

Was there any reason for this possibly very damaging statement?

Re:LRP "sold out" ?

[slamb]

The mailing list is active, there are any number of distributions though few on the latest kernels, all appears kosher if not frantically active.

Was there any reason for this possibly very damaging statement?

Yeah, because at the linked site:

• There have been no releases since 0.9.8 on 12 Sep 2000 (a year and a half).
• The only news since then has been three seperate sponsers (Cyclades, VA, and Sangoma). It's not clear what the money is being used for.
• The mailing list archives, give 404s on the -devel list. Only the users list seems to be active.
• The "unstable" directory on the site contains only (besides the 0.9.8 release) a few kernel patches made to 2.2.19 in July of 2001.

On the other hand, this site seems quite active. I'm not sure what their relationship is.

Re:LRP "sold out" ?

[zsazsa]

linuxrouter.org is no longer the center of "Linux-firewall-on-a-floppy" development. It's been seldom updated for several years now; the only important thing on it being the mailing list. The site even apologizes for its own lack of maintenance: Unfortunately most all of the LRP docs at this site are painfully out of date. The LRP still is the basis of most Linux floppy distros, albiet heavily modified.

Instead of linuxrouter.org, the real hotbed of development these days is the LEAF site, LEAF standing for Linux Embedded Appliance Firewall. The steinkuehler.net site you mentioned is a part of LEAF, hosting the Eiger/Dachstein distributions. Unfortunately the linuxrouter.org project doesn't point the way to LEAF. I only found out about it by following the mailing lists.

Ian

Re:LRP "sold out" ?

[Speed Racer]

I wish someone would create a single floppy OpenBSD firewall.

Is OpenBSD-based good enough? Try GNAT Box Light.

Re:LRP "sold out" ?

[ahde]

Name one reason _not_ to use 2.2?

Before you say "ip tables" try and fit that on a floppy.

2.2 kernels are safe, stable, secure, tested, well known, documented, efficient, lightweight, etc. The last known remote exploit was a DoS on 2.2.19 almost a year ago -- and most firewalls wouldn't have included the features that make it possible.

Re:LRP "sold out" ?

[young-earth]

Actually Gnat is FreeBSD based, at the time they took a kernel I'm not even sure OpenBSD had started. And FreeBSD was at the time heavily X86 focused IIRC.

If you want a no-moving-parts OpenBSD based firewall, you can build one up using embedded OpenBSD, aka emBSD, see their site for details. They use the Soekris single-board computer with Flash IDE to get a nice little firewall with pf and OpenBSD.

Re:LRP "sold out" ?

[Speed Racer]

You're right, my bad. I meant to write FreeBSD, otherwise, the first part of my post makes no sense. Thanks for the correction.

Re:LRP "sold out" ?

[GlobalEcho]

I wrote what was once widely appreciated as the most useful howto for using LRP. It is now woefully out of date, and I recommend Eigerstein or Dachstein, which are so well-designed that they don't need that kind of detailed documentation.

I can shed a little more light on the middle-recent history of LRP and LEAF. Two years ago, LRP was indeed the center of all linux floppy firewall/router activity. However, people were starting to innovate, and Dave Cinege (who owns the domain name) never seemed to find the time to update his own work or incorporate that of others. It was a running joke on the mailing list. It would not have been much work for Dave to at least put up links to the sites documenting and extending LRP, but it never seemed to happen.

For a while, linuxrouter.sourceforge.net (now changed to leaf.sourceforge.net) was a repository of all the extra work. Before that everything had been on a crazy collection of obscure personal websites (like mine).

Dave promised major updates to LRP, and then gave up on LRP and decided a completely new, cool project was necessary. This was around the time Tim McVeigh was executed, which Dave considered the murder of a hero or prisoner of war. Without getting into politics or morality, I merely note that it was the last straw for many people, who made a complete split and formed LEAF. I presume it was the rancor behind this split that keeps Dave from mentioning LEAF on his website.

Unfortunately, if you type "linux router" into Google, LEAF shows up way down the list -- maybe 20th.

IMHO, the people working on LEAF are dedicated and impressive. It remains far and away the best floppy-based router/firewall available. It is certainly the most actively maintained.

Re:LRP "sold out" ?

[PhiRatE]

iptables
iproute2

And yes, I fit both of them, plus a 2.4 kernel, on a 1.44mb floppy with no special formatting or anything. Admittedly it was a custom assembly but it was more than worth it for the advantages that these applications offer.

FreeSCO

[groove10]

That's what I use on my little NAT/Gateway thing at home. Works like a champ. Web-based config + many other add-ons for this floppy distro. More put together than LRP IMHO. Check it out at: freeSCO.org. The dicumentation is pretty good, although it may not be as secure as other distros.

Re:FreeSCO

[groove10]

I meant documentation... Should have previewed! Also check out picoBSD at: http://people.freebsd.org/~picobsd/picobsd.html. I've never used it but it appears to be a floppy distro of FreeBSD specific to firewalls / gateways / etc. Worth a look most likely.

Re:freesco

[seann]

Is not buying a 50$ hub/router a lot cheaper?

Re:freesco

[Ommadawn]

perhaps.. so let's say you or some friends have an old 486 kickin around.. and maybe some old NICs..

Re:freesco

[seann]

true story

Re:freesco

[caffeineboy]

PCs at surplus - $5

1 nic/machine

probably 1 machine has no RAM or a bad PS

2 machines makes for 1 good one with 2 nics.

Wozniak?

[HEbGb]

Sorry, he's done some great things in the past, but what the hell does Steve Wozniak know about computer security?

Re:Wozniak?

[cscx]

I can't really tell you, but I hear that the Woz knows a thing or two about putting toothpaste in the center of Oreo® cookies.

Re:Wozniak?

[Drakin]

He has the mentality for finding ways around security. Be it with technological gagets, or otherwise.

It's a matter of not knowing how, but thinking of how it could be attacked. Security isn't just about plugging holes, it's about thinking about new holes that could be used.

Re:Wozniak?

[Error27]

I doubt Woz claimed to be a security expert. He and Captain Crunch really are friends though.

Re:Wozniak?

[mrseigen]

Plus, he and Jobs used to sell phreaking boxes out of their dorm. Woz has his hands in a lot of tech honeypots.

Re:Wozniak?

[Anonymous Coward]

In answer to your question Mr HEbGb or whoever you are... A LOT MORE THEN YOU CAN POSSIBLY IMAGINE....
I've gotten a LOT of very good ideas from Woz and Kevin Mitnick, of which I had a great time partying with kevin at RSA Conference last week. But YES!! I would certainly classify him as being way up there, and even beyond in creativity. It's just that his innterests are somewhere else right now.

I cant wait to see his new product when he completes it. I'm sure it's going to be a winner.

Crunch

LinuxMandrake SNF

[DCowern]

Single Network Firewall... runs off of a 2.2 kernel, easy to set up, and runs off a "slick web based interface". You can download the ISOs for free off their website.

Some linkage:

• info: http://www.mandrakesoft.com/products/snf
• download: http://www.linux-mandrake.com/en/ftp.php3

Re:LinuxMandrake SNF

[Yottabyte84]

Same problem here, and I can't get port forwarding to work right.

Re:LinuxMandrake SNF

[Perl-Pusher]

I tried it, there's no support for a DMZ. So you can't use it to filter packets to your public servers and create a private LAN. I ended up using shorewall a set of scripts that are pretty easy to configure. I liked the Mandrake SNF web interface, but it wasn't flexible enough to suite our needs.

Re:LinuxMandrake SNF

[RadioheadKid]

Sorry to be redundent, but I must agree, couldn't get port forwarding to work. Althought, I must say the DSL support with PPPoE was great, install was a little confusing (could never get it to set up each card with the correct interface parameters) but once you get it to the point where you can use the web interface its easy. I also had problems with Smoothwall, but that was with the PPPoE support which was still in beta (this was almost a year ago) probably much better now. I'm happy now just using Bastille-Linux and then tweaking the rest myself. (end 2 cents)

Re:LinuxMandrake SNF

[Yottabyte84]

Basrille doesn't do NAT, but it's great for firewalling your box.

Re:LinuxMandrake SNF

[Yottabyte84]

That spelling error is a figment of your imagination, please ignore it. ;-)

Re:LinuxMandrake SNF

[RadioheadKid]

yes it does, with iptables for 2.4 kernels...

Re:LinuxMandrake SNF

[RadioheadKid]

Just as proof heres the init script output when bastille is starting:

Setting up IP spoofing protection... done.
Allowing traffic from trusted interfaces... done.
Loading NAT modules... done.
Setting up masquerading rules... done.
Loading masquerading modules... done.
Setting up chains for public/internal interface traffic... done.
Setting up general rules... done.
Setting up outbound rules... done.

And also the fact that I have two computers on the inside connection of my firewall, might be enough proof....

Re:LinuxMandrake SNF

[Yottabyte84]

Erp, I did not know that!

People shouldn't say these things!

[jaavaaguru]

next to un-crackable

What does Steve Wozniak have against Captain Crunch? we all know what happened to Oracle when they made similar claims.

Re:People shouldn't say these things!

[mark-t]

Maybe, except he didn't say that it _IS_ uncrackable, only 'next-to-uncrackable'. I realize that some may consider this nitpicking, but it isn't, really. Any non-trivial piece of software has bugs, and Steve Wozniak knows that just as well as any of us. This sort of comment is likely Woz's way of expressing the high degree of confidence he has in the product without making any sort of claim that could very possibly be proven false next week.

Re:People shouldn't say these things!

[zaffir]

A DoS isn't exactly cracking...

slashdotted already?!??

[kemster]

Looks like it's /.'d already, so use the power of the google.

Coyote Linux

[servoled]

Note sure if this qualifies, but it is a neat little floppy disk distribution that does nat. Check it out at http://www.coyotelinux.com/.

Re:Coyote Linux

[GuanoBoy]

I've run my home network behind Coyote Linux as well as a 30+ node office (with servers behind it) fir years and it's done a fantastic job. *and* all that off a floppy.

It takes minutes to download, install, and get running.

Re:Coyote Linux

[wholesomegrits]

Maybe a few comments from De Raadt, the OpenBSD guy, regarding the intelligence of using a floppy disk for your firewall are in order. The short and quick: it's a stupid idea. This thread seems to be dominated by the "let's entrust my entire network's security to a $.25 (or cheaper) part that has the highest failure rate of any storage medium ever. This isn't directed at you, servoled, but just a general note for the thread.

Re:Coyote Linux

[PurpleFloyd]

A floppy based distro hardly ever uses the actual floppy drive. It would more likely load only the kernel, shell and compression utility, then uncompress the contents of the floppy into RAM, and run from there. The floppy is only there to provide a way to easily boot a system, and to hold the initial data. Also, de Raadt's comments don't really apply to a lot of what floppy based distros are used for: home users who want a simple firewall. As a rule, I don't keep any sensitive information on an Internet-connected computer. Thus, even if my network is cracked, it will still be a serious pain in the ass to get to my Quicken files on a non-networked system. My firewall keeps me from becoming a zombie in a DDoS attack or similar, but I wouldn't expect it to really be too successful against anything else. Why would it need to be? Anyone who uses a simple little floppy based firewall to protect their corporate payroll or something really deserves what they get. Still, it's just fine for home use.

Re:Coyote Linux

[mcrbids]

Eh...

So you make TWO.

Once booted, Linux has uptimes of months, so it just isn't a problem...

Re:Coyote Linux

[GlobalEcho]

Actually picoBSD tries to do just this, though it is based on FreeBSD rather than OpenBSD. Personally , I prefer LEAF in its Dachstein form, which is essentially what happened to LRP.

Theo (in citing their tendency to go bad) clearly misses the point of floppies, though:

- Read only media are a true blessing. You are never more than a reboot away from a clean system.

- Their unreliability makes them more secure, since if they go bad, the router just dies at the next reboot, which is ultimate security, however frustrating.

- They are only used every couple of months when you upgrade.

- They are low-power and have no spin noise.

- They are found on the cheapest hardware.

Re:Coyote Linux

[Jonathan White]

Coyote does have a surprisingly nice interface but I must confess to always preferring OBSD for secure systems. Besides, I tend to agree with De Raadt on the usage of floppies (http://www.monkey.org/openbsd/archive/misc/0007/m sg00236.html).

Cheers WWW, and I must say I wish you were here, drop me an email sometime.

Re:Coyote Linux

[ranulf]

Yup. I second this...

I was given an old 486 motherboard with not a lot else, so decided to make a floppy-based firewall so that we'd have something quiet that can stay on all the time.

I got bored of hacking my own floppy-based system, so I thought I'd try coyotelinux. It really is fantastically easy to use, and is a great way to trick Windows users into trying Linux and then realising it only has to be complicated if you want it to be.

A few things could be better documented; for instance my network cards (NetGear FA331's didn't have drivers, so I had to compile my own - fine but the docs don't say what kernel version it uses, so you have to boot up again to find out!)

But basically you can have a working Linux firewall set up in about 6 mouse clicks. And that includes DHCP client to obtain the cable IP address and server for the local net. Nice.

The server is pretty secure - the only visible service running is telnet (and that's optional), and coupled with the fact you can write-protect your floppy means it can't be tampered with.

The only downside is that it uses some sucky editor (ae) and the termcap isn't set up right... I will install vi when I have a chance :-p

Give it a go!

The LEAF stuff also looks good, but personally I'd rather loose a floppy drive than a CD drive...

Ralf.

Re:Coyote Linux

[Rogerborg]

• let's entrust my entire network's security to a $.25 (or cheaper) part that has the highest failure rate of any storage medium ever

Oh, please. How often do you reboot a firewall? Once every six months? Once a year? Once per power failure?

And if the floppy has rotted during this time, you do have an image on a more stable medium somewhere inside your intranet, right? If not, well, you deserve what you get, I suppose.

Re:Coyote Linux

[fferreres]

1 - They are not supposed to be turned on/off much.
2 - You can have a backup floppy, or more.
3 - Of course this are not for large networks, they are for the slow pentium you have in the attic.
4 - Some of these are "load-from-the-net", so they are a way to boot the firewall.

So this anti-floppy knowledge is ok, as long as they can visualize what they are beign used mostly for.

Re:Coyote Linux

[TeamSPAM]

Is is possible to switch from floppy images to small iso files? I would almost think it's easier for people to try making micro distros that could run off a CD-R instead of a locked floppy.

Re:Coyote Linux

[saintlupus]

Is is possible to switch from floppy images to small iso files?

Probably, but then you'd be blocking out all of the older machines that can't boot off of a CD, but can boot off of a floppy.

As someone who ran a 486 for all his serving needs on a home network, I'd rather not go down that route.

--saint

Re:Coyote Linux

[Stinking Pig]

LEAF supports booting from flash, hard disk, or cdrom as well as floppy, and can then pick up packages from any or all of the above or a network server.

The point to booting from floppy isn't to reboot every twenty seconds in some sort of floppy-drive torture test, but rather to boot from a media that allows hardware-based write protect. A more reliable hardware write protect can be achieved with CD-Rs, but not everyone has a burner or a CD-ROM in their erstwhile disposable router machine.

Re:Coyote Linux

[wholesomegrits]

That's great...but you don't keep log files? You don't update configs, you don't update software (recent ssh holes, for example)? Nice in theory, but the floppy distros are passé when an inexpensive hard disk will do the job much better. A floppy can fail just by sitting in the drive. They're shit. Apparently I ushered in the pro-floppy legions with this comment. Is there some problem with recognizing that a floppy is a pathetic storage medium? Is it so hard to get a CD drive, or a cheap hard disk?

Re:Coyote Linux

[roybadami]

Oh, please. How often do you reboot a firewall? Once every six months? Once a year? Once per power failure?

Actually, that's potentially a problem, though maybe less so than it used to be.

Floppy drives tend to die if they're left unused for really long periods of time.

This was first noticed when BIOSes started allowing you to disable booting from floppy -- the floppy drive was no longer exercised at power up, and if it wasn't otherwised used, it would likely be unusable after a few years of disuse.

Most modern BIOSes fix this by exercising the floppy drive even if they don't intend to try and boot from it, but that isn't really a solutions for machines that might go really long periods without a reboot.

I guess the solution for a linux firewall is to have a daemon that spins up the floppy drive and seeks the heads every couple of months...

OK, I'll be the first to bite

[bferrell]

Why do you say the LRP has been sold out?

Clarkconnect

[Anonymous Coward]

I use clark connect for my firewall. Its linux based wit a web admin, it displays usage reports, bandwidth graphs. Does nslookups and whois on people who try to hack you. Even displays "12.12.12.12 tried to use Code Red 2.0"
Also includes CUPS for printing.Samba for file sharing. OpenSSH and the web based admin uses ModSSL so its all encrypted.

Its frickin awesome! Is built from Redhat 7.2 and accepts all Redhat 7.2 RPMS.

Re:Clarkconnect

[xtremex]

I used to use ClarkConnect. But I wanted to make an old 486 w/ isa NICs into a gateway/firewall. It only supoorts PCI cards. (true, you can configure it to work with ISA's, bit it's a pain in the ass)

Re:Clarkconnect

[xtremex]

I understand all that. But sometimes people have an old 486 and don't feel like spending ANY money to upgrade an old cheap box. I am the guy people call to setup home firewalls. I've tried to get them to buy PCI nics and they wont. Oh well.

Free Firewall...

[Talez]

Smoothwall has been doing the job for me for ages... Only a 20 meg download for the ISO and you install the system off that... It's pretty cool!

Re:Free Firewall...

[GSloop]

Again, be wary of Dick (aka Richard Morrell).

From what I can gather, his attitude could use some serious positive adjustments.

He does provide a FREE fw, but it wouldn't excuse his behavior IMHO, should the IRC logs and such posted on the net turn out to be true.

Cheers!

Re:Free Firewall...

[wpanderson]

exactly ... cf Linus, Theo, RMS, and so on. not particularly paragons of happy chatters and friendly hug types. i'm not excusing anyone's behaviour here, but it's not exactly isolated, is it?

from what i hear...

[jrs 1]

these machines will be given away in packets of cereal within the year ;) and you'll be able to access a trunk line with them!

Gnat box has a Free 5-user version

[young-earth]

works great, easy to set up, floppy only, works on >= 486 machines. I've never seen it go below 98% idle on a 100MHz P5 with 5 hard-working machines filling a 768Kbps DSL line. You can pay $50 and get a DMZ added on to the free version, same price for a VPN license.

Download it from here. This is a BSD based firewall, but no shell, nothing for a cracker to get onto it. Uses SSL web access (new in later versions) or a Winblows client for configuration.

Oh and one point that is heavily stressed in their marketing material - it's ICSA certified.

There is a small version for ~$750 street price that gives 25-user version with DMZ, no moving parts, runs off 12VDC.

Astaro Security Linux

[lethalp1mpslapper]

This firewall is free for non-commercial use and has a web interface to boot. I've used this for sometime now. It supports VPN, incoming/outgoing email virus scan, IP accounting and routing. It will even update itself on the fly if you want. Here is the link: Astaro Security Linux

P.S. - I don not work for these guys, I am just impressed by what they offer.

Re:Astaro Security Linux

[ThePythonicCow]

Yes - I also use Astaro, on an old PC I setup as
my home firewall. I've been delighted with it.
It's easy to modify the firewall rules when I
or my son have a new game that needs another hole
punched in the wall.

Astaro seems to be one of the top downloads from
SourceForge for firewalls.

Google Cache

[OrangeHairMan]

Get the Google mirror here: http://www.google.com/search?q=cache:9eTg0-gz5L8C: www.shopip.com/+&hl=en.

I'd dare to say..

[Dr. Nonsense]

"I'd dare to say, next to uncrackable, is crackable."
Dr. Nonsense, cofounder of the Nonsense School of Journalism and PR.

www.coyotelinux.com

[mikeage]

Not quite GPL'ed, but a nifty single-disk solution. I liked it better than LRP since it has built in support for PPPoE, important to us Verizon lusers.

Re:www.coyotelinux.com

[elmegil]

I'll second the recommendation. Been behind coyote since I got DSL 15 months ago. It's a wonderful thing (and I don't have to have a HD making noise & heat in the closet).

Re:www.coyotelinux.com

[SubtleNuance]

Coyote Linux is a derivitive of LRP. It *is* GPL (as it is really GNU/Linux (again, it is LRP)).

The (iirc) non-gpl part is the windows-based installer. But i think it is available gratis.

Ive built CoyoteGNU/Linux routers for friends, would recommend it.

Uncrackable?

[nochops]

Uncrackable, perhaps...
UnSlashdotable, hell no!
Burn, baby burn!

On another note, I wonder if a good slashdotting could be considered ddos in court?

Re:Uncrackable?

[Anonymous Coward]

WELL - I guess I know what it's like to be SlashDotted... Hahahaha! Our server is one busy little guy....

Guess I'm going to have to go to the office and shut down the server for a few hours until the dust settles....

I think the CrunchBox on the server has already done that actually.... No big deal.

Re: woz, yes - I know him very well. He hosted by webcrunchers server up until just recently, and he sold his house in Los Gatos.

For your info: the box is only on a puny T1, so no wonder the connection is swamped.

Good thing it happened on a Sunday....

Crunch

Snort

[Roast Beef]

He spoke at UIUC's Reflections/Projections conference last year, and he showed us a bit of the Crunchbox. As far as we could tell, it was essentially a box with snort running to drop packets from anyone who tried an attack. Secure, yes, but also overly paranoid for most systems. Also, it pulls the CVS snort rules daily, so that's a potential weakness. It looked like it allowed you to view changes to the rules, but you didn't have to approve them in any way. I wasn't impressed.

Re:Snort

[TyDubious]

Captain Crunch himself posted on this thread and only got a score of 0 ???
Maybe some moderator was thrown off by the anon. handle.

Mine doesn't work

[khuber]

I blew real hard and couldn't get a tone out of
the damn thing.

-Kevin

What the hell is wrong with you people?

[Wakko Warner]

is anyone aware of some kind of 'packaged' firewall with a slick interface available for free?

Yeah. It's called "stealing a copy of Firewall 1 from work". Sometimes you have to spend money for things.

- A.P.

Re:What the hell is wrong with you people?

[Yottabyte84]

Mandrake's one is free, but I don't reccomend it. I've had problems with port forwarding, and upgrading the sucker is flakey. The intreface is pretty tho.

freesco

[caffeineboy]

When friends want to share a cable modem I usually go over to the local computer surplus sale and get 2 PCs that have NICs in them and a HDD and intall freesco.

It is based on an old kernel, and doesn't have socks so not everything will work, but it's easy to set up and even an idiot can use the web-based panel.

For a super low hassle setup I'd recommend it. It goes right onto an ex DOS PC, no re-formatting or anything.

IPCop

[cyroth]

Give IPCop a go. Very similar to Smoothwall without the "attitude" that some people suffer from.

Re:IPCop

[freeio]

IPCop is excellent for probably 90% of the firewall needs for individuals and small businesses. It is based on linux kernel 2.2.20 and ipchains. It is GPLed, has a quality web interface, and installs fast and easy. Furthermore, the user list is friendly and helpful. I downloaded the iso for it, wrote it to a cd, and then took about 15 minutes start to finish with the initial installation. After that, the fine tuning was handled over a very intuitive web interface. I would rate it a 9.5/10.

Re:IPCop

[wpanderson]

> It is based on linux kernel 2.2.20 and ipchains.

Thanks to SmoothWall.

> It is GPLed, has a quality web interface,
> and installs fast and easy.

Thanks to SmoothWall.

> Furthermore, the user list is friendly and
> helpful. I downloaded the iso for it,
> wrote it to a cd, and then took about 15
> minutes start to finish with the initial
> installation.

Thanks to SmoothWall.

> After that, the fine tuning was handled
> over a very intuitive web interface.

Thanks to SmoothWall.

Would ipcop have any users or any on-the-ground support if they (a) hadn't forked SmoothWall, and (b) hadn't been so vocal about forking it ... Yes, forking GPL sources is perfectly legal, but talk about riding on the back of someone elses success ...

Re:IPCop

[DavittJPotter]

And even though "thanks to SmoothWall" may be due, SmoothWall's attitude towards customer support (actually, the lack thereof) guarantees that I would *never* use a product from such an abrasive crew.

Between friends/developers, "RTFM!" is fine, but that is a pretty hard stance to take if you expect corporate customers, I think.

Just my opinion, of course.

Cheers.

Re:IPCop

[slydder]

>> It is based on linux kernel 2.2.20 and ipchains. >Thanks to SmoothWall. Not quite. SW was 2.2.19 based when we forked, but who cares. >> It is GPLed, has a quality web interface, >> and installs fast and easy. >Thanks to SmoothWall. Not quite again. The GUI is quite a bit different. >> Furthermore, the user list is friendly and >> helpful. I downloaded the iso for it, >> wrote it to a cd, and then took about 15 >> minutes start to finish with the initial >> installation. >Thanks to SmoothWall. SW has nothing to do with the list. Then again I doubt you were even replying to that so I'll just leave that alone. hehe. However, I must admit that the installation code is still almost 100% based on the original SW code. >> After that, the fine tuning was handled >> over a very intuitive web interface. >Thanks to SmoothWall. See above. >Would ipcop have any users or any on-the-ground >support if they (a) hadn't forked SmoothWall, >and Do you really want to talk about support? (b) hadn't been so vocal about forking >it ... Yes, forking GPL sources is perfectly >legal, but talk about riding on the back of >someone elses success Sorry. We ride more on the back you SW's failure. But either way doesn't really matter. Charles Williams PM IPCop Linux

Re:IPCop

[slydder]

Sorry. it seems that didn't work too well. ;) try this again.

>> It is based on linux kernel 2.2.20 and ipchains.

>Thanks to SmoothWall.

Not quite. SW was 2.2.19 based when we forked, but who cares.

>> It is GPLed, has a quality web interface, >> and installs fast and easy.

>Thanks to SmoothWall.

Not quite again. The GUI is quite a bit different.

>> Furthermore, the user list is friendly and
>> helpful. I downloaded the iso for it,
>> wrote it to a cd, and then took about 15
>> minutes start to finish with the initial
>> installation.

>Thanks to SmoothWall.

SW has nothing to do with the list. Then again I doubt you were even replying to that so I'll just leave that alone. hehe. However, I must admit that the installation code is still almost 100% based on the original SW code.

>> After that, the fine tuning was handled
>> over a very intuitive web interface.

>Thanks to SmoothWall.

See above.

>Would ipcop have any users or any on-the-ground >support if they (a) hadn't forked SmoothWall, >and

Do you really want to talk about support?

(b) hadn't been so vocal about forking
>it ... Yes, forking GPL sources is perfectly >legal, but talk about riding on the back of >someone elses success

Sorry. We ride more on the back you SW's failure. But either way doesn't really matter.

Charles Williams
PM IPCop Linux

Re:IPCop

[wpanderson]

> Not quite. SW was 2.2.19 based when
> we forked, but who cares.

actually, when you forked, SmoothWall was 2.2.20 based, but let's not let the facts get in the way of things

> Not quite again. The GUI is quite a
> bit different.

The GUI is exactly the same when you look at the nuts and bolts of it. You (the ipcop team) have changed the colours slightly, removed/replaced some graphical elements, but otherwise it's VERY recognisable as SmoothWall. Were you to radically overhaul the entire look and feel of ipcop, then I'd grant you "quite a bit" of a difference.

> > Would ipcop have any users or any
> > on-the-ground >support if they (a)
> > hadn't forked SmoothWall, >and
>
> Do you really want to talk about support?

Sorry, i was referring to grass-roots support, i.e. advocacy.

> Sorry. We ride more on the back you
> SW's failure. But either way doesn't
> really matter.

again, don't let the facts get in the way of anything else chuck ... SmoothWall has tens, if not hundreds, of thousands of active users, plus god knows how many ISO downloads ...

ipcop has had, what, 130k ISO downloads with about 2000 active users? honestly, how many would you have had if you hadn't been so vocal about your (not yours personally) treatment by Richard and also if you hadn't forked SmoothWall, but started from scratch - be honest now ...

Re:IPCop

[JPriest]

BR please

Re:IPCop

[slydder]

>> Not quite. SW was 2.2.19 based when
>> we forked, but who cares.

>actually, when you forked, SmoothWall was 2.2.20
>based, but let's not let the facts get in the
>way of things

Well, the actual ISO wasn't. now if you applied all the fixes, except the nagware (fixes4), then yes it would be 2.2.20 after applying fixes5. However, IPCop forked in November and the 2.2.20 patch (fixes5) came out on the 6th of that month (approximately).

>The GUI is exactly the same when you look at the
>nuts and bolts of it. You (the ipcop team) have
>changed the colours slightly, removed/replaced
>some graphical elements, but otherwise it's VERY
>recognisable as SmoothWall. Were you to
>radically overhaul the entire look and feel of
>ipcop, then I'd grant you "quite a bit" of a
>difference.

Well of course. Both GUI's interface with almost the same underlaying software and there is only so much to do. However, the bugs in the original SW code aren't there and it does have a quite different look compared to SW. Honestly, I like the look of SW better but I like the amount and format of the information in IPCop better. Kind of a a toss-up.

>> Do you really want to talk about support?

>Sorry, i was referring to grass-roots support,
>i.e. advocacy.

Sorry, but that's not what he was refering to and what you replied to. Next time qualify your answer if you wish to deviate from the topic. As far as advocacy goes, we are not looking for it from anyone other than those that make use of the package. And that we have.

>again, don't let the facts get in the way of
>anything else chuck ... SmoothWall has tens, if
>not hundreds, of thousands of active users, plus
>god knows how many ISO downloads ...

That I truely doubt. However, let's take it at face value and say you do have that many users. How many will you have next year? I'd say about half, and that's being nice. Once somebody needs help IPCop will get a new user. Those are the facts.

chuck

Re:IPCop

[slydder]

see the one posted above this one. hehe. forgot to select plain text. oops.

chuck

SINCE WE'RE ON THE SUBJECT...

[kir]

Fast, reliable, application level proxies - with the ability to log at different levels (and run on linux).

Where can these be found?

Both generic tcp/udp proxies and application aware "smart" proxies (i.e. H.323, NetMeeting, RealAudio, etc.). I know a lot of this funationality exists in the kernel, but I'd love to have proxies for those pesky protocols that decide on random high ports. If it could see and understand the "conversation", it could then, on the fly, proxy the appropriate (randomly selected) ports.

If I am completely missing something here (i.e. I'm a moron?!), let me know. I can take it. I think??

Re:SINCE WE'RE ON THE SUBJECT...

[kir]

OK... apparently, I am a moron... well, maybe not a moron, but LAZY. I got off my arse and did some poking around. Look what I found.

I found a few application level proxies -

OpenGateKeeper H.323 Proxy

ftp.proxy - This looks very well done.

smtp.proxy - done by the same guy as tcpproxy below.

For the generic tcp proxy -

nportredird - This looks very promising.

aproxy - looks a little too simple, but it's perl! (English can be found via babelfish.)

tcpproxy - This one seems the most complete and designed for a firewalling environment.

I found a whole slew of different app "level" proxies (Quake, POP3, etc.), but most seemed a bit basic. Some of the POP3 ones were cool (proxy auth support).

I was not able to find a good udp proxy - with multi-source/multi-destination (proxy with an ACL). I've a small local port udp redirector (I have no idea where I got it) that I use on my home network, but it's not something I could use at work. So... there ya go.

Is a remotely updatable firewall a good thing?

[gwernol]

From the page at iShop.com:

The latest attack signature libraries can be automatically updated from a centralized source of the computer security community.

I am certainly not a security expert, but this seems like a potential weak point. If they can automatically change the rules the firewall uses, then in theory someone else could as well, if they cracked the update protocol.

Does anyone know how they protect these updates so that they can't be intercepted and broken?

Re:Is a remotely updatable firewall a good thing?

[buffy]

I am certainly not a security expert, but this seems like a potential weak point. If they can automatically change the rules the firewall uses, then in theory someone else could as well, if they cracked the update protocol.

It all depends upon the security posture of your company. The same question can be made of outsourcing security services in general. Some companies are too small and/or do not have the internal expertise to property manage an integrated solution, and rely on services and solutions from third party companies. In essense, you are putting you the family jewels in someone else's hands.

So, allowing your firewall/ids to go out and fetch the latest ruleset may be OK if you're already willing to trust as it is.

Not saying that I don't consider it a problem--it's just something that has to be taken in check with your needs and resources.

Re:Is a remotely updatable firewall a good thing?

[mewsenews]

The crunchbox could ship with the public key of the Crunchbox team, and then the iShop people could digitally sign updates.

If you wanted to fake an update, you'd need iShop/Crunchbox's secret key to sign your little bundle of destruction.

I have no idea if this is how they take care of it, but it seems like a good idea to me.

h4x0r3d?

[EchoMirage]

Steve Wozniak is quoted as saying it's 'next to un-crackable.'

...and as soon as the story was posted, the screen read "j00've b33n h4x0r3d" and nature once again revealed its irony.

is it really that great?

[trelaneopn]

the server is lagged as hell, if it cannot protect against the slashdot effect, the single greatest denial of service attack known to the internet... is it really worth all the money on the page I cant even access to buy it?

Re:is it really that great?

[Anonymous Coward]

Maybe because we took it down. Obviouolsy it was swamped, but nobody got into the web server as was claimed in a thread above.

But this is great, and I thank you shashdooters for giving me the perfect opportunity to revamp our network. We've been trying to decide when a good time would be, to take down the network for an Overhaul. You guys just picked that date at the most perfect time. On a Sunday, when all of us were present.... I'll know in a little while if shopip had been hacked. Steve is busily working on the forensics now.

I wouldn't count on Shopip being up anytime this evening. Besides, we already have all the testers we can handle, so after the end of next week, we may not be offering access to the DEMO box. So those who got slashdotted out of a chance to check out the Crunchbox, may not have an opportunity anymore.

Crunch

Re:is it really that great?

[trelaneopn]

my most humble apologies, if you are the real captiancrunch it's an honor to be LART'd by you sir. anyway, I'll take a look at it later, I enjoy security, and used to be with 7thsphere. (admittedly not as skilled as you but damnit I DID SOMETHING AT LEAST!) tre

Re:is it really that great?

[trelaneopn]

I feel loved (but it beats feeling /.'d) there are mornings where I wake up and know exactly what some poor lemon based pdp-11 powerd webserver feels like under a /. . usually I just go back to bed.

OT: $0.02

[emmons]

I do believe that everyone who usually writes "just my $0.02" on slashdot should change their comment to something a bit more universally understood. Perhaps: "just my 4 pages" ?

Just my 4 pages.

Coyote Linux

[mcrbids]

Used it, like it. Typical "on a floppy" distro... check it out here. Comes w/SSH for remote support. Dunno about "Slick Interface" but for a CLI junkie like myself, it's cool.

It's a great way to make that ole' Packard Bell 486 come back to life!

Eh? OpebBSD is *easy*

[zulux]

I hate to be a prat, but what's the point on adding a web-based interface to OpenBSD. The whole OS is damn easy to setup - the man pages are idiot proof and the documentation on installation are wonderfull. There are some rough spots that look a bit difficult if you don't have OpenBSD's documentation on hand - so keep another computer nearby to browse the web and man pages.

Hints:
Buy the OpenBSD CD - they are bootable and support the project.
Learn a bit of VI beforehand for editing those text files - of course other editors are available but VI comes built in.

Other hints:
Trust Theo and his friends to get the operating system secure - not a has-been cracker cashing in on name recognition.

Re:Eh? OpebBSD is *easy*

[r00tdenied]

I believe the point is to have the configurations accessible from remote computers on the network or at least a specific machine. A firewall is not going to have a keyboard and a monitor attached to it.

Re:Eh? OpebBSD is *easy*

[Stinking Pig]

OpenBSD is pretty easy, but ipf is pretty easy to screw up. A scripted interface is a good thing.

Re:Eh? OpebBSD is *easy*

[psxndc]

OpenBSD doesn't use ipf as of version 3.0 over licensing issues with Darren Reed. They wrote a custom packetfilter named ... *TADA* pf. It's supposed to be easier to use than ipf though it is "backwards compatible" with ipf. See here for the full story/reason. Funny though, Darren Reed released a version of OpenBSD with ipf a little while ago.

I agree with the grandparent of this post. OpenBSD is pretty easy to set up (and its gotten easier with every version since I started using it at 2.7) and the man pages are fantastic.

psxndc

Re:Eh? OpebBSD is *easy*

[Anonymous Coward]

Well - perhaps thats true. But it's also true there are a lot of people who want to migrate off of M$ IIS servers, and not all of them are as smart as you are. So what better way is there to get more people using OpenBSD, then to make it really easy to use.

That's always been the thing that turn people off to using OpenBSD. Sure, there are lots of people who can set these things up, except perhaps those pampered IT people so used to using IIS.

I'm just making it easier for people to make that migration. So please don't shoot the messenger.

Crunch

Re:Eh? OpebBSD is *easy*

[cmkrnl]

On a layer 2 bridge firewall dickhead ? How are you going to ssh into something with NO IP address precisely ?

Curmudgeon

Re:Eh? OpebBSD is *easy*

[AngusSF]

That's always been the thing that turn people off to using OpenBSD.

You got that right. Last month I started what turned into a flamewar on openbsd-misc with a simple suggestion that there was a need for an easy-to-set-up-firewall-distrib. There are now two mailing lists working on just such a project, so as not to /. them ;-), those of you who are really interested can go /. the openbsd-misc archives and track them down.

File systems

[Beowulf_Boy]

I've tried several different types of Firewall distros. Coyote, Smoothwall, that Mandrake one, etc. I finally settled on Freesco, because it runs off the fat32 filesystem. All of the other ones are basesed on non-journaling Filesystems (Ext2). And my electric goes out quite frequently.

Re:File systems

[/dev/trash]

fat32 is journalled?

Re:File systems

[_Knots]

No, fat32 is not journaled. Beowulf_boy just thinks it is because Windows tends not to keep lots and lots of dirty data in RAM (as opposed to *nix, etc.) and so seems to have better crash-safety.

It's a lot like the mac's FS - HFS isn't journaled either, but since MacOS n (n 10.0) had single threading disk access and didn't keep a lot of dirty data in ram, the disk was usually in sync.

_Knots

Re:File systems

[Beowulf_Boy]

No, I know its not Journaled, but its close enough.

Re:File systems

[_Knots]

Close enough? Sure, for government work, maybe (=)) but it's not journaled and as such has NO guarantee of meta-data or data consistancy, as opposed to JFS, XFS, EXT3, JFFS, etc.

_Knots

ClarkConnect is Easy and Free...

[Timodious]

Please check out ClarkConnect... it's a great little firewall based on RedHat 7.2. It gets regular updates, and has an active user community.

Bastille Linux?

[outofoptions]

OK. The interface isn't slick.

Re:Bastille Linux?

[khuber]

Why call it Bastille Linux?

The Bastille was stormed and taken by a mob - what good is that kind of fortress?

I believe bastille is a generic word for prison even though most people think of the French fortress prison.

The Bastille is somewhat of a Titanic story. It fell because both because they thought it was so strong and didn't send enough reinforcements, and because the attack was extremely underestimated.

But the funny thing relating to the name of the distribution isn't that it was stormed in 1789 (it was attacked successfully several times before then), but what it represents. The Bastille was where monarchs imprisoned people who didn't agree with them. It became a symbol of oppression and silencing the opposition. Sort of like the MPAA or "digital rights management" of its day.

-Kevin

FWTK: Not a fancy interface...

[tkrotchko]

...but a solid firewall.

http://www.fwtk.org/main.html

There's still a lot of support and I believe an active mailing list.

I put one together 5 years ago, and the company I work for still uses it for their mailing host.

Interface? There is none. But it works pretty damned good if you're willing to spend 1 day understanding how it works.

Not a bad deal.

Correct Smoothwall Archive URL

[TellarHK]

My bad.

Here is the correct link.

Re:Correct Smoothwall Archive URL

[Watts Martin]

You know, after reading the entire thing, I think both you and Dick should be taken out and spanked. :)

It's obvious Dick is genetically incapable of responding civilly, and he should be physically prevented from responding to users. There are certain people who seem to revel in the Bastard Operator From Hell stereotype. One suspects he started his own company because if he tried to work for anyone else, they'd fire him, ideally with a cannon.

Having said that, though, it's also clear that you simply weren't willing to take "it's a firewall, and isn't competing with a Linux distribution" for an answer. Dustmite didn't start out irritable--he got that way after explaining the rationale. Then doing it again. Then repeating himself. Over. And over. And over.

Quite frankly, any engineer would have started sounding irritable by the end of that IRC log. He could have handled it better, but honestly, you didn't come across like you were going to accept any "closure" other than a Smoothwall employee saying, "Yes, it's a great idea to put GCC and a web server on our firewall, and we'll get right on it."

It's interesting to hear these things about Smoothwall, though, since I work for a company that makes a box that competes with them. (Incidentally, our box does have a web server on its firewall if you want it. Dustmite is right: it's bad security to do that.)

Re:Correct Smoothwall Archive URL

[TellarHK]

Yeah, I'll admit that I understand how that could have looked that way. It wasn't that I had issues with the fact Smoothwall doesn't have those features, but the answer I got was quite rude. People being rude like that honestly tends to bring out the worst in me, a situation I've worked to curb since reviewing that log a few times more than I needed to be somewhat humbled.

My concern in some areas with Smoothwall is that a good deal of the security they had in place at the time of my conflict with them, was based on a ''They'll never get to root anyhow'' mentality. My main suggestion, GCC, is something that could only be exploited from a root login. Honestly, once a root login is compromised, your firewall is essentially useless as a security tool. And seeing how root is claimed to be the only login id available on a Smoothwall system, it would stand to reason that any access would be catastrophic.

However, the crux of my entire line of reasoning was that "for my needs" I'd like a system that had those features. Its perfectly understandable, expected, and encouraged that Smoothwall and other projects target whatever userbase they want to. But by giving me the terse response they did, instead of saying "We're not targeting the small home user who wants a web presence, sorry." it just really rubbed me the wrong way. They could even have left out the "sorry".

That's fine, that's cool, I said as much repeatedly in my correspondence. However, I kept being treated with the same lack of respectable treatment that Richard is increasingly known for. For me, right after the IRC conversation, it became a matter of the lack of courtesy with which I was treated feeding the flames. Pun not intended.

I'll admit to my faults in that exchange, but don't expect the same from Richard or his team. And that, to be honest, is where Smoothwall really fails.

Re:Correct Smoothwall Archive URL

[Paradise Pete]

I gotta agree with Watts Martin. The way I read it, dustmite was patient until you continued to ingore what he said. The feeling I got was that it was as if you were simply waiting for him to stop typing so that you could ask for it again.

It wasn't like he didn't understand you, he just didn't think it was a good idea. Then instead of either accepting that and giving up, or trying to persuade him, you simply repeated that you'd like to have it, as if you thought he somehow hadn't heard you in the first place.

Re:Correct Smoothwall Archive URL

[TellarHK]

Well, I said all that I had to say about those conceptions in my above post. I wasn't ignoring him, that much I'll add. I just didn't think the answer I got was much of any answer at all.

But again, my problem with Smoothwall isn't that it didn't give me what I mentioned on the IRC chat. IPCop doesn't give me those things either, but I use it now regardless. The problem is Morrell's attitude, and if you do a little poking around Slashdot stories prior to this one, you'll see that there're -dozens- of people he's treated just as poorly, with far less provocation that I admittly gave him.

Re:Correct Smoothwall Archive URL

[TellarHK]

Actually, I didn't get slapped down. Some people point out flaws in my dealing with the situation - which I'll admit - but I get emails of support and stories about other people having similar (or worse) experiences.

I consider this to be a good way to warn people about an individual who I don't believe is trustworthy, particularly with regards to something this important to the security of a network.

If he'll call the ISPs of his critics and make false accusations, make groundless threats of legal action, and continue sending emails after repeated requests to cease, he simply personifies the worst things about business in general. And this looks very bad for Open Source.

Re:Correct Smoothwall Archive URL

[Quarters]

I'm not quite sure why you think people should take your side in that argument. Personally, I think you're as much to blame as the SmoothWall folks.

You repeatedly ask for a feature in IRC. When you're told that they won't add such a feature because it would compromise their product you repeatedly ask for the feature until you become a nuisance and they ban you.

Then you email the owner of the company, without the IRC log to back up your claims, and state that a member of the company was mean to you.

The owner of the company, who has probably looked at the IRC log and noticed that you're not telling the whole story. Asks you to not mail him any more. Maybe he didn't do it in a very civil manner, but he did ask you to not mail him any more.

How do you respond? You repeatedly mail him, his team, an ISP that has no connection to the problem, and try to make submissions to Slashdot.

Then you have the audacity to get upset when the SmoothWall owner doesn't honor your request to stop emailing you.

What gives you the right to expect a certain level of respect that you didn't give to him? In the very first emails from the SmoothWall owner you were asked to never mail him again. You ignored that. Anything that happened after that is pretty much your fault.

Re:Correct Smoothwall Archive URL

[T-Punkt]

I just read the IRC log and I must say that his first answers were short but not rude at all (later after you have used up all of his patience he indeed gets slight rude...). But IMHO you were quite annoying since you just ignored his answers or haven't understood them.

I think the whole problem is that you want something like a small, secure operating system based on linux that has dhcpd and a webserver and IRC and ....

But Smoothwall is no such thing (you can abuse it as such of course, but don't expect support for that) - it's "a firewall". In short: A firewall is something that is inbetween you and the internet. This can be a software package (i.e. an add-on to the OS) that installs on your workstation or a device that sits on your uplink. And to be precise Smoothwall is the software/OS of such a device.

You really shouldn't run any additional software on the machine that runs Smoothwall, you should run them on machines that are either placed before the firewall or after it, so including GCC in smoothwall doesn't make any sense at all unless you change the purpose of the software from "a firewall" to ... whatever, you know what I mean.

Your failure was that you haven't understand the goals of Smoothwall and dustmite's failure was that he hasn't noticed that. When you said that you want to replace Suse and RedHat and only have "one machine to work with" and want to install/run this and that he simply should have said "Sorry, Smoothwall is obviously not the right solution for your problem. Use something else, we can't help you".

Oh, BTW: Do you really except help from someone after you have criticized him for his attitude? This is not a clever tactic.

Re:Correct Smoothwall Archive URL

[TellarHK]

As a potential user of his software, I have the right to be informed about a product I'm going to use - especially if it's something I'll be trusting my network to. As a businessman (which Richard appears to be, far more than a developer), Richard needs to be more in tune with making himself and his product look good.

And I didn't repeatedly ask for a feature, what I said was that the feature in question would suit -my- needs. People seem to think that by saying that, I'm making a demand. That's -really- inaccurate. Also, understand that I did not know that dustmite was in any way related to Smoothwall. He was not listed on the website's list of team members and IRC regulars, so I assumed he was just another user. He never identified himself as anyone with anything to do with the company, which is something that didn't become clear until later.

When I get an email like I did from him not once but -twice-, several hours apart, after sending a rather clear and polite letter about my concerns about the IRC conversation, I get the feeling that this person is -trouble-. So yes, after that I fanned the fires just a bit, and did so intentionally. People like Richard need to be exposed for what they are.

You say I didn't include the IRC log, but I can see you didn't read my site all the way through. I mention in the site and my letters back and forth to Richard that I had no way of acquiring that log, or I would have sent it. I was using the Java-based client on the Smoothwall website, and that didn't even have a cut and paste feature if I recall correctly.

I emailed his ISP (Well, tried to) because he was harassing me after a polite request to stop. He wasn't emailing me anything of substance, he was mailing me threats and invectives. Nothing even remotely constructive.

And anyone who says an argument over -anything- online deserves a false accusation of hacking being called into someone's ISP is nobody I'll be speaking with twice.

Re:Correct Smoothwall Archive URL

[little_fluffy_clouds]

My main suggestion, GCC, is something that could only be exploited from a root login.

Your misconception is why you have "suffered" all of this. A compiler can be used to get root, with the right exploit, e.g. a kernel race condition. If I somehow worked out how to get a non-root process to run something it compiled for me (some exploit), I can elevate my privileges if the kernel has the right kind of bug. These things do happen, for example, this one.

"dustmite" was correct, a firewall does not need, and should never have, a compiler.

Re:Correct Smoothwall Archive URL

[moonbender]

Gosh. They might treat other people unfairly, but christ, you so got the replies you deserved. The mere notion of mailing an abuse (or whatever you want to call it) mail after a pointless "fight" (in which you, quite obviously, were wrong) in IRC is so pathetic.

Re:Correct Smoothwall Archive URL

[deepvoid]

If you really want to put a web server and compiler on something outside the fire wall do the following:
1) Buy another machine, call it OUTSIDE.
2) Put OUTSIDE between your DSL hub and the world.
3) Put the firewall between OUTSIDE and your intranet (call it INSIDE).

If you want to manage anything on OUTSIDE, just do a cable swap for temp access and then swap back to put it back in the world.

OUTSIDE will be exposed to hazards, but the firewall will keep INSIDE fairly secure, as long as you don't pull a boner and put code generating or executing resources on the firewall. Oh, and by golly, don't log into OUTSIDE when it is exposed to the world, there are venders who make perfectly good hardware switches which can switch single or multiple connections.

Gee, maybe somebody already said this, if so just ignore...

May I suggest IPCop

[brianc]

http://www.ipcop.org/

It started as a fork of SmoothWall (without the
attitude) and has grown steadily since.

I encourage everyone to check it and the mailing lists out!

Re:This article is a perfect example...

[Ben Wolfson]

This f*cking article was up on the Reg® on the f*cking 27th of February! In the world *I* live in, that was last Wedesday! How the f*ck does this qualify as "news"?

Did you know about it last Wednesday?I didn't.It's news to me.

Re:This article is a perfect example...

[r00tdenied]

ERROR:

You have exhausted your use of the '*' key! If you use it again, your computer will let out high doses of radiation aimed at your manhood. Luckily for human kind this would rid your strain from the genepool! Have a nice day!

Oh, that's just great.

[Anonynnous Coward]

Now I have to go find every BBS archive that has my G-Phile with box lists and update them.

LRP is still alive

[giannifive]

LRP hasn't sold out. Check out http://lrp.steinkuehler.net. The latest version is only 3 months old, and comes in CD form.

A few firewall linux based distros

[Dacmot]

1. Freesco which I personnally use on a 486/dx2 with 8mb of ram. It has many functionalities like remote access, dhcp, dns, print server, firewalling, masquerading, bridging, support for many ethernet cards and best of all fits on a floppy (no HD required, but possible to do a HD install) Works like a charm and very easy to setup... almost plug and play (although not like windoze's plug and pray)
   
2. Coyote Linux which seems to offer a few more features than freesco, but requires 12mb of ram. Again, fits on a floppy.
   
3. SmoothWall which seems to be more of a feature complete firewalling solution includes web-based admin, proxy server and much more. It's larger (30MB or so) but seems fairly easy to use.
   

Saw this and thought...

[gmhowell]

I was grocery shopping today. I noticed that the elephant is no longer on the peanut butter cap'n crunch. And that 'thing' is no longer on the crunch berry box. I figured the first link in this story would go here. Nope. Just some boring hacker crap.

(and for those keeping score, I am in fact blocking timothy's articles from the front page. I came here after seeing the headline on another site.)

Re:This article is a perfect example...

[talks_to_birds]

Yeah. I read this, there, on Wednesday.

Seriously: check out the Reg® at http://www.theregister.co.uk/

It's an excellent news source, with a British/European focus, it's extremely well-written, and covers a lot of stuff that most of the people who read *^H (oops: not supposed to do that ;-) this place would probably find interesting.

If conservation of bandwidth is your gig, check out the USA version at http://www.theregus.com/

It's a little different in content (less British focus..) so I personally find it a little less interesting..

t_t_b

Re:This article is a perfect example...

[RickHunter]

Yes, but olds are what people pay for from news services. Think about it. CNN - reports stuff people already know, but tries to make them feel good about it. NBC - does the same. Practically any newspaper - same.

Occasionally they include some true news, but then again, so does Slashdot.

If anything, Slashdot is about as bad (good?) as most "reputable" news sources. IOW, they fuck up on a regular basis, report on things that are out-of-date, and spin stories to fit their personal biases.

Go figure, they're human. I dare you to do better.

LRP is now LEAF...

[phraktyl]

LRP has been superceded by the LEAF project at http://leaf.sourceforge.net. I'm running a current LEAF distro (Oxygen) and it's rock solid. There are quite a few different flavors, depending on your needs and experience level.

From the LEAF site:

An easy to use embedded Linux network appliance for use in small office, home office, and home automation environments. Although it can be used in other ways, it's primarily used as a gateway/router/firewall for Internet leaf sites.

Last Oxygen release was about 2 weeks ago.

Re:LRP is now LEAF...

[Stinking Pig]

Hee-hee, I clicked on this article for the sole purpose of seeing if I'd be the F1rst P0ST d00d for LEAF.

Seriously, LEAF distributions are one of the best ways available to secure a network. Floppy-sized distribution, pre-made disk images, scripted configuration, and no need for read-write media. They run from RAM disk, don't install things you don't need, support boot from CD-ROM, flash disk, floppy, zip drive, or network, support backup of configuration files only if you're booting from non-writable media... I could go on for a long time, but check out http://leaf.sourceforge.net instead.

.

Furby Intrusion Tool

[Ilan Volow]

I bet some enterprising 15 year-old nicknamed "Captain Furby" will find that the 8156khz sound of a Furby's voice produces the perfect pitch to crack the "Crunch Box".

Re:File systems - Not all

[jackb_guppy]

IPCop now is using Ext3. See features of V0.1.1. 2.4 Kernel and IPTables in V0.2

Re:This article is a perfect example...

[talks_to_birds]

Sorry: you're quite right.

From now on it'll be <strong>strong tags</strong>

How's that?

t_t_b

ClarkConnect

[CDS]

I have been using ClarkConnect for quite some time, and have been very impressed.

It is a full linux distribution, based on redhat 7.2, and is your typical linux firewall/router, but also comes with Snort, SSH, Junkbuster, Apache, proftpd, samba, cups, webmin, MRTG, etc.

The interface is web-based or commandline-based.

I am currently running it on a 486-66, 20M ram system, and the routing is very quick (I don't notice any slowdowns at all), but administration is a bit slow with this old box.

I'd highly recommend it.

Re:This article is a perfect example...

[talks_to_birds]

hmm..

Although I do reserve the right to use an asterisk in an expletive, as I did in the offending passage, above, by replacing the vowel with a star to soften the full weight of my choice of words...

t_t_b

How about this?

[BJH]

If you can read Japanese (and if you can't just look at the pictures), how about OpenBlockS?

It's tiny (look at the picture about halfway down the page to get an idea of how small it really is - those are RJ-45 ports), runs Linux, and you can fit it with a HD if you really want to (although I don't see why you would).

Trinix

[BluesGeek]

The Trinix distribution seems like a powerful way to do this also. The homepage is hear
Trinix
It is intended as a network analysis tool, but it is has all the cool features (OpenSource, runs entirely in RAM, floopy boot, etc ...). I've havn't tried it yet myself as I am currently running the LRP distro without a problem.

LRP is *NOT* Dead or Sold Out!

[Halvard]

This is an amazing thriving project with multiple branches. The coordinating web site is http://leaf.sourceforge.net/. The original poster couldn't be more wrong about its demise.

astaro firewall

[Pika]

check out astaro firewall at www.astaro.com.

it is a linux based firewall solution with vpn & virus scanning support. it's the most comprehensive firewall package that i have seen (and that is freely downloadable).

astaro includes implementations of other security related products (swan, etc) all in one package. definately worth a try.

Try IPCop

[SFNative]

Anybody who has heard of Smoothwall has heard 1)It works like a charm, 2)The support involves calling people assholes and telling them to fuck off.

IPCop works just like Smoothwall for now. The next version has some incredible features that will take you to places you can only go with Smoothwall if you're willing to pay, if you can go there at all. Plus, the support is quick and friendly.

I use IPCop at home, at work and set it up for freinds and couldn't be happier.

It has IDS, VPN, a web proxy...eh, I could go on and on. Go check out the page!

Long live IPCop!

Re:Try IPCop

[wpanderson]

> Long live IPCop!

interesting that most of these comments about ipcop popped up after this was posted to one of their lists ...

personally I'm more interested in *BSD variants to Crunch's new box rather than listen to a rehashing of whatever many other discussions / arguments / holy wars have gone by over Linux-based distros ...

I thought the title was about the cereal

[antdude]

Sheesh! :)

LRP Sold out?

[macdaddy]

Can someone explain? I must have missed something.

(this post isn't worth modding so don't)

Just spoke to the owner...

[g_bit]

I called the number on the site to find out the price because it wasn't listed.

One of the developers picked up the phone and told me all sorts of stuff about the firewall including the price and then, when I told him that his product was on /. he freaked and said "Oh no! Our site is getting /.ed guys!!".

Way to go /.ers!

Re:Smoothwall Attitude Problems (was: Smoothwall)

[dpotter]

Just took a quick look at the Smoothwall FAQ and I have to say that you appear to be correct about Mr. Morrell's attitude:

The FAQ devotes 32 of 88 pages to how to correctly interact with the community, with such topics as "On Not Reacting Like a Loser" and "RTFM and STFW: How to tell you've seriously screwed up."

Furthermore, the remaining 56 pages are liberally sprinkled with the same: "Asking this question on the mailing list or IRC will inevitably result in the verbal equivalent of being hit round the head with a baseball bat. The answer is NO."

While I appreciate the sentiment of these statements, devoting nearly half of the document to this topic might be a little overboard.

Re:This article is a perfect example...

[Hal-9001]

Agreed...the writing in the Register is too lurid for my tastes. I prefer having my Register stories filtered by other /. readers.

Summary of mentioned firewalls, and a question

[Anonymous Coward]

It looks like a lot of the Linux-based firewalls I've seen recommended here use ipchains with the 2.2 kernel instead of iptables with the 2.4 kernel. As far as I understand, this would mean they can't do connection tracking for things like FTP and IRC. Here's what I'm able to figure out so far...

Firewalls using iptables with 2.4.x kernel:

• Astaro Security Linux: kernel 2.4.x
• BBIAgent: kernel 2.4.13
• ClarkConnect: iptables, kernel 2.4.9-31 (RH 7.2)
• Trinux: iptables, kernel 2.4.x (Slackware)

Firewalls using ipchains with 2.2.x kernel:

• Coyote Linux: kernel 2.2.19
• IPCop: kernel 2.2.x
• LEAF/LRP/Dachstein: kernel 2.2.19
• Mandrake SNF: kernel 2.2.19
• Smoothwall: kernel 2.2.19

Firewalls using ipfwadm with 2.0.x kernel:

• Freesco: ipfwadm, 2.0.38 (!)
• FWTK: Dunno, looks old, mentions ipfwadm

My question is, isn't it best to use an iptables-based firewall on a 2.4.x kernel instead of an ipchains- or ipfwadm-based firewall on a 2.2.x or 2.0.x kernel? I definetely want the connection tracking capabilities in the 2.4.x kernel, especially for screwy things like FTP, IRC, etc. (Yes, I know there is an IRC connection tracking patch out now for 2.4 kernels...) Is a kernel that doesn't support connection tracking for firewalls a reasonable option these days?

Re:Summary of mentioned firewalls, and a question

[wpanderson]

> Smoothwall: kernel 2.2.19

2.2.20 since the fixes5 update

Re:Summary of mentioned firewalls, and a question

[SpaceLifeForm]

I don't believe so. Netfilter/iptables is more powerful than what was available prior to 2.4.x kernel.

Re:Summary of mentioned firewalls, and a question

[GlobalEcho]

Linux firewalls and NAT routers were able to handle FTP and IRC at least as far back as the 2.0.x series kernels, using kernel modules that I assume basically forced state tracking on these types of connections. Other modules handle all the other major protocols like this (e.g. RealAudio).

LEAF/LRP/Dachstein do so automatically. I assume most if not all of the others you cite do so as well.

So, to answer your question, the answer is "no". Lack of support for connection tracking is indeed unacceptable. But 2.0.x and 2.2.x have tracking after all, at least where it matters.

Re:Summary of mentioned firewalls, and a question

[salmo]

Actually the 2.2.x kernels have better support for this type of thing via kernel modules (which netfilter also requires). There are a few modules that haven't been ported to netfilter yet (see http://www.netfilter.org for more info on this).

Also, in my experience with my NAT box (a PII 266, w/ 96 MB of RAM I have had lying around) I found that for some reason 2.2 w/ ipchains handles the traffic much more efficiently than 2.4 w/ iptables. This may have to do with the fact that I am using old EISA 3c515 card and an onboard tlan NIC (I know some changes have been made to the 3c515 driver, but you think that would have improved performance). The rules were rougly the same (based off the IP Masq HowTo) and the only things I am running on it are sshd and bind as a caching name server. (If anyone can tell me why this is the case please do!)

Also, I know it sounds silly to run bind on a firewall, but this is more to provide access to my network at home, not for security per se. I was working around having to update the configs of all of my machines every time road runner changed the DNS servers on me. (Again, if anybody has a better work around, let me know!)

Re:Summary of mentioned firewalls, and a question

[GC]

I may be wrong here, so check...

I believe that Kernels running 2.4 and netfilter (i.e. iptables) check state of TCP connections. i.e. They follow the connection build (SYN, SYN/ACK, ACK) and the teardown (FIN, FIN/ACK, ACK).

I don't think ipchains works that way and is a simple packet filtering firewall.

Re:Summary of mentioned firewalls, and a question

[garbageiscool2]

I just tried out BBIagent and it is working well but i have a few problems with the java control panel it uses. Mainly that when i am using the blackdown java it crashes galeon/mozilla and i was only able to get it to work with using IE on a windows computer.Otherwise works very well.

Re:Summary of mentioned firewalls, and a question

[BurritoWarrior]

The velociraptor firewall by Symantec uses Linux 2.4 as well. It has a very easy to use Microsoft Management Console (MMC) based GUI to manage it. It also has a proprietary process that runs on it that proactively kills any other processes that are not supposed to be running.

A nice combination of usability and stability, imho.

Re:Summary of mentioned firewalls, and a question

[jred]

I know that a while back a buddy of mine was switching all his home boxes to 2.4, and when he got around to the firewall, there were some fairly important (to him) modules (?) that wouldn't work w/ 2.4. That might be rectified by now, though.

This reminds me....

[dadragon]

This kinda seems like PicoBSD a free, small BSD dist for this purpose... along with others.

Another OpenBSD based minimal Firewall

[little_fluffy_clouds]

The emBSD Firewall seems to be right on track, and you can download it right now. I've not tried it, but it runs off a 32MB Compact Flash.

FrazierWall Linux

[bkives]

Coyote Linux has one of the easiest installers. It even installs from windows.
http://www.coyotelinux.com/
But if you run it through GRC's Shields Up at: http://grc.com/default.htm
You will see closed ports on the default firewall ruleset.

Might I suggest FrazierWall Linux. It is a fork of Coyote and LRP, but with better default firewall rules, and a built in web server for local firewall status information. And it will even e-mail the firewall logs to you.

http://www.frazierwall.com/

Plus it passes both the Shields Up and Sygate Scans : http://scan.sygatetech.com/
with stealth mode almost everywhere.

I did have some problems with in initial install. I looked in the config files from Coyote to get things straight with FrazierWall. Other than that, FrazierWall is a well done firewall.

Re:FrazierWall Linux

[Gis_Sat_Hack]

With regard to "passing Sheilds Up & Sygate Scans",

I feel compelled to point out that the box
I am currently using is a bog standard Wintel
setup running win 98 connected to the internet
via a garden variety cheap ISP.
The only 'security' running is an early version
of ZoneAlarm & the use of Junkbuster's IP forwarding
through a proxy.

This combo *also* passes these 'security' scans.

With the proxy in place, they get the _wrong_ IP address & scan my proxy host, not me.
With the proxy disabled, they get the box IP correct, but ZoneAlarm happily blocks all ports
in stealth mode.

I _don't_ regard this box as secure at all, in fact
it's the 'fun, toy, browsing & downloading' box that sits on the *outside* of the real firewall
that protects my actual working & developing network.

Re:FrazierWall Linux

[Lumpy]

Unfortunately it has some problems. you can produce screwed up disks easily out of fraizerwall. and trying to make modifications can be a pain in the ass for anyone that isnt intimately familiar with it.

Also, any firewall that doesn't respond to icmp pings is incorrectly configured. "stealth mode" is just a broken firewall config and should never ever be encouraged... as it can cause huge headaches with dhcp leases to the firewall, and other networking problems for the firewall user as the provider shut's down the users link due to not being up. (@home had this in some areas... you didn't allow pings in? your dhcp didnt lease an IP (even if you had a "static" ip.)

Fraizerwall needs alot of work before it can be unleased on anyone that has less than 4 years Linux experience.

Re:Smoothwall Attitude Problems (was: Smoothwall)

[dpotter]

Just noticed that those first 32 pages were written by ESR, not Mr. Morell. Credit where it's due.

dp

FrazierWall Linux

[bkives]

I like Coyote Linux. I used it for some time. It has one of the easiest installers. It even installs from windows. But if you run it through GRC's Shields Up at: http://grc.com/default.htm you will see closed ports on the default firewall ruleset.

Might I suggest FrazierWall Linux. It is a fork of Coyote and LRP, but with better default firewall rules, and a built in web server for local firewall status information. And it will even e-mail the firewall logs to you.

http://www.frazierwall.com/

Plus it passes both the Shields Up and Sygate Scans : http://scan.sygatetech.com/
with stealth mode almost everywhere.

I did have some problems with in initial install. I looked in the config files from Coyote to get things straight with FrazierWall. Other than that, FrazierWall is a well done firewall.

E-smith/SMEserver

[lesmikesell]

The modified RedHat distribtion peviously known as e-smith (now SMEserver) is available for free download at http://www.e-smith.org (follow the download link). It includes pretty good ipchains based firewalling, even when configured to run as a server and internet gateway on the same machine. If you haven't seen e-smith, it is basically an office-in-a-box providing internet NAT routing and all the usual server functions with administration through a web interface simple enough that you can let someone else do it all. They have been purchased by Mitel who sells service related to the software - if you vist the http://www.e-smith.com site (instead of .org) you won't even see the free download mentioned.

Another LRP branch

[wecoyote52]

I might as well blow my own horn...

http://www.frazierwall.com

It is an LRP floppy distro that is customized, runs a 2.2.18 kernel, supports most NICs, and has a thttp web interface with tons O'info about your hardware, network, and connections.

It also mails firewall blocking logs daily, provides a network time service for your LAN and has a user oriented interface.

It's cracked already?

[farrellj]

Their webpage says:

"Evaluate our demo at:
https://demo.shopip.com"

But I don't get a connect, has it been cracked already?

ttyl
Farrell

What about a general-purpose distro?

[Ian Bicking]

How hard is it to use a general purpose distrobution for a firewall? It seems like it might be nice to be able to add a web server, file server, print server, or whatever to your firewall -- especially if the firewall is more to provide NAT than to provide security. A general purpose distro makes this sort of thing easy, and any vaguely modern machine is going to have power to spare to provide other services.

Are there any packages for Debian or RedHat that provide firewall functionality easily?

Re:What about a general-purpose distro?

[jeboyer]

Check out Gibraltar. It's a Debian-based firewall system that boots off of a CD--like a floppy-based system, but with more space for bells and whistles.

It looks to be under heavy development at the moment, and the developer seems to be a pretty active in Debian developer (various firewall type packges such as freeswan, PoPToP, etc.)

Re:What about a general-purpose distro?

[ocelotbob]

SuSE does this. The default install installs a "personal firewall", which shuts down pretty much everything. For purposes of setting the machine up as a more full-featured firewall, it comes with a package called susefirewall, which consists of a fairly quick configuration process that gets pretty good results. I'd say it comes close to, if not matching, the capabilities of the dedicated firewall distros.

Re:Smoothwall -smoozewall / IPCop rules

[Keezdriver]

For a real FREE firewall go to http://www.ipcop.org and download a firewall that's easy to set up, has a great Administration manual and a FREINDLY user list for those special problems. I used to use that other firewall but got tired of reading how I wasn't supposed to ask for support because I didn't freaking buy his corporate product, thing is I was GOING to buy the Home Server when it came out but now I've moved on to a better producy with freindly support. Michael T

nice...

[PierceLabs]

but I wonder if it stuff cuts the roof of your mouth :D

Re:Smoothwall -smoozewall / IPCop rules

[Keezdriver]

and yes I know friendly is spelled wrong twice and I meant product not producy. SmoothWall support still sucks. Michael T

Congrats, Crunch!

[jcr]

Well dude, I guess you got the publicity you were looking for ;-)

-jcr

Re:File systems - Not all

[wpanderson]

> IPCop now is using Ext3. See features of V0.1.1.

As is SmoothWall Corporate Server, and as will the next release of the free version of SmoothWall.

> 2.4 Kernel and IPTables in V0.2

should be interesting to see just how much breaks when you do that Jack :)

unbreakable?

[krokodil]

It may be unbreakabale but looks like it is
slashdottable.

At last...

[quintessent]

...No more Soggies!

Mandrake SNF

[Linegod]

Mandrake Single Network Firewall - http://www.mandrakesoft.com/products/snf . Simple to install, and simple to maintain. The latest version, which is still in 'Cooker', uses shorewall - http://www.shorewall.net and can be installed from the Cooker Beta ISO simply be select the 'snf' package only.

.

Re:This article is a perfect example...

[nomadic]

I dare you to do better.

Most real sources actually have the decency to RETRACT incorrect stories.

Re:LRP "sold out" ? --- LEAF

[jmarca]

yes, thank you for stating what i was going to say.
i'm glad your response was modded up. I am quite satisfied with the level of activity on LEAF. We are going to move to a recent version of Oxygen in the near future. And the reason for doing that is to be able to run Seawall as a firewall on our
'embedded' boxes.

heres an idea

[stupidbugyougosquish]

What? A free packaged firewall. This I think fits that question like a glove.

Take a look at emBSD

[draziw]

emBSD based firewalls are built on OpenBSD. Right now there is a 1.x line of emBSD which is built on OpenBSD 2.9, and there is a 2.0 emBSD beta which is built on OpenBSD 3. It is built to be a hard core firewall/router running from 32 megs of flash memory. I'm running LRP on a few systems (some floppy, some from IDE based solid state disks). I plan to migrate my LRP systems to emBSD 2.0 when it comes out of beta.

Re: Updating Smoothwall yourself?

[King_TJ]

It's always interesting to see people so quick to attack an author of security-related software when they ask how to essentially "de-secure" the product!

I mean, honestly, it's probably a little "over the top" to ban your IP over the question -- but looking at it from the author's side for a minute; You're basically trying to modify the package to suit your specific needs. If you do this, you run a risk of introducing new code that's untested as to the level of security inherent in it. If the author helps you do these modifications, and then your box gets hacked later, how do you think that reflects on his original product?

Richard Morrell may have his share of attitude problems, but I don't think this is really a fair one to use against him. Firewalls are *not* supposed to run other services. People keep trying to add ftp, printing and Samba file sharing services to Smoothwall, among other things - and it's just a BAD idea.

Re:Woz and hacking

[King_TJ]

Eh... I remember in the "good old days" of computing (when the Commodore 64 ran most of the BBS's out there, and people had fights over which platform was best: Tandy, Commie, or Atari), Woz was pretty well-regarded in the phone phreaking and system hacking communities. I don't think it was necessarily because anyone thought he was really good at it, but more because he had "celebrity status", yet still kept friends in those circles.

I even remember getting called up, late one night, and added to a huge conference call that a phone phreaker set up. Woz was in the call, along with a lot of regular attendees of the 2600 group meetings and so forth. (It's been years now, but I believe they hacked a code for a conference calling service called "Alliance", and they were trying to see how long they could keep the call going -- adding new participants as other people got off the phone.)

I don't even recall what the topic of dicussion was, but I don't think it was anything substantial. Pretty much just a lot of "Oh wow, cool - so who's all in here tonight?" and misc. chit-chat.

Re:Clarkconnect = insecure!

[King_TJ]

I looked at Clarkconnect, but I refuse to run it. Why? Because honestly, what kind of serious firewall product also leaves all those other services running? What's the point in protecting your systems and data behind a firewall, when at least some of your important files and servers *are* the firewall? There's no line of defense in front of your print server, file server, etc.

The difference between Business and Engineering

[trenton]

That Woz quote got me thinking...

Let's say you have a good product and you want to get it endorsed. Bring it to a business guy, and he'll say: "This box is uncrackable. It's totally secure and cannot be comprimised."

Bring the same thing to a well-respected engineer and he might say: "It's darn, near impossible to crack. Hey, nothing is impossible, and there's always a risk, but this product is as good as it gets."

Too bad only the first endorsement would ever help sell the product.

A server with 1 up on smoothwall

[fireboy1919]

Yes, smoothwall is good, and yes, Clark Connect is even better. I haven't tried this Freesco thing, but I'd have to say it may not serve you if you want to have more services than the average router. If you look in the nearly unnoticable corner of the web you'll find the "shop" with the real beauty - the Start-up server. This is a router with a lot of interesting features, including a console menu system called "smat" that lets you do everything you need, and which, I might add, is highly configurable because its written in Bash (you also get webmin). Its also based upon Slackware, so you get to download any of its packages if you need them. The one feature I particularly like about this distro is the fact that it uses the keyboard LEDs (num, caps, and scroll) as status indicators for the network, so you don't have to plug in a monitor to troubleshoot the connection at the source if anything goes wrong.

FLOPPYFW!

[DaCool42]

floppyfw is a sweet deal. 1 floppy. easy config. i've got mine set up to do dhcp for the internal network and everything. very nice.

/. effect

[jonnystiph]

Here is a google cache of the page with the specs.

Re: Updating Smoothwall yourself?

[xtremex]

Why couldn't he say it like YOU did??? I wanted to upgrade a process running on the server. Just a simple question. It didn't have an ftp client, so I asked if there was a way for me to upgrade a package..he didnt even ANSWER the question. He said "*I* made this damn product, and if you don't like how it's made, go fuck yourself", and then kicked me out of the channel and banned me (this was a while ago). I could take a flame if it's deserved, but this just SHOCKED me..it was uncalled for. I still use Smoothwall however.

The fork of Frazierwall.....

[cyberkahn]

will be Nileswall. :-)

OpenBSD - an Invisible Firewall :-)

[Midnight Ryder]

I'm using OpenBSD 3.0 (which means pf instead of ipf for the filtering) and set it up as an ethernet bridge that does firewalling (IE - this sucker has no IP address, and can't be hacked from the outside world - in fact, it's friggin invisible. What a wonderful setup!) The disadvantage for most people, however, is that if you do it this way there's no remote administration. That's fine with me - the firewall machine has monitored physical access (in other words, it's locked in a cabnet the sets in my office :-)

There's some oddness doing it this way, but, it's really worth while if you want a machine that can't be screwed with at all. And, vi sucks, but is survivable ;-)

Oddly enough, all the docs I found on doing it this way were for previous OpenBSD versions, which used ipf for filtering. pf and ipf are close enough that the docs for doing it are still pretty close to in date - but there's just a few things that would have to change for it to be correct. A little searching through the pf man pages will show the differences.

Re:File systems - Not all

[slydder]

>> IPCop now is using Ext3. See features of V0.1.1.

>As is SmoothWall Corporate Server
>[smoothwall.co.uk], and as will the next release
>of the free version of SmoothWall.

hmmm. Ext3 under GPL and Ext3 after paying.

>> 2.4 Kernel and IPTables in V0.2

>should be interesting to see just how much
>breaks when you do that Jack :)

Yes. It should

Charles Williams
PM IPCop Linux

Re:Woz and hacking

[Anonymous Coward]

Haha! I remember being called from Alliance conferences. This was about - 7 yrs AFTER I was "popped". Do you know Adfam Bauman?

Contact me, King_TJ, I'm sure I know you... :-)

Crunch

Re:Woz and hacking

[rsfc]

I read somewhere that he and Jobs managed to wake up Pope, phreaking as a Foreign Office, or something...

Vatican security checked the call with FO though, so he (Pope) never actually answered.

Bifrost

[dNil]

There is a real nice, stripped clean and naturally free linux distro for firewalls/routers called bifrost. The latest few versions use 2.4-kernels, but they keep a nice annotated back-log of their old distros since 1997. The distro has a fairly clever system for dealing with mobile users (called nomad). It lacks a "click-and-go" wui by design, due to the risk of unneccesary security breaches - in my translation from the swedish pages - Correct filterrules are preferentially constructed "offline", and transfered by scp. For those who want clickability and colors, we recommend Xemacs for suitable coziness. Imho, thats the way to go (although I zealously use emacs instead).

The guys who maintain bifrost/nomad spend a lot of time on fairly advanced network performance testing with different hardware/driver combinations, so you maight want to consider their hardware recommendations as well. For the machines they put together for the Swedish university network, they go with flash-drives for safe (and fast) storage.

If you are curios about the name of the distro, the following helps:
The name Bifrost comes from the nordic mythology, where Bifrost is the bridge between Midgård (The Earth) and Asgård (the home of gods) and is called The Rainbow by humans. It's so strong that it will not be destroyed until Ragnarök - the end of the world. Bifrost is guarded by Heimdall and the red color one can see in it, is a flaming fire that prevents the giants to climb up to Asgård.

Re:File systems - Not all

[wpanderson]

> >As is SmoothWall Corporate Server
> >[smoothwall.co.uk], and as will the next release
> >of the free version of SmoothWall.
>
> hmmm. Ext3 under GPL and Ext3 after paying.

which part of "next release of the free version" didn't you understand? :)

Re:Smoothwall Attitude Problems (was: Smoothwall)

[Scooby Snacks]

The original document is available on ESR's site, BTW. (If you're interested.)

COYOTE LINUX !!!

[CDWert]

From one of the fist fellows to bring a RoadRunner clinet to Linux, Josh Jackson.

This is simply put the slickest stuff going from what Ive seen, I actually waled my mom through an install over the phone.

COYOTE LINUX

There is it appears a new embedded version, Ill have to look at that,

Ive had 2 installs up for over a year, both only ceased functioning once, when the people at their location forgot it was there and unplugged em, (both places:)

To me something you can truly forget about is the ticke, VPN clients and all....

Yes, but...

[Pig Hogger]

... does it comes with bells and a whistle?????

Don't trust anything written by Draper...

[deepvoid]

I can understand Steve's misdirected trust for John "Captain Crunch" Draper, but is there any network administrators out there who would stake their reputations, and possibly their jobs on a firewall written by this guy? Having reviewed code written by this man, I beleive I am accurate in saying he should stick to hardware design, and leave the software to the pros.

I have to admit, he is rather good at "networking", but not the sort used in telecommunications. Social engineering skills do not qualify a person for the hairy task of writing an unbreakable firewall, and unless his skills in the hard sciences have dramatically improved in the last 10 years, I figure there will be plenty of opportunities for buffer over-run and DOS attacks in the near future.

Prove me wrong John, put your source in the public domain, under the same open source scrutiny as OpenBSD, and if it is a secure (and not through obfuscation either) as you say it is, I'll sing your praises instead.

anyone seen it?

[Tom]

did anyone else notice that there are almost no comments about the box itself, just tons of comments about other Linux-based firewalls?

has anyone ever seen the box, used it, witnessed a demo, anything? or knows some more details, like pricing, which aren't immediatly apparent from the website?
if so, please share your knowledge.

Re: Silly FUD

[Anonymous Coward]

You dumbass, those are options that you have to manually turn on during the installation.

By default it is set up simply as a firewall/router.

Any distro is only as safe as the services its running on open ports. duh.

I looked at Clarkconnect, but I refuse to run it.

You looked at what the package listing on the website?
You obviously didn't "look at" the distro enough to know what you're talking about.

Who in the fuck modded this guy up anyway?

Free Firewall

[AciDive]

Securepoint is a free Linux 2.4.x based firewall. You can find it at www.securepoint.de. Itlooks priety secure to me but it has one draw back, if you want to use the graphical administration software that comes with it you have to have a windows box, other than that it looks like it could rank right up there with a checkpoint-1 system. The system is administerable from the console if you do not want to use a windows box.

yet another floppyfw

[gelfling]

Here's another !!

http://www.zelow.no/floppyfw/

The info on /. today is great - truly the reason /. exists.

Re:This article is a perfect example...

[JPriest]

The Reg usually makes for an interesting read
The Inquirer is a good source for AMD/Intel roadmaps and bleeding edge tech news.
Anandtech is not updated that often but the often have the best coverag and reviews of new products and technologies.
I don't visit Toms Hardware often but it is another good source for benchmarks and reviews.

Homemade Linux Floppy

[clasher]

For those looking for instructions on building a linux floppy take a look at some documentation I made up while working on my own.

I had not found any good linux floppy firewall distributions running 2.4 the kernel so I figured out how to do it myself. This document doesn't include the instructions on how to include iptables but I will be adding that soon (it isn't too difficult).

Re: The Answer is .... "Wrong"

[fferreres]

The reason for that attitude is having 100% control, not 100% security. You cannot assume someone is security illiterate and conclude just wanting to be able to change anything is a security vulnerability.

One day, they may find this FW has a vulnerability, and ALL of this firewall will have that one. Because they are all the same.

Bottom line: i think you are plain wrong, tohugh I will agree that anyone security illiterate is better of leaving things as they are.

virus scan = $$$

[fferreres]

It's not in the freeloader version.

Also, it doesn't have DHCP ("because a firewall is not supposed to do that, and is a security vulnerability.......") so if you use a cablemmodem or anything that gets the IP from a DHCP server, you are out of luck. There are some ways to add DHCP, but from external parties. But the web interface is not very aware of the fact the IP will change (rule making nightmare).

Re:virus scan = $$$

[fferreres]

Well, i'm waiting for the dhcp enabled final release of astaro. Another problem with astaro is that it requires more CPU power than other firewalls. You can do with a 133 pentium for low badnwidth (512kb/s) anyway, just the web interface is slow.

But the requirement states the minimun cpu is a 300 mhz celeron and 64 mb ram. The old 486 with 16 mb won't work. A 32 mb 90 mhz pentium 1 will be painfully slow.

I'd say astaro is great for > pentium 200 mhz with > 64mb ram.

Re: Updating Smoothwall yourself?

[Anonymous Coward]

Bad attitudes must be very prevalent among the "security elite" (in the computer industry that is).

Think about it: Darren Reed, Richard Morrell, Theo De Radt, etc. etc.

They all share common traits: bad attitudes and superiority complexes.

From what I read and understand, Richard Morrell is just a mean wanker, with no justification or provication. Darren Reed and Theo deRadt aren't so flamboyant as Morrell. They are pretty understanding, and you can atleast communicate with them, unless you are one of the other.
They seem to be stubborn more than anything; however, they have the right to do what they want with their respective projects.

I think the source for all of this is, of course, insecurity (in a personal, non computer related way).

Re:File systems - Not all

[wpanderson]

eeeeeeeeeeeexcellent - the AC crowd show their true colours once again! "raping cott deaths"?? isn't this a family show?

Re:FreeSCO = terrorists

[jsailor]

Unfortunately the previous poster made the mistake of implying more terrorist incidents were a good thing. But for those of us not isolated from the incidents, the few weeks after 9/11 were the only prolonged periods where I can remember Americans actually caring about people other than themselves.

The original poster's ignorance that Arab=bad is pathetic and on a good day is considered racist. I didn't think the slashdot community was this narrow-minded about anything other than open source.

... and for the record, I live in Manhattan, lost friends and colleagues, and don't condone terrorism.

Re: Silly FUD

[King_TJ]

Ok, bright guy - so you think it's a good programming decision on the part of Clarkconnect and other firewall authors to give the user the option of running server services on top of the firewall??

Of course you can turn the stuff off. The point is, it's misleading to release a security product with the ability to do quite insecure things with it. At the very least, it's bad practice and teaches bad habits.

Show me a single Cisco firewall product with Samba or print services optionally running on it?

Re:Smoothwall Attitude Problems (was: Smoothwall)

[symlink]

After reading the whole introduction written by ESR, my thoughts were "What an overinflated sense of self importance!"

Anyone who has the time to write a 30 page document on how to properly ask a question of a hacker has WAY too much time on his hands.

Quit trying to convert the world, and just use your "delete" key. It's there for a purpose.

Re: Updating Smoothwall yourself?

[dgavin]

If you lurk on the smoothwall email list for a while you'll see why Richard get a bit cranky. Threatening phone calls to his home with rude messages left with his children.. Having to exlain (for the 1,000th time) why a firewall should not be running {ftp|tftp|rsh|rexec}. Lusers asking the same old questions for the 50th time and getting all upset when the response to their badly phrased question is a quick "sod off!". I agree that Richard can be a very disagreeable fellow, but I can't fault the software or the behavior of the rest of the team from what I've seen.
I've been running smoothwall for several months and other than the nag screen and ads on the web interface, I have no issues with it - I even donated to the team before that whole subject got tense. I've found it easy to install, maintain and use. Several friends have also installed it and are quite happy with it.

Re:Smoothwall Attitude Problems (was: Smoothwall)

[mudshark]

With profuse apologies to Monty Python - I couldn't help but think of this:

M = Man looking for support, R = Receptionist, Q = Mr. Morrell

M: Ah. I'd like to have some support, please.
R: Certainly sir. Have you been here before?
M: No, I haven't, this is my first time.
R: I see. Well, do you want to have just one support incident, or were you thinking of taking a course?
M: Well, what is the cost?
R: Well, It's one pound for a five minute incident, but only eight pounds for a course of ten.
M: Well, I think it would be best if I perhaps started off with just the one and then see how it goes.
R: Fine. Well, I'll see who's free at the moment.
Pause
R: Mr. DeBakey's free, but he's a little bit conciliatory.
Ahh yes, Try Mr. Barnard; room 12.
M: Thank you.

(Walks down the hall. Opens door.)

Q: WHAT DO YOU WANT?
M: Well, I was told outside that...
Q: Don't give me that, you snotty-faced heap of parrot droppings!
M: What?
Q: Shut your festering gob, you tit! Your type really makes me puke, you vacuous, coffee-nosed, malodorous, pervert!!!
M: Look, I CAME HERE FOR CUSTOMER SUPPORT, I'm not going to just stand...!!
Q: OH, oh I'm sorry, but this is abuse.
M: Oh, I see, well, that explains it.
Q: Ah yes, you want room 12A, Just along the corridor.
M: Oh, Thank you very much. Sorry.
Q: Not at all.
M: Thank You. (Under his breath) Stupid git!!

Re: Updating Smoothwall yourself?

[walt-sjc]

Heaven forbid that Red Hat Liux users would want to upgrade any of their software. They may destabilize the whole operating system! This would make RH look bad.

Yes, your argument IS that stupid. If I want to upgrade my Palm, Tivo, PC, Mac, Dishwasher, toilet, install Dr. Sholls insoles in my goddamn shoes, it my right. If my feet smell, it's MY problem, and Nike shouldn't care!!! It doesn't make Nike look bad...

Once I buy a product, it's mine. If I upgrade it and fuck it up, it's my fault. If the mfr. gets pissy, then it's time to find a new product.

Richard Morrell is not the god of all firewall products. Maybe I know what I need in a firewall better than he does. Maybe MY business needs exceed the artificial limitations that his product has. Maybe I want to add IDS capability - THAT certainly belongs in a firewall. Maybe transparent filtering proxy. That belongs there too. Maybe better NAT support. Whatever.

Look where Linux would be if Linus refused to incorporate patches written by others, and didn't release source. Hmm. Probably a pile of crap. It's one thing to be strong willed, and another to be an arrogant asshole.

Yes, adding some services random service like samba, etc. isn't very smart, but forewarn the user. Educate. Do NOT put artificial restrictions and limitations in the product, as that reduces the utility greatly.

Re:Smoothwall Attitude Problems (was: Smoothwall)

[GSloop]

[Smacks you in the nose]

"Well, you're just DAMN UGLY"

Explaination doesn't make it any more correct. Manners are what my/your mother should have taught you. Obviously, Dick either didn't have a mother, or one that didn't do her job. (Or was that a father?)

Cheers!

Re:Smoothwall Attitude Problems (was: Smoothwall)

[GSloop]

ROFL! That seems to explain it fully.

Dick is trapped in flashbacks of MP shows.

I KNEW there was some logical explaination!

Thanks!

Cheers!

Re: Updating Smoothwall yourself?

[GSloop]

Intelligent people usually learn what they do well, and what they don't.

Dick seems to not realize the fact that abusing people isn't correct - EVER!

If he can't handle support, please do something else. If Dick is a "friend" to OSS, we don't need enemies.

Just in case yo wondered, I do have to work with clueless users. I usually bite my tongue, grind my teeth, and then SMILE and try to be helpful. Anything else really doesn't help.

Cheers!

Re:This article is a perfect example...

[RickHunter]

You do have a point there, and I wish Slashdot would do that a little more often.

Then again, it'd probably require some hefty modifications to Slashcode, and from what I've heard, its a miracle that Slashcode works at all. ;)

Re:Smoothwall -- yes.. it is worth a try.

[whoppo]

I'd have to agree.. I downloaded smoothwall 0.9.9SE a few months ago while searching for a low/no cost site-to-site VPN solution. The install was quick and easy, and although I needed to modify some of the scripts to make the Free-S/WAN VPN components interoperate with my Checkpoint FireWall-1/VPN-1 gateway at work, the end result is a secure and stable firewall with the desired full-time encrypted connection to the office. Now I've seen Mr. Morrell's postings to the "gpl" mailing list, and I don't think he's going to win any awards for open-source customer service, but his product delivers as advertised and then some. It's certainly worth the download to try it out, and most likely will be worth a nominal donation to most users. Features include statically or DHCP assigned external address, modem support with dial-on-demand, Intrusion detection (snort), web and DNS proxies, DMZ interface support, IPSec comliant VPN, traffic logging with nifty graphs, an easy-to-use SSL web interface and a few other little goodies.

50ms - 100ms latency?

[rocca]

Seems a little high - anyone have some stats on latency for the different packages available?

oh, 'boxes'...

[dbpubs]

...I thought you said 'Boxers' - combined with the wolf whistle, i thought we were gettin pr0n.

floppy OS

[castlan]

I don't speak for the pro-floppy legions, but while your previous post was insightful, it did not deserve a score of 5. I don't use a floppy based distro, but this debate has acutally pushed me towards the benefits of such a solution. In any event, the issue is not as cut-and-dry as you or Theo seem to think, and your being overmoderated encourages me to play the devil's advocate.

Unless you are a long time computer hobbyist with generations of surplus hardware laying around, a hard drive is not trivial to acquire. On the otherhand, anyone who gets junkmail more than likely has thrown away many floppies. A harddrive is only cheap compared to what harddrives used to cost. For the price of one inexpensive hard drive, you can get hundreds of floppy disks. Hard drives are not impervious to failure, and for the cost, redundant copies of your packet filter conf. file have a better chance of survival on $50 worth of floppys than one $50 hard drive.

If top security is your concern, then you don't keep log files on a rewriteable medium like a hard drive. A better answer is a read-only boot device, with logs sent to a printer. You can reboot if anything goes wrong, and still have access to the logs while offline. You can stay online while making and testing updates on another floppy, and even keep multiple floppies with multiple configs.

For a single function device, it is tough to argue that a harddrive makes a RAID (Redundant Assortment of Inexpensive Diskettes ;) passe. Performance is not an issue because single function devices should run from RAM - running from a harddrive would be undesireable. It is even argueable that read-only floppies can be better than CD-ROMs because they are easier to update. CD-R defeats the whole inexpensive aspect, unless you already have the hardware and buy blank media in bulk. Even then, floppies are still cheaper. While you may now get AOL CDs in the mail, these aren't as useful as AOL floppies! If AOL ever starts mailing preformatted harddrives, then I will gleefully retract my arguments.

-castlan

Re:news for nerds

[quinto2000]

i like :)