I was thinking today (so for anyone in the DC corridor that’s what you were smelling today) about... many things. But one thing that struck me is the sheer number of services that Astaro offers.
While this is a Good Thing, to have so many different features rolled into one, it can also, I think, be a bad thing. I know all these services are disabled by default but they are very useful and a lot of people probably turn them on.
The less you have running on your firewall the better. This is the philosophy behind embedded firewall products and single disk distros of Linux/Unix like closedBSD. Products like Astaro seem to roll a lot of features into one.
This first struck me when I was outlining the system to my boss and his response to the various proxies was, "that sounds like a lot of overhead". While he was correct, it can also be a security vulnerability and general pain in the ass.
Having it all rolled into one is probably fine for home users and small businesses, however something I would be interested in hearing about the feasibility of is this -
With the hot failover stuff I know that the Astaro guys have been able to get their products to talk to each other. What I was thinking of is a way of removing potentially exploitable services like the proxies, dhcp server, and so on even further from the firewall - instead of attempting to jail them in chroot environments on the machine running the filters, you put them on a separate machine behind the filter but linked together.
This is probably just me talking out of my ass again, but I think that would be an interesting option for larger companies whose interest in security prompts large, bearded men to wander around at three in the morning rumbling about security issues to develop something like this.
Or I could just be stupid and very paranoid. But, if I was ever setting up something like this on my own for a high security network, I probably would put any proxies of mine behind the firewall instead of on it. It would just be nice to have the unified Astaro webadmin interface in front of that than having to go to either two different webadmin interfaces or webadmin one and ssh the other.
This thread was automatically locked due to age.
