Re: laptop protection in an office network

From	Reco <recoverym4n@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: laptop protection in an office network
Date	2015-08-30 00:30 +0200
Message-ID	<q2WNj-6U1-5@gated-at.bofh.it> (permalink)
References	(6 earlier) <q2TFM-2lh-7@gated-at.bofh.it> <q2TPr-2wt-9@gated-at.bofh.it> <q2Uiu-38a-15@gated-at.bofh.it> <q2Usa-3kb-5@gated-at.bofh.it> <q2WtX-6xG-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

 Hi.

On Sat, 29 Aug 2015 23:00:51 +0100
Brian <ad44@cityscape.co.uk> wrote:

> On Sat 29 Aug 2015 at 22:58:57 +0300, Reco wrote:
> 
> >  Hi.
> > 
> > On Sat, 29 Aug 2015 20:40:47 +0100
> > Brian <ad44@cityscape.co.uk> wrote:
> > 
> > > On Sat 29 Aug 2015 at 22:18:00 +0300, Reco wrote:
> > > 
> > > >  Hi.
> > > > 
> > > > On Sat, 29 Aug 2015 20:01:40 +0100
> > > > Brian <ad44@cityscape.co.uk> wrote:
> > > > 
> > > > > On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote:
> > > > > 
> > > > > >  Hi.
> > > > > > 
> > > > > > On Sat, 29 Aug 2015 13:25:28 -0500
> > > > > > rlharris@oplink.net wrote:
> > > > > > 
> > > > > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote:
> > > > > > > > Also netstat (issued from your laptop) gives insight. For example
> > > > > > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are
> > > > > > > > root (or sudo, of course), the extra option -p tells you which process is
> > > > > > > > "at the other side" listening.
> > > > > > > >
> > > > > > > > Note that the dhcp client itself (which you need to get an IP address to
> > > > > > > > take part in your customer's network) puts you already at some risk,
> > > > > > > > depending on how it's configured.
> > > > > > > 
> > > > > > > Here is the output from the laptop:
> > > > > > > 
> > > > > > > # netstat -lntup
> > > > > > > Active Internet connections (only servers)
> > > > > > > Prot Rec Snd Local Address            Foreign   State PID/Program name
> > > > <skip>
> > > > > > > #
> > > > > > > 
> > > > > > > Regrettably, the formatting of the output does not consider the need to
> > > > > > > include the output in the body of an e-mail, so editing was required to
> > > > > > > remove excess spaces so as to prevent every line from being wrapped.
> > > > > > 
> > > > > > 
> > > > > > Something like this should save you from the most troubles provided
> > > > > > that you don't plan to use your laptop as a print server or NFS:
> > > > > > 
> > > > <skip>
> > > > > > 
> > > > > > 
> > > > > > Of course, it's *very* simplistic set of rules (for example, someone
> > > > > > may consider accepting ssh connections from arbitrary hosts a bad idea),
> > > > > > but it should work.
> > > > > 
> > > > > Why does he need any iptables rules? I see nothing at risk there. It
> > > > > seems to me he can be confident his computer is safe.
> > > > 
> > > > You need to look better. As of now, this laptop:
> > > > 
> > > > 1) Has NFS portmapper open for no good reason.
> > > > 
> > > > 2) Has some (possibly badly configured) tcp service port 9999.
> > > > 
> > > > 3) Has possibly misconfigured SSH (i.e. PasswordAuthentication yes - a
> > > > bad idea for untrusted network).
> > > 
> > > Covering up such problems with iptables doesn't tackle such problems. 
> > 
> > On the contrary, it does. Since nobody can connect to the problem
> > service from the outside - it's irrelevant whenever the service is
> > secure or not.
> > 
> > 
> > > Why not fix them at source?
> > 
> > I dunno. Some people are reluctant to remove stuff. Especially if the
> > "stuff" in question is installed by "Standard" task of d-i.
> > Adding stuff on top of "standard" installation is easier to grasp.
> 
> I hadn't appreciated that iptables main function is papering over the cracks.

It's the most common usage of iptables IMO, and, to some extent it's
Unix-style. I.e. you don't touch so called "base system", you merely
write your own kludges around it.


> > > > > > Two things I'm unsure of are:
> > > > > > 
> > > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office
> > > > > > network), but YMMV.
> > > > > 
> > > > > There is much value in mDNS in an office network with CUPS nowadays.
> > > > 
> > > > Provided that an office network allows multicasts *and* it's not a
> > > > all-Windows shop *and* they did not forget to allow dnssd server-side -
> > > > it's a possibility. Chances for all this are slim IMO.
> > > 
> > > No mDNS then. No printing.
> > 
> > Clarification needed.
> > 
> > Are you suggesting that disabling Avahi also disables CUPS? It's not
> > true.
> > Are you suggesting that with disabling Avahi CUPS looses ability to
> > print? It's not true too.
> > Or are you suggesting that with Avahi disabled a client is unable to
> > print using *known* CUPS over the network? It's also a false statement.
> 
> None of these. Bonjour plays a central role in printing over a network.
> Discarding it as a very useful tool isn't very helpful.

So it must be "printing over the network using *unknown* CUPS". While I
can grant that such usecase is valid, it has way too many restrictions
and prerequisites for my taste. Let's leave it at this.

Reco

Thread

laptop protection in an office network rlharris@oplink.net - 2015-08-29 07:00 +0200
  Re: laptop protection in an office network Riley Baird <BM-2cVqnDuYbAU5do2DfJTrN7ZbAJ246S4XiX@bitmessage.ch> - 2015-08-29 08:00 +0200
    Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 08:20 +0200
      Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 09:20 +0200
        Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 10:20 +0200
          Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 14:00 +0200
            Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 18:20 +0200
              Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 18:30 +0200
            Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 20:30 +0200
              Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 20:40 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:10 +0200
                Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:30 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:50 +0200
                Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 02:40 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 03:30 +0200
                Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 03:40 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 04:30 +0200
                Re: laptop protection in an office network Doug <dmcgarrett@optonline.net> - 2015-08-30 04:50 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 05:00 +0200
                Re: laptop protection in an office network Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 00:20 +0200
                Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 05:10 +0200
                Re: laptop protection in an office network David Wright <deblis@lionunicorn.co.uk> - 2015-08-30 06:40 +0200
                Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 07:30 +0200
                Re: laptop protection in an office network Martin Read <zen75502@zen.co.uk> - 2015-08-31 03:50 +0200
                quality keyboards rlharris@oplink.net - 2015-08-31 09:10 +0200
                Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 09:40 +0200
                Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it>  - 2015-08-31 09:50 +0200
                Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 12:00 +0200
                Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:20 +0200
                Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 14:30 +0200
                Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it>  - 2015-08-31 14:40 +0200
                Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 15:50 +0200
                Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 16:40 +0200
                Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it>  - 2015-08-31 17:00 +0200
                Re: quality keyboards Anthony Maples <anthonym7009@gmail.com> - 2015-09-01 00:10 +0200
                Re: quality keyboards "Thomas Schmitt" <scdbackup@gmx.net> - 2015-08-31 16:10 +0200
                Re: quality keyboards Haines Brown <haines@histomat.net> - 2015-08-31 13:00 +0200
                Re: quality keyboards Curt <curty@free.fr> - 2015-08-31 14:20 +0200
                Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:10 +0200
                Re: quality keyboards Gene Heskett <gheskett@wdtv.com> - 2015-08-31 14:30 +0200
                Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 15:00 +0200
                Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it>  - 2015-08-31 15:10 +0200
                Re: quality keyboards Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 15:10 +0200
                Re: quality keyboards Martin Read <zen75502@zen.co.uk> - 2015-08-31 13:20 +0200
                Re: quality keyboards David Wright <deblis@lionunicorn.co.uk> - 2015-08-31 17:40 +0200
                Re: quality keyboards Glenn English <ghe@slsware.net> - 2015-08-31 18:30 +0200
                Re: quality keyboards Don Armstrong <don@debian.org> - 2015-08-31 21:50 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:10 +0200
                Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:20 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:50 +0200
                Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 22:00 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:10 +0200
                Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-30 00:30 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:50 +0200
                Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:40 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 16:10 +0200
                Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 18:30 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 20:50 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:30 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 22:00 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:30 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:50 +0200
                Re: laptop protection in an office network Renaud (Ron) OLGIATI <renaud@olgiati-in-paraguay.org> - 2015-08-29 23:40 +0200
              Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 23:00 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:30 +0200
                Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:50 +0200
                Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-30 10:30 +0200
                Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:40 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 01:50 +0200
                Re: laptop protection in an office network Chris Bannister <cbannister@slingshot.co.nz> - 2015-08-30 09:30 +0200
                Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:30 +0200
                Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 11:10 +0200
                Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 21:10 +0200

csiph-web