Re: How Do You Build Firewall Rules to Restrict RPC Traffic?
- From: "Will" <westes-usc@xxxxxxxxxxxxxx>
- Date: Tue, 18 Oct 2005 15:55:17 -0700
"Phillip Windell" <@.> wrote in message
news:eXLQrCB1FHA.1264@xxxxxxxxxxxxxxxxxxxxxxx
> But back on the original design issue,...If you have two internal
interfaces
> as I described then there is nothing to protect RPC from to begin with and
> this is kind of pointless. Internal Networks (no matter how many you
have)
> are not exposed to the Internet, so RPC is never exposed to the Internet.
> The Access Rule between two external segments should allow everything in
> most cases unless there is a specific reason to restrict specific things
for
> specific purposes. In other words it is no different than if you had a
> reguler LAN Router between the two private segments and never even had a
> connection to the Internet at all.
The worst security risks on most networks are not from the outside coming
in. They are from the inside looking out. You hire a contractor and he
tries to install his software on a a domain controller and change security
there outside of group policy. You go to a web site and unintentionally
download an Active X control that installs a virus that starts to look
around your network and attacks anything it can find, including your domain
controllers.
You can certainly harden machines, and to some degree you should, but that's
not a cost effective thing to do in most cases. There are endless security
holes and security risks and who can keep up with them all. What I have
found does work however is to isolate machines that perform certain
functions behind their own segments on a firewall and configure the firewall
to restrict access to those machines in a way that suits their use. For
our network, the domain controller will be used to authenticate, perform DNS
lookups, and do group policies and all things associated with SYSVOL.
That's it. I'm not letting anyone inside or out talk to those domain
controllers on any ports other than the ones required for mandatory domain
controller functions.
I'll post the solution to the problem of how to restrict RPC access when/if
I find one.
--
Will
.
- References:
- Prev by Date: Re: ISA2K4 SP1 Broke VPN
- Next by Date: Re: internet access
- Previous by thread: Re: How Do You Build Firewall Rules to Restrict RPC Traffic?
- Next by thread: Re: error 502 for https sites with non standard port
- Index(es):
Relevant Pages
|
