2

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers.
In order to allow the packets to go through I must allow port 80 (OcsInventory) and port 514 udp from this DMZ server to the machine on the vlan.
If the machine on the DMZ were ever compromised an attacker would have full access to port 80 and 514 UDP.
Is there any way to only allow these connections when Syslog/OcsInventory need to send a message?
Port knocking maybe?
Better yet, is there a way to only allow certain processes on my DMZ server to access the remote ports?

Any suggestions are very much appreciated.

|improve this question
1

Q:Is there a way to only allow certain processes on my DMZ server to access the remote ports?

A: You need a UTM box or Next Generation Firewall to do that. These boxes can work with application layer of each connection and distinguish between different applications so you can allow only certain applications traffic to pass. A good example of a free box is SOPHOS UTM that you can test.

|improve this answer
-2

is there a way to only allow certain processes on my DMZ server to access the remote ports?

Yes, SELinux. Any sysadmin serious about IT security will have to, sooner or later, learn how to SELinux and create policies for applications and your problem is perfect for SELinux to solve. Once you are competent with SELinux and secure your servers, you will feel much more confident about your server security and turning SELinux off will make you feel naked, in a blizzard.

The only books that I can recommend are "SELinux by Example: Using Security Enhanced Linux" and "SELinux System Administration". The latter should be released next month.

Some links that will help you get started:

http://selinuxproject.org/page/Main_Page

http://www.crypt.gen.nz/selinux/faq.html

There is also an excellent community on #selinux @ Freenode IRC

|improve this answer
  • This doesn't actually answer the question. You'd be better off explaining how to do this with SELinux or variants. – Steve Sep 26 '13 at 17:52
  • @SteveS Indeed, my "answer" simply points him in the right direction because using SELinux is much too complex to explain it on a QA site and there are resources online that explain it better than I ever can. Also, SELinux is one of those things that you have to learn, copy/pasting is a bad idea. – Matrix Sep 26 '13 at 18:06
  • Well yes, but that wasn't my point. You're advocating using a special Linux variant and that doesn't actually solve the problem. You'd still have to learn how to do it in SELinux, whatever that 'it' is. I think the answer should focus on the 'it'. – Steve Sep 26 '13 at 22:47
  • -1, for the reasons @SteveS stated. – Ayrx Sep 27 '13 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.