2

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers.
In order to allow the packets to go through I must allow port 80 (OcsInventory) and port 514 udp from this DMZ server to the machine on the vlan.
If the machine on the DMZ were ever compromised an attacker would have full access to port 80 and 514 UDP.
Is there any way to only allow these connections when Syslog/OcsInventory need to send a message?
Port knocking maybe?
Better yet, is there a way to only allow certain processes on my DMZ server to access the remote ports?

Any suggestions are very much appreciated.

2 Answers 2

1

Q:Is there a way to only allow certain processes on my DMZ server to access the remote ports?

A: You need a UTM box or Next Generation Firewall to do that. These boxes can work with application layer of each connection and distinguish between different applications so you can allow only certain applications traffic to pass. A good example of a free box is SOPHOS UTM that you can test.

-2

is there a way to only allow certain processes on my DMZ server to access the remote ports?

Yes, SELinux. Any sysadmin serious about IT security will have to, sooner or later, learn how to SELinux and create policies for applications and your problem is perfect for SELinux to solve. Once you are competent with SELinux and secure your servers, you will feel much more confident about your server security and turning SELinux off will make you feel naked, in a blizzard.

The only books that I can recommend are "SELinux by Example: Using Security Enhanced Linux" and "SELinux System Administration". The latter should be released next month.

Some links that will help you get started:

http://selinuxproject.org/page/Main_Page

http://www.crypt.gen.nz/selinux/faq.html

There is also an excellent community on #selinux @ Freenode IRC

4
  • This doesn't actually answer the question. You'd be better off explaining how to do this with SELinux or variants.
    – Steve
    Sep 26, 2013 at 17:52
  • @SteveS Indeed, my "answer" simply points him in the right direction because using SELinux is much too complex to explain it on a QA site and there are resources online that explain it better than I ever can. Also, SELinux is one of those things that you have to learn, copy/pasting is a bad idea.
    – Matrix
    Sep 26, 2013 at 18:06
  • Well yes, but that wasn't my point. You're advocating using a special Linux variant and that doesn't actually solve the problem. You'd still have to learn how to do it in SELinux, whatever that 'it' is. I think the answer should focus on the 'it'.
    – Steve
    Sep 26, 2013 at 22:47
  • -1, for the reasons @SteveS stated.
    – user10211
    Sep 27, 2013 at 1:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .