Linux Server Outside of Firewall

[pcthuglife]

I've always kept my servers behind my lan's firewall and just enabled port forwarding for whatever services I wanted to make public (ie: 80, 443, 25, 110, etc).

My new employer keeps all of their servers outside of the firewall, which makes me a little nervous but maybe I'm just being too paranoid.

So i setup a CentOS 4.3 server to run apache, dns, and postfix. In CentOS' firewall settings I checked the box to allow HTTP access (port 80 and 443), then I manually specified tcp port 53 for DNS.

Postfix is running, but it's only configured for localhost sending, so in the security window I unchecked the SMTP mail server option.

The problem is when I run a port scan on the server the port scan shows 6 open ports. 21, 25, 53 80, 110, and 443 are all "open" according to the port scanner. Is this a security threat or should I be ok? I don't have an FTP service running, so I have no idea why 21 is open. Postfix is enabled but the firewall isn't configured to allow mail connections, so I can't explain 25 and 110 (Dovecot is also disabled). 53, 80, and 443 all make sense because they are for the services I want to make public.

I guess my real question is should I try to manually configure the iptables rules or just use the default CentOS security options? I mean it is an "Enterprise" linux distro so I figured they should do things with stability and security in mind. I'd rather not go modifying things by hand.

Please let me know what you all think about my situation. Thanks!

 

[n0cmonkey]

What's running on the ports other than 80, 443, and 53? lsof or may be fstat should be able to tell you.

Is postfix configured to listen on the external interface? If so, change it so it's only listening on loopback.

 

[pcthuglife]

I have inet_interfaces = localhost in my main.cf file. When I run netstat and grep 21 and 110 I don't get any listen results. It's not that the server has running services listening on those ports, it's that the firewall doesn't have those ports closed by default. Even though in the CentOS security level settings the only ports I have allowed are 80, 443, and 53. So should I be concerned or will the server just ignore requests on those other ports since there aren't any listening services? Also should I push to get the server behind a firewall or should it be fine on its own?

 

[n0cmonkey]

The firewall should block everything that isn't specifically opened. So if a scanner is reporting something as open then something is listening.

Servers should be behind firewalls too.

 

[InlineFive]

Servers should always be behind a firewall, I don't know what your employer is thinking.

 

[Cloud Strife]

Perhaps your employer was talking about a DMZ?

 

[pcthuglife]

nope, no dmz, just straight link to the web. this is going to be a big adjustment for me because I was the network admin of the last company I worked for, now I have to follow someone else's decisions. I expressed my concern and said that there should be some kind of hardware firewall in place to protect the server. They didn't seem to understand the concept of port forwarding to open the firewall up for the specific services that we want to run. Right now it goes T1 -> Switch -> Server

 

[Nothinman]

Perhaps your employer was talking about a DMZ?

Even servers in a DMZ are behind firewalls, unless you're talking about a crap SOHO "port forward everything" DMZ.

They didn't seem to understand the concept of port forwarding to open the firewall up for the specific services that we want to run.

If there's anything important on those servers I would make sure my resume was up to date.

 

[pcthuglife]

If something happens to the linux servers outside of the firewall they're not going to be able to point the finger at me. I've already gone ahead and covered my butt by expressing my concerns to other people around the office. In a diplomatic way of course

The servers aren't holding any real valuable information anyway. They're going to act as the company's primary DNS server and bugzilla database server. Of course then the new question comes up, why do you need two HP 2U blade servers with dual Xeon processors to run DNS and apache? The decision and purchase had been made before I started...

 

[Nothinman]

If something happens to the linux servers outside of the firewall they're not going to be able to point the finger at me. I've already gone ahead and covered my butt by expressing my concerns to other people around the office. In a diplomatic way of course

I wasn't even thinking that, I just figured if something like that happened you'd want to find another job either way. =)

 

[Cloud Strife]

Originally posted by: Nothinman

Perhaps your employer was talking about a DMZ?

Even servers in a DMZ are behind firewalls, unless you're talking about a crap SOHO "port forward everything" DMZ.

Of course actual DMZ network segments.

 

[n0cmonkey]

Originally posted by: pcthuglife
If something happens to the linux servers outside of the firewall they're not going to be able to point the finger at me. I've already gone ahead and covered my butt by expressing my concerns to other people around the office. In a diplomatic way of course

http://blogs.ittoolbox.com/security/inv...ity-geek-fired-for-doing-his-job-10637

 

[Dravic]

Originally posted by: pcthuglife
If something happens to the linux servers outside of the firewall they're not going to be able to point the finger at me. I've already gone ahead and covered my butt by expressing my concerns to other people around the office. In a diplomatic way of course

The servers aren't holding any real valuable information anyway. They're going to act as the company's primary DNS server and bugzilla database server. Of course then the new question comes up, why do you need two HP 2U blade servers with dual Xeon processors to run DNS and apache? The decision and purchase had been made before I started...

wow.. PRIMARY DNS outside your firewall, and not the ISP's...

dns poisoning in one of the best way to hack into a network, the fact that your servers are outside of you firewall give a hacker really easy ways to spoof and poison DNS traffic. I wouldnt trust any dns querey that thing returned to me. raise you concerns AGAIN. send an email to someone at the internet storm center and see if they can provide your some data on the matter.. if not they may be call you soon enough about the havok your mail and dns servers are causing....