28 Dec
2000
28 Dec
'00
7:51 a.m.
I became very curious after I read a couple of posts assuming
OpenBSD as the best OS for a firewall box. Could anyone explain (or at
least point out links) why OpenBSD would be more appropriate for a
firewall?
I am planning the instalation of a firewall, and I was
thinking about a linux box, possibly running the LRP package.
I do not intend to raise any OS-war, but rather to understand
the arguments for each side.
Cheers,
--
*** Rodrigo Martins de Matos Ventura <yoda(a)isr.ist.utl.pt>
*** Web page: http://www.isr.ist.utl.pt/~yoda
*** Teaching Assistant and PhD Student at ISR:
*** Instituto de Sistemas e Robotica, Polo de Lisboa
*** Instituto Superior Tecnico, Lisboa, PORTUGAL
*** PGP fingerprint = 0119 AD13 9EEE 264A 3F10 31D3 89B3 C6C4 60C6 4585
28 Dec
28 Dec
10:50 a.m.
I became very curious after I read a couple of
posts assuming
OpenBSD as the best OS for a firewall box. Could anyone explain (or at
least point out links) why OpenBSD would be more appropriate for a
firewall?
I am planning the instalation of a firewall, and I was
thinking about a linux box, possibly running the LRP package.
I do not intend to raise any OS-war, but rather to understand
the arguments for each side.
Let me address the last paragraph first by stating I've been running Linux
for 9 years now. I prefer Linux over the BSD varients hands down.
HOWEVER, there is no way I'm going to use Linux for a Firewall, and I'd even
think twice before using it as a server. OpenBSD has now gone over three
years without a remotely exploitable hole, when using the default install.
The entire reason for OpenBSD's existance is security. My OS of choice for
running a firewall would be OpenVMS, however, since the software to do
firewall and NAT doesn't really exist for OpenVMS, I run OpenBSD.
For info on OpenBSD try the following:
http://www.openbsd.org
http://www.deadly.org/
If you have enough machines around do a default install of what ever Linux
distro you were thinking of on one, and OpenBSD on another. Then run some
tools for checking for vulnerabilies against the two. You just might find
the results disturbing.
Zane
11:04 a.m.
Let me address the last paragraph first by stating
I've been running Linux
for 9 years now. I prefer Linux over the BSD varients hands down.
HOWEVER, there is no way I'm going to use Linux for a Firewall, and I'd even
think twice before using it as a server. OpenBSD has now gone over three
years without a remotely exploitable hole, when using the default install.
The entire reason for OpenBSD's existance is security. My OS of choice for
running a firewall would be OpenVMS, however, since the software to do
firewall and NAT doesn't really exist for OpenVMS, I run OpenBSD.
If you have enough machines around do a default install of what ever Linux
distro you were thinking of on one, and OpenBSD on another. Then run some
tools for checking for vulnerabilies against the two. You just might find
the results disturbing.
Zane
Agreed...
I'd actually consider FreeBSD or NetBSD for firewall duty.
The only Linux I'd consider for a firewall is a distribution I'd
roll myself. (Building every utility and control file manually)...
I'm considering building a Linux varient that has a BSD style build
environment and less of the lovely autoconf built gnu stuff.
...and no RPM's.
--Bill
Bill
--
bpechter(a)monmouth.com | FreeBSD since 1.0.2, Linux since 0.99.10
| Unix Sys Admin since Sys V/BSD 4.2
| Windows System Administration: "Magical Misery Tour"
12:06 p.m.
I'm considering building a Linux varient that has
a BSD style build
environment and less of the lovely autoconf built gnu stuff.
...and no RPM's.
--Bill
I'd *really* like to see a GNU free Linux! I know that at one point there
was some discussion of doing this. Why you ask? Because some of us just
can not stomach Stallman!
As for no RPM's, something like the OpenBSD Ports tree would be nice (not
sure if this is in other BSD's).
Zane
8712
days inactive
8712
days old
3 comments
3 participants
participants (3)
-
healyzh＠aracnet.com -
pechter＠pechter.dyndns.org -
yoda＠isr.ist.utl.pt