Shorewall users - Feb 2002 - Re: speaking of security

> I''d like to be able to email all the root mail to a central mail
server
> within the LOC portion of my network. The reason is I''m lazy, and
would
> like to collect all my system status emails from all the local *nix boxes
> into one email box rather than monitor different login accounts on 7-10
> separate machines.
Well, I thing, that''s not unusual. There are people who even collect
*all*
logfiles on one server ;)
> In going over the /etc/params file, there isn''t a
"DMZ_LOC_TCP=" line, or a
> "DMZ_LOC_PORTS1=".
>
> So, since the easy and obvious way doesn''t seem to be there, what
are some
> of the more esoteric methods to open up a small hole between my DMZ and my
> LOC segments?
If your "collecting-*nix-box" is also a world accessable mail server,
then
why not opening it for the box in the DMZ via the rules file. In fact, our 
webserver is only allowed to initiate one connection to the outside world, 
and that''s smtp, and this only to our world accessable mail server.
> Gar
Alex.
--
* Alexander Müller *
department of ferrous metallurgy
Aachen  university of technology
mailto:alex_m@iehk.rwth-aachen.de

Alexander Müller wrote:
> ...
> > So, since the easy and obvious way doesn''t seem to be there,
what are some
> > of the more esoteric methods to open up a small hole between my DMZ
and my
> > LOC segments?
>
> If your "collecting-*nix-box" is also a world accessable mail
server, then
> why not opening it for the box in the DMZ via the rules file. In fact, our
> webserver is only allowed to initiate one connection to the outside world,
> and that''s smtp, and this only to our world accessable mail
server.
What happens to internal mail that is sent to your mail server?  Is it SMTP
forwarded on to an internal mail server, or do you collect via POP3/IMAP?  I can
see the advantage in this setup (it''s nice and simple and intuitive),
but i
could also see a disadvantage in that it may expose mail from the web server to
external access.

Paul
http://paulgear.webhop.net