(Questions during presentation, but preferable if left to Q&A session)
Welcome
Printing Mishap
About Me
IT History
Main intro was Mac
Managed to copy Claris Works Office 1.0 to floppy disk
Student & SNAP at Dickson College
Brief history of my work at Dickson
Intro
Network Security
Businesses often see security as expensive and difficult requiring a mysterious black box in the corner that only the costly expert understands. This is a bizzare myth and is almost always incorrect.
SmoothWall
What is SmoothWall?
Some people from early days no longer there (if people have previously heard of it)
SmoothWall is a Linux based network firewall distro aimed at the SOHO market that converts an old (or new) computer into a fully functional network firewall featuring:
Simple and powerful web interface
DHCP Server
Web Proxy
DNS proxy
Intrusion Detection System
VPN termination & passthrough
Excellent logs and viewers
Virtually no Linux knowledge required
and more... (extendible)
SmoothWall Express is open source and is supported and funded by SmoothWall Ltd who make SmoothWall Corporate Server which is aimed at medium to large businesses. Express and Ltd are similar in arrangement to Red Hat (Fedora/RHEL)
Typical Network
Layout (Green/Orange/Red) <AwPhuch network diagram
GOR>
<AwPhuch network diagram GR>
Support
Support isn't guaranteed, but between the forums, mailing lists and IRC it is arguably one of the best support communities on the web.
Small business use of SmoothWall to secure their network.
Small Business network used in this seminar
One ADSL connection
6 PCs running Windows (OS typical in SOHO environment)
One printer (Shared from a PC)
Some file sharing
One Switch
Not enough funding for IT specialist
Network should “Just Work”
Why they would choose SmoothWall
Price (free + minor cost for PC)
Functionality
Ability to grow with network
Central network management
No need for Intricate knowledge of Linux, Networking or Computers
Other possibilities
Option One
Windows ICS
ADSL Modem
Firewall (None/ICS/Zone Alarm)
Dreadfully Insecure, these firewalls are not designed with networks in mind, constantly bugging the user of the host computer for permission to allow/disallow traffic
Not ideal, and not particularly clever
Option Two
SOHO Router
Potentially replace switch
Some newer ones do run Linux and are extendable, but they just don't have the power of a PC,
Often have a quirky web interface which tends to be either overly simplistic or overly complex.
Super cheap ones usually have a TCP/IP stack which has to fit in a tiny amount of space, insiders have said just how badly designed they are.
Option Three
Cisco Router
Too complex for small business
Secure when configured properly
Requires an intimate knowledge of the IOS
Good products, but extremely confusing to the untrained, requires a professional to install.
Option Four
Proprietary Gateway Security Device (Symantec etc)
Generally a high cost compared to other options in a SOHO environment
Some have whacky licensing rules (pay per firewall rule, pay per client computer etc)
Of these options, SmoothWall is probably the best in this situation.
Installing SmoothWall (Small Business in question)
Diagram (IP address, network segments) (Word :-()
ADSL Modem (Screenshot of DSL-300G configuration)
Half bridge, login handled by modem
Installing SmoothWall (Screenshots of relevant sections)
Installation Boot Screen
Installation Media
HDD Wipe Warning (Smoothie then formats the HDD)
Green NIC Selection
Choose Green NIC
Green IP
Installation (smoothie then runs the setup program)
Restore Configuration
Keyboard Layout
SmoothWall Hostname
Upstream Proxy
ISDN
USB ADSL
Network Configuration
Red/Orange/Green Selection
NIC Setup
Confirm Card
IP Info Of Card
Red DNS Info (only required when not using DHCP for red)
DHCP Server
Admin Password
Root Password
Setup Password
Setup Complete (smoothie then restarts the computer and boots for the first time)
Boot Screen (SmoothWall & Old)
Login Prompt
Configuring SmoothWall
Web Interface (My SmoothWall) (Screenshots)
URL
Homepage
Status
Advanced
Traffic Graphs
Web Proxy
DHCP Server
Dynamic DNS
IDS
Remote Access
Time
Port Forwarding
Keep publicly accessible servers up-to-date as once you have opened up to the web, it will be vulnerable to web attack. You can partially protect a service with intrusion prevention software, but they often make mistakes and block users for incorrect reasons.
External Services Access
DMZ Pinholes
PPP Settings
IP Block
Advanced Networking
VPN
Logs (General)
Firewall Log
Firewall Log Export (All Logs) (PyFlag analysis)
Whois
Ping Traceroute
SSH Shell
Updates
Modem Configuration
Passwords
Backup
Shutdown
Help
Adding extra features to SmoothWall
Community mods, written and tested by community members.
Not guaranteed to work, but they almost always do, the community is very good.
Homebrew mods
Ones that are probably of most use to SOHO
Heaps of mods for monitoring traffic levels
Traffic per IP Address
Graphs of firewall logs
Traffic Shaping
Comes in a few varieties
Allows you to control which user and data type gets prority
Intrusion prevention
Automatically blocks things detected by snort, useful, but sometimes a bit over zealous.
Partial web vulnerabilities protection
Dshield Blocklist
DansGuardian (And other web proxy solutions)
DansGuardian Author Daniel Barron works for SmoothWall Ltd!
From Squid ACLs to DansGuardian, power at your fingertips
Automatic SmoothWall Updates
Simplify the update procedure
Possibly included in an upcoming SmoothWall release
My Visual Basic app that checks the internet connection
People wanted something that told them if they are connected or not
Basic ping test
Martin Pot cleaned it up a bit
Nice way to have a taskbar icon (windows users like that)
Martybugs.net/SmoothWall/
Fantastic reference site for SmoothWall info
Includes information about IP Accounting, Proxy log analysis, Memory graphs and much more
Run by Martin Pot
Quite a few of the mods (or at least the concept of the mods) are available as add on modules for SmoothWall Corporate Server (Including an advanced version of DG)
The firewall is just one (main) part of the jigsaw
Tips for security
Don’t run as administrator when not necessary
Run decent anti-virus software and KEEP IT UP TO DATE (Background & Weekly scanning)
Spyware/Adware scans (Spybot & AdAware)
Securing Windows
Regularly run Windows Update
Updates are often annoyingly outdated and buggy, but they tend to do their job most of the time.
Unfortunately Microsoft seem to enjoy Monthly patches, and take forever to create them. Open source software seem to be updated quickly, and when required.
Turn off useless services.
Do you really need your staff to be able to “net send” each other?
Thankfully, Windows is much less dangerous when not directly exposed to the internet, so you can keep some of the useless services on if you find a use for them.
Where possible, use Firefox
IE should only be used for IE specific sites, as such, small business probably will never need to use it)
Where possible, use Thunderbird or other email client
Small business should be trained not to use Outlook, it uses the IE engine and is commonly exploited
Don’t use file sharing software
Not suitable for business, not necessary, more risk than benefit)
If necessary, have one specific computer do that task and monitor it carefully
Discourage floppy disk usage
Not a security tip, more a data integrity tip.
Encourage flash drives and CD/DVD
NEVER open a file from an unknown or suspicious source
Common sense, but needs to be reinforced.
Move to Linux
This would solve a lot of security problems, but isn’t ideal for a lot of small businesses.
Linux is getting there, soon enough it will be the dominant desktop OS
Small business likes guaranteed support (Brief)
SmoothWall Corporate Server
More powerful out-of-the-box
Only pay for what you need
Not expensive (Compared to other solutions)
Don’t pay for functions that you don’t have a need for
Many of the mods for SWE are part of Corp Server and many of the Corp Server fucntions find their way into SWE
Funds SW Express
Corporate support
Ease of use through web interface
Funds Open Source Project
Summary
Internet Security doesn't have to be expensive
SmoothWall provides easy internet security for the home and office
A firewall is only part of the story, it is important to keep other software up-to-date as well, especially publicly accessible servers.
Q&A session