Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

22

|

Chapter 2: Designing Perimeter Networks

The Internet is only one example of an external network to which you might be con-

nected. If your organization has a dedicated Wide Area Network (WAN) circuit or a

Virtual Private Network (VPN) connection to a vendor or partner, the part of your

network on which that connection terminates is also part of your perimeter.

*

Most of what follows in this chapter is applicable to any part of your perimeter net-

work, not just the part that’s connected to the Internet.

Some Terminology

Let’s get some definitions cleared up before we proceed. These may not be the same

definitions you’re used to or prefer, but they’re the ones I use in this chapter:

Application gateway (or application-layer gateway)

A firewall or other proxy server possessing application-layer intelligence, e.g.,

able to distinguish legitimate application behavior from disallowed behavior,

rather than dumbly reproducing client data verbatim to servers and vice versa.

Each service that is to be proxied with this level of intelligence must, however,

be explicitly supported (i.e., “coded in”). Application gateways may use packet

filtering or a Generic Service Proxy to handle services for which they have no

application-specific awareness.

Bastion host

A system that runs publicly accessible ...