RE: Remote Access (Again)

[Justin Haase <JHaase@xxxxxxxxxxxxx>]

Let me preface these statements with the fact that I am not a "negative
nancy" or predict the sky will fall or hellfire and damnation or whatever.
I believe in a highly-secure environment, as anyone with a production system
with production data or customer information (not just iSeries) utilizing
the internet should.  If you disagree, that's fine.  I am going from direct
experience, as well as input from numerous audits by
internationally-recognized auditing firms.

> It doesn't matter if your iSeries is directly connected to the internet,
> or if it goes through a few routers first... as long as the packets get
> there, they can be sniffed.

Perhaps I wasn't clear.  Internal network with no direct internet access was
meaning either NAT or PAT, or perhaps even virtual IPs.  Not just a router
and firewall inbetween.  I apologize for the vagueness.  It could also mean
NO internet access.  Take it as you will.

> Turning off ICMP is a really bad idea.   Without it, the TCP/IP protocol
cannot work as it was designed to.

I and every auditor on the planet disagree with you on this statement.  (and
it works just fine w/o it)

> If you want to block pings, then use a firewall that's smart enough
> to block pings without blocking other ICMP functions.

Yes, that will work.

> I don't understand why you think ICMP is a security risk.    All it can do
> is a 'Denial Of Service' attack by flooding your network with traffic,
> so that important tasks take longer.

DOS is exactly why.  Remember the Ping-o-death?  Not necessarily
iSeries-related, but do one, do 'em all.

jch