[Discuss] multi-home-office security and privacy

[bctill]

Hello all --

While waiting for replies, I've been searching the web, but that has 
been more-or-less fruitless, as the information on the web seems aimed 
at one of three audiences:

1. Managers wanting enterprise-wide policy guidelines.
2. Consumers wanting generic, maintenance-free "solutions".
3. People wanting details of what menu item to click.

Oddly, there seems to be little or nothing aimed at the sysadmin who has 
to design, implement and maintain these systems so as to minimize the 
overall attack surface while maximizing functionality for authorized 
users.

For engineers designing any other kind of system, there is no end to 
sites offering tips, tricks, and rules of thumb.  But when it comes to 
network security... almost nothing.

Can anyone suggest where I can find this kind of information?

Regards,
-- Bernie.


On 2023-03-09 14:47, bctill wrote:
> Hi Brendan --
> 
> Thanks for the quick reply.
> 
> People who are serious about privacy and security can not allow 
> themselves to be deterred by unpleasantly complicated solutions.
> 
> Any device, access to which is not physically controlled by me at all 
> times, 24/365, can not be trusted.  Smart phones, for example, don't do 
> what users want unless integrated into a third-party cloud such as 
> icloud.  Even Linux distros now have "features" like telemetry and 
> forced updates baked in, on the false premise that the third-party 
> server that maintains the distro can be trused.
> 
> There is no such thing as a "trusted third party".
> 
> Therefore, real-time deep packet inspection with the ability to 
> interdict both in-bound and out-bound traffic based on source, 
> destination, and content is the minimum level of security I'm willing 
> to consider.  I'm looking for the ability to deny all traffic not 
> conforming to a specific set of exceptions of the form "program v, 
> executed on local device w, by user x, is allowed to communicate with 
> remote location y, for purpose z".
> 
> I'm also looking for the ability to scan in-bound and out-bound traffic 
> in real time for payloads containing embedded threats.
> 
> The whole solution must be tolerant of mixed operating-systems, because 
> devices running iOS and Windows 10 must be accomodated in addition to 
> Linux.  On the Linux front, I have the option to standardize on a 
> specific distro, so discussion of the size and shape of the attack 
> surface presented by various distros would be welcome.
> 
> Sonicwall "security appliances" seem to have most of these 
> capabilities, but again, I lack the context to ask the right questions 
> or understand the jargon used in the answers.  Even though I have a 
> Ph.D. in computer science, I feel nowhere near qualified to separate 
> reliable information from marketing hype.
> 
> In this area, "I get the gist" is nowhere near good enough!  So... 
> where do we go from here?
> 
> Regards,
> -- Bernie.
> 
> 
> On 2023-03-09 12:51, Brendan wrote:
>> hi bernie,
>> 
>> you'll probably want some sort of vpn between them, as setting up SSH 
>> tunnels for every needed port is a pain in the ass.
>> 
>> try and find a simpler SSL based vpn (something like 
>> http://ocserv.gitlab.io/www/index.html perhaps - note: i use their 
>> client to connect to a cisco ssl vpn, i haven't tried the server 
>> itself). ipsec vpns are unpleasantly complicated to set up.
>> 
>> make sure to have a firewall (probably using iptables/nftables on your 
>> gateway/NAT server, which could also run the vpn server) in front of 
>> the servers and start it off with a default deny policy (then add in 
>> allow rules for traffic that needs to get out).
>> 
>> if you have a solid firewall policy that'll protect things pretty 
>> well. if you trust the remote sites, you could just let them vpn in 
>> and have unfirewalled access to the server network (though, still 
>> require authentication for everything on the server network itself).
>> 
>> 
>> On 2023-03-09 12:38, bctill wrote:
>>> Hello all --
>>> 
>>> I am looking for someone with whom I can discuss (and from whom I can 
>>> learn about) setting up a network of two or three home offices and 
>>> securing it.  The network should include web server, email server, 
>>> file server, computation server, and three to six (silent) 
>>> workstations.
>>> 
>>> Up to now, I have been a one-man band so my approach to internet 
>>> security has simply been to keep all private and proprietary 
>>> information on a machine connected to the internet only via 
>>> sneaker-net.
>>> 
>>> Obviously, this is not sufficient for the new use-case. Equally 
>>> obviously, I have a lot of context to absorb before I can even frame 
>>> my questions in a meaningful way.
>>> 
>>> Is anyone up for it?
>>> 
>>> Regards,
>>> -- Bernie.
>>> 
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> Discuss mailing list
>>> Discuss at vlug.org
>>> http://vlug.org/mailman/listinfo/discuss_vlug.org