[lug] Firewall / Lockdown questions

[Nate Duehr]

On Jul 31, 2007, at 9:34 PM, dio2002 at indra.com wrote:

> is there any security risk posed by sending out all root mail  
> aliased to
> my external account?  i'm not sure what type of info is actually  
> sent in
> these emails over time.

For most things, no.  No "normal" daemon I've seen sends out anything  
"dangerous" to you, but I've seen systems where a prior admin had the  
system mailing things to root that shouldn't travel over the Internet  
at large.

It all depends on what you're getting in your mail from root.  If you  
wrote a cron job to e-mail you /etc/passwd every hour... and weren't  
using shadow passwords... yeah, it'd be a security risk.

And of course, how you access your mail, where it's stored, and how  
it gets there, all come into play also.  If your mail server is  
sitting right next to this box... and you always access it via a VPN  
or SSL-enabled clients and have no cleartext way to access it  
(webmail, whatever...) -- you've removed all risk that someone could  
read the mail "in flight", so to speak.  If the mail server is a  
commercial provider, then you're at their whims as to all of the  
above risks...

So, it's somewhat impossible to answer the question.  :-)

--
Nate Duehr
nate at natetech.com