Re: [GENERAL] Firewall Security Requirements for Postgresql Access

[Bruno Wolff III]

On Wed, Sep 08, 2004 at 03:12:29 +,
  Randy Yates [EMAIL PROTECTED] wrote:
 [EMAIL PROTECTED] (Ben) writes:
 
  Well, R/W doesn't make much sense for TCP incoming/outgoing SYN
  packets make more sense, and if the database is located outside the
  firewall, you really only need to allow outgoing SYN packets on the port
  (as well as packets related to that session, of course).
 
 Are you suggesting that the firewall be configured so that the only
 outgoing packets allowed through are ones with the SYN bit set in the
 CODE BITS field of the TCP header? I'm fairly ignorant on protocol
 matters, and I don't understand why one would single out these types
 of TCP segments.  Could you please expound?

Blocking SYN packets can be used to prevent the set up of a TCP connection.
One way to block inbound connections to ports, but allow outbound connections
to them is to block incoming SYN packets. This has the advantage that no
state needs to be maintained about the connection. The normal situation is
that inbound SYN packets are blocked except for the few ports to which you
want to allow connections to.

---(end of broadcast)---
TIP 7: don't forget to increase your free space map settings

[GENERAL] Firewall Security Requirements for Postgresql Access

[Randy Yates]

Is opening up port 5432 (R/W both directions) all that is required
of a firewall in order to access a postgres database outside the
firewall?
-- 
%  Randy Yates  % My Shangri-la has gone away, fading like 
%% Fuquay-Varina, NC%  the Beatles on 'Hey Jude' 
%%% 919-577-9882%  
 [EMAIL PROTECTED]   % 'Shangri-La', *A New World Record*, ELO
http://home.earthlink.net/~yatescr

---(end of broadcast)---
TIP 2: you can get off all lists at once with the unregister command
(send unregister YourEmailAddressHere to [EMAIL PROTECTED])