Great idea, I do it all the time. As iptables is stateful, you can configure the script to disallow all outgoing connections and only allow http, https is you use it and ssh for management. Don't forget to get the web server to remotely log its syslog, for a rock solid audit trail.
cheers Ivan >>> Anish Basu <[EMAIL PROTECTED]> 06/25/03 04:24pm >>> I am trying to set up a secure web server which will already be protected by a dedicated harware firewall. The hardware firewall will be configured to protect the web server as well other computers on the network. The web server will be running Red Hat 9.0. Is there any reason to install and configure firewall software such as IPTables on the web server itself? Are there any advantaqes or disadvantages to having two firewalls set up this way? Thanx in advance for any help. ************************************************************* Anish Basu ([EMAIL PROTECTED]) Chair Events and Programming Co-Chair Internet Security USACS, Undergraduate Student Alliance of Computer Scientists http://usacs.rutgers.edu ************************************************************* -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.2.1 (GNU/Linux) mQGiBD73j5cRBACZL6r2HapGwo05TAkgw3xGvkfWQl19010ucpiMECdJBI9KfgrK /F9qUAcdKeJvJUSNVIDudfs+LKf8chpW3+uhH121m01PrlNKK+PU4BGlkEAMvmMw UJaG1Qq37Vs9uw0Ar2bCzq8XDUdbSuJtv/AucTJW4gv30NIwnHYHSesKuwCglKXi jAkwG0hXxFX33WqsX+OYffEEAJWhaF3VfXVgiz8xaWSNwatd8CKsZlknBnomJpen TVdlsnl+18Nyl2VjRzcRimYJQdEKUQjpUfjrmOP1+OCPA1cvk46KMO2frdvbGRLs PxWrxa60G7bJVpuw1LF1cTNAiFzQT3uaZzOIj+zZvntBPvi6dTgeqqt0G4T5fdhM 398bA/sHktmFOBtYMTFTbNF74HeMv1DfmRHjDygkpOS+ZZrdZUIv0VXSyPjwsVLY zF+J8pzyxDVhD9gtTnlIUxGFW22S+PSvFDXPwB//Vrcux6ogfuAhpRjbrC5K1ED+ sTzMNebZVaDAQvsCFhKlHoYlwMsUnOASDcrlTDPIe7h8rt/BkbQkQW5pc2ggQmFz dSA8YW5pc2hiQGVkZW4ucnV0Z2Vycy5lZHU+iFkEExECABkFAj73j5cECwcDAgMV AgMDFgIBAh4BAheAAAoJEFg2FXGIkwwyXpkAni1mKIaIF8xvQTII6U+5oas1Zhyc AJ99GSjXgiVS7ED/dS+Ti9LPUuP1NLkBDQQ+94+cEAQApxgDaofLmhxouHOX0dPz qitLgWwJUB5hTB1duFSdBGBVwAPSVLzE33UJiwiYr0L/lSJenfwh50FeavqyHSxE M0ttF5/yP+7y1pmWMkxcBkntmKOPMNyC+ptV3TTK9geGcIxZyIx4sm631Pb3PNCf 2p7PrgsLYNJLktP4jERvw/cAAwUD/AkVM2zoMjPkZd7+BGrJeNzuTENq7m7xc1ur v6fLWx+K0eNbfkKoyiLqVTTtSzX8CV2j/nu+Vwnfy/4Qr3KKdd1fg0W088FPPhQO 7ZqVS89lAePLNBHSrhS9Et63A74Qw58W/fS9UMVGvATrdRTqCXv5ru/yGLalqWTU 1yi8zSpViEYEGBECAAYFAj73j5wACgkQWDYVcYiTDDLACwCdHBAHf/UwoB8BsbDk IGoZW0tuD7cAnRi5TN/irq9muS3jENqIJB+rquV0 =od0b -----END PGP PUBLIC KEY BLOCK----- --------------------------------------------------------------------------- Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! The Gartner Group just put Neoteris in the top of its Magic Quadrant, while InStat has confirmed Neoteris as the leader in marketshare. Find out why, and see how you can get plug-n-play secure remote access in about an hour, with no client, server changes, or ongoing maintenance. Visit us at: http://www.neoteris.com/promos/sf-6-9.htm ---------------------------------------------------------------------------- *************************************************************************** Messages included in this e-mail and any of its attachments are those of the author unless specifically stated to represent WorkCover Queensland. The contents of this message are to be used for the intended purpose only and are to be kept confidential at all times. This message may contain privileged information directed only to the intended addressee/s. Accidental receipt of this information should be deleted promptly and the sender notified. This e-mail has been scanned by Sophos for known viruses. However, no warranty nor liability is implied in this respect. ********************************************************************** --------------------------------------------------------------------------- Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! The Gartner Group just put Neoteris in the top of its Magic Quadrant, while InStat has confirmed Neoteris as the leader in marketshare. Find out why, and see how you can get plug-n-play secure remote access in about an hour, with no client, server changes, or ongoing maintenance. Visit us at: http://www.neoteris.com/promos/sf-6-9.htm ----------------------------------------------------------------------------