git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@4520 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
1998-03-03 18:39:52 +00:00
parent 09f4ec9aff
commit a4f3488699
2 changed files with 16 additions and 16 deletions

View File

@@ -74,9 +74,9 @@ Distribution of this memo is unlimited. Please send comments to the
<cat-ietf@mit.edu> mailing list. <cat-ietf@mit.edu> mailing list.
.HH 1 "Abstract" .HH 1 "Abstract"
.lp .lp
Kerberos and firewalls both deal with security, but because of the Kerberos and firewalls both deal with security, but doesn't get along
anti-social nature of firewalls, they don't get along very well. This very well. This memo discusses ways to use Kerberos in a firewalled
memo discusses ways to use Kerberos in a firewalled environment. environment.
.HH 1 "Introduction" .HH 1 "Introduction"
.lp .lp
Kerberos[RFC1510] Kerberos[RFC1510]
@@ -94,15 +94,15 @@ with firewalls are many, but to name a few:
.np .np
Firewalls usually doesn't allow people to use UDP. The reason for this Firewalls usually doesn't allow people to use UDP. The reason for this
is that UDP is (by firewall advocates) considered insecure. This is that UDP is (by firewall advocates) considered insecure. This
belief is probably based on the fact that many \(*lqinsecure\*(rq belief is probably based on the fact that many \*(lqinsecure\*(rq
protocols (like NFS) use UDP. UDP packets are also considered easy to protocols (like NFS) use UDP. UDP packets are also considered easy to
fake. fake.
.np .np
Firewalls usually doesn't allow people to connect to arbitrary ports, Firewalls usually doesn't allow people to connect to arbitrary ports,
such as the ports used when talking to the KDC. such as the ports used when talking to the KDC.
.np .np
In many non-computer organisations, the computer staff isn't what you In many non-computer organisations, the computer staff isn't what
would call a \(*lqwizards\*(rq; a typical case an academic you'd call \*(lqwizards\*(rq; a typical case is an academic
institution, where someone is taking care of the computers part time, institution, where someone is taking care of the computers part time,
and is doing research the rest of the time. Adding a complex device and is doing research the rest of the time. Adding a complex device
like a firewall to an environment like this, often leads to poorly run like a firewall to an environment like this, often leads to poorly run
@@ -157,8 +157,8 @@ hitch a ride on some other protocol, that's already beeing handled by
the proxy. the proxy.
.)f .)f
.lp .lp
This type of firewall might also cause extra trouble when used with The last type of firewall might also cause extra trouble when used
kerberised versions of protocols that the proxy understands, in with kerberised versions of protocols that the proxy understands, in
addition to the ones mentioned below. This is the case with the FTP addition to the ones mentioned below. This is the case with the FTP
Security Extensions [RFC2228], Security Extensions [RFC2228],
.(d .(d

View File

@@ -74,9 +74,9 @@ Distribution of this memo is unlimited. Please send comments to the
<cat-ietf@mit.edu> mailing list. <cat-ietf@mit.edu> mailing list.
.HH 1 "Abstract" .HH 1 "Abstract"
.lp .lp
Kerberos and firewalls both deal with security, but because of the Kerberos and firewalls both deal with security, but doesn't get along
anti-social nature of firewalls, they don't get along very well. This very well. This memo discusses ways to use Kerberos in a firewalled
memo discusses ways to use Kerberos in a firewalled environment. environment.
.HH 1 "Introduction" .HH 1 "Introduction"
.lp .lp
Kerberos[RFC1510] Kerberos[RFC1510]
@@ -94,15 +94,15 @@ with firewalls are many, but to name a few:
.np .np
Firewalls usually doesn't allow people to use UDP. The reason for this Firewalls usually doesn't allow people to use UDP. The reason for this
is that UDP is (by firewall advocates) considered insecure. This is that UDP is (by firewall advocates) considered insecure. This
belief is probably based on the fact that many \(*lqinsecure\*(rq belief is probably based on the fact that many \*(lqinsecure\*(rq
protocols (like NFS) use UDP. UDP packets are also considered easy to protocols (like NFS) use UDP. UDP packets are also considered easy to
fake. fake.
.np .np
Firewalls usually doesn't allow people to connect to arbitrary ports, Firewalls usually doesn't allow people to connect to arbitrary ports,
such as the ports used when talking to the KDC. such as the ports used when talking to the KDC.
.np .np
In many non-computer organisations, the computer staff isn't what you In many non-computer organisations, the computer staff isn't what
would call a \(*lqwizards\*(rq; a typical case an academic you'd call \*(lqwizards\*(rq; a typical case is an academic
institution, where someone is taking care of the computers part time, institution, where someone is taking care of the computers part time,
and is doing research the rest of the time. Adding a complex device and is doing research the rest of the time. Adding a complex device
like a firewall to an environment like this, often leads to poorly run like a firewall to an environment like this, often leads to poorly run
@@ -157,8 +157,8 @@ hitch a ride on some other protocol, that's already beeing handled by
the proxy. the proxy.
.)f .)f
.lp .lp
This type of firewall might also cause extra trouble when used with The last type of firewall might also cause extra trouble when used
kerberised versions of protocols that the proxy understands, in with kerberised versions of protocols that the proxy understands, in
addition to the ones mentioned below. This is the case with the FTP addition to the ones mentioned below. This is the case with the FTP
Security Extensions [RFC2228], Security Extensions [RFC2228],
.(d .(d