October 18, 2001, 4:53 PM — Last month's column was devoted to planning the architecture of your firewall. While some administrators may consider such planning a management responsibility, it will become an administrator's responsibility if it's not properly addressed before the firewall is implemented. This article focuses on setting up the environment that supports your firewall software. Next month I'll conclude with advice on firewall deployment.
Operating system platform
Choosing a platform becomes almost a religious debate with some people, and it's not one I want to get into here. My choice is always a Unix system, and for this article I will describe a Solaris system (this is Unix Insider,after all).
Be sure to check the requirements for your firewall software. My partner and I once went through the effort of installing Solaris 7 on a box and hardening the system, only to discover that the firewall software had not yet been ported to Solaris 7. We had to backtrack to Solaris 2.6. Read the firewall documentation before you start installing the platform.
Hardening the operating system
It would be foolish to rely on the firewall software alone to protect the system. Before installing the firewall software, the system should be hardened to limit potential exposure. If you purchase a "black box" firewall, the vendor should harden the system, though you have no way to be certain that everything is in order. If you're installing the firewall yourself, you can strip all unnecessary services from the OS. Peter Galvin and Hal Pomeranz offered guidelines for hardening your OS in two previous Unix Insider columns. Peter's tips in his Solaris Security FAQ are more up-to-date (and I hear he will be updating the FAQ page again soon).
I've used Peter's guidelines quite often myself, with the following modifications:
Some firewall applications will not work with just the core system support option, and it becomes very time-consuming to install libraries piecemeal. I install the developer system support and remove binaries I don't need.