Admins...

I don't understand why admins don't answer correctly to the questions at first. This is my conversation (well, a little exaggerated) by mail with one of those:

Me - Hi! In the private networks of the Computer Science Department we can access all department network, but we can't ssh to outside the network.

Admin - Yes. That's true. You must use a proxy.

(Erm, a proxy for ssh?)

Me - Well, but how can I use ssh through the proxy?

Admin - You can't.

(Good. At least I know what a proxy and ssh are! I have plenty of patience but today wasn't one of those days...)

Me - Ok. We'll manage to create a ssh tunnel through another machine. No problem. But, meanwhile, why can't we do it?

Admin - Basically, three reasons: 1) a lot of worm infected computers were attacking machines; 2) teachers and researchers don't have much time to apply patches to their machines and 3) this way the machines are hidden and can't be accessed from outside.

(Hmms... nice reasons. We want access from inside to outside, so 2 and 3 are useless. For 1, we are all sorry for Microsoft.)

Me - Ok, we all know NAT. I think that solves 2 and 3. Also, the first will continue to happen. We know there are a lot of Windows machines on the external network.

Admin - The problem is that the network hardware does not support NAT. If you get me an old machine we can install it with Linux to work as firewall and NAT.

(Ho!!! Now you got me! I am very ignorant about networks. I don't know if the excuse is good... but... it could be told as first answer to my first question, or is just me?)

Me - Ok...

Categories

1 Comments

Marco said:

Tell your admin dude that proxies and NAT are perfectly evil (while pointing him at http://www.cs.utk.edu/~moore/what-nats-break.html) and that a firewall alone is perfectly capable of protecting machines inside from the big bad infected internet, while still allowing for proper outbound and where necessary inbound connections.

You may want to add that if he doesn't know how to do this, he should get a different job ;)

Leave a comment

About this Entry

This page contains a single entry by null published on February 15, 2005 8:29 PM.

The Lost Nobel Prizes - #1 was the previous entry in this blog.

Inkscape Rockz is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.