3 ms·

pfSense is great for a prosumer router. What gets me about it is cleaning up the mess it creates in business use cases, as pfSense is designed with a mindset th

pfSense is great for a prosumer router. What gets me about it is cleaning up the mess it creates in business use cases, as pfSense is designed with a mindset that the pro will always be there, ready to attach a screen at a moments notice when interfaces change or packages get updated. Running PHP as root also isn't great, I'm not sure how that passes in the context of HIPPA.

gigatexal 8y ago
You can always roll your own headless openBSD + pf
- liv-io 8y ago
  I can only recommend the same, OpenBSD + pf is simply perfect. If you manage a couple of firewalls add Ansible and you'll never consider vendor firewall appliances again: https://github.com/liv-io/ansible-roles-bsd/tree/master/openbsd_pf https://github.com/liv-io/ansible-roles-bsd/tree/master/open...
  - gigatexal 8y ago
    This is really cool!
    - liv-io 8y ago
      Thank you, happy to read! I hope more people discover the beauty of OpenBSD. Sane defaults, security standards and developers. Can't be grateful enough for their work.
mkhpalm 8y ago
I think network security best practices addresses that issue. Keep network management interfaces off unrestricted local area or routeable networks. Huge swaths of popular software as well as very expensive hardware have many unresolved security issues. There is nothing you can do to make a lot of that stuff secure short of putting them on their own isolated network and explicitly controlling all ingress/egress traffic to it.
auslander 8y ago
> Running PHP as root OPNsense was created to fix that. Now it is better than pfSense.
- metildaa 8y ago
  How is a disappearing network interface handled? What about package deperecation? On both issues, PFSense left me with a non-working router, which is unacceptable when every other router software and hardware appliance out there will bring itself up in a hobbled state to pass traffic. An optional ethernet port disappearing is not a good reason for your router to halt and catch fire.
closeparen 8y ago
The HIPAA Technical Safeguards are compact, readable, and basic: https://www.law.cornell.edu/cfr/text/45/164.312 https://www.law.cornell.edu/cfr/text/45/164.312
- metildaa 8y ago
  Okay, but how does running one of the most commonly exploited languages as root pass any HIPAA audit? That was the question asked in my prior comment. We ended up ripping out PFSense at a few medical practices due in part to this issue.
  - closeparen 8y ago
    Why not? Which part of the Security Rule would it violate? It's probably a bad idea. But HIPPA is a specific and public block of text, which says less than most people seem to imagine it does. (I'm no lawyer. I've just read the thing).
  - jimktrains2 8y ago
    You seem to be under the impression that the management UI is on a public network. Ideally locked down to certain vlans. The UI controls setting up the network and other services. Please explain how to do this without root access. (Write another process which runs as root and controls the settings and is talked to over a Unix socket actually isn't a bad idea, however, it is not void of its problems either.) Also "most commonly exploited languages" is a bit of hyperbole, no? First, C probably takes that slot. Second, being one of the most common languages for web development makes it a target. Third, most php exploits are bad code, which, while easy to write in php (and c!), can be and is done in all languages. Isn't the administrator interface on _any_ router essentially root access on said router? Do you complain that juniper or Cisco equipment is insecure because you can login? BMCs (Baseboard management controllers) are something with very ... questionable ... security, yet network segregation is used to ensure its use securely. Given that many HIPAA complaint organizations such as AWS and GCP (Google Cloud Platform) I find it hard to believe that a management interface would disqualify something from HIPAA compliance. Which part of the HIPAA audit did pfsense fail? Was it simply an abundance of caution" on your part? If so, what did you replace it with that didn't have a management or has a management interface with no bugs (hint: even Cisco and juniper have CVEs for the management interface)?

gigatexal 8y ago

You can always roll your own headless openBSD + pf

liv-io 8y ago
I can only recommend the same, OpenBSD + pf is simply perfect. If you manage a couple of firewalls add Ansible and you'll never consider vendor firewall appliances again: https://github.com/liv-io/ansible-roles-bsd/tree/master/openbsd_pf https://github.com/liv-io/ansible-roles-bsd/tree/master/open...
- gigatexal 8y ago
  This is really cool!
  - liv-io 8y ago
    Thank you, happy to read! I hope more people discover the beauty of OpenBSD. Sane defaults, security standards and developers. Can't be grateful enough for their work.

mkhpalm 8y ago

I think network security best practices addresses that issue. Keep network management interfaces off unrestricted local area or routeable networks. Huge swaths of popular software as well as very expensive hardware have many unresolved security issues. There is nothing you can do to make a lot of that stuff secure short of putting them on their own isolated network and explicitly controlling all ingress/egress traffic to it.

auslander 8y ago

> Running PHP as root OPNsense was created to fix that. Now it is better than pfSense.

metildaa 8y ago
How is a disappearing network interface handled? What about package deperecation? On both issues, PFSense left me with a non-working router, which is unacceptable when every other router software and hardware appliance out there will bring itself up in a hobbled state to pass traffic. An optional ethernet port disappearing is not a good reason for your router to halt and catch fire.

closeparen 8y ago

The HIPAA Technical Safeguards are compact, readable, and basic: https://www.law.cornell.edu/cfr/text/45/164.312 https://www.law.cornell.edu/cfr/text/45/164.312

metildaa 8y ago
Okay, but how does running one of the most commonly exploited languages as root pass any HIPAA audit? That was the question asked in my prior comment. We ended up ripping out PFSense at a few medical practices due in part to this issue.
- closeparen 8y ago
  Why not? Which part of the Security Rule would it violate? It's probably a bad idea. But HIPPA is a specific and public block of text, which says less than most people seem to imagine it does. (I'm no lawyer. I've just read the thing).
- jimktrains2 8y ago
  You seem to be under the impression that the management UI is on a public network. Ideally locked down to certain vlans. The UI controls setting up the network and other services. Please explain how to do this without root access. (Write another process which runs as root and controls the settings and is talked to over a Unix socket actually isn't a bad idea, however, it is not void of its problems either.) Also "most commonly exploited languages" is a bit of hyperbole, no? First, C probably takes that slot. Second, being one of the most common languages for web development makes it a target. Third, most php exploits are bad code, which, while easy to write in php (and c!), can be and is done in all languages. Isn't the administrator interface on _any_ router essentially root access on said router? Do you complain that juniper or Cisco equipment is insecure because you can login? BMCs (Baseboard management controllers) are something with very ... questionable ... security, yet network segregation is used to ensure its use securely. Given that many HIPAA complaint organizations such as AWS and GCP (Google Cloud Platform) I find it hard to believe that a management interface would disqualify something from HIPAA compliance. Which part of the HIPAA audit did pfsense fail? Was it simply an abundance of caution" on your part? If so, what did you replace it with that didn't have a management or has a management interface with no bugs (hint: even Cisco and juniper have CVEs for the management interface)?