thanks again for a really nice, small, easily installable firewall distro based on Linux! Configuration feels ‘light’ and the many graphs helpful. I actually wanted to like it as my future firewall.
Alas, ‘security through obfuscation’ is a no-go, and the port 444 is nice, but only as icing on a security cake. The cake itself doesn’t convince me:
After a cold boot, the bash history is still available. I might be able to change that, but don’t want to. It ought to be a must-have.
After a cold boot, the token on the client side of the web-GUI is still valid and I am allowed to continue with the configuration from where I have left off at shutdown.
Unfortunately, for me there is no going further for me from here for the time being. I am afraid of more surprises that don’t give me the confidence that I personally would like to have.
So sad, thanks again for the help provided during my first steps!
and what security problem would clearing the Bash history solve?
If somebody has access to your Bash history, he/she/it has access to the machine itself. The history of commands is the last thing you would have to worry about in such a scenario.
This is not a decision of IPFire: Since we are using HTTP Basic Authentication, that’s just the way authentication is standardised. Needless to say, we could implement something else, but that would come with additional complexity, hence additional attack surface.
Frankly, I do not consider that level of “security” to be appropriate: IPFire, like virtually all security solutions out there, works under the assumption of its administration being trustworthy. If you have a problem with a compromised device you are accessing IPFire’s web interface from, it’s curtains either way.
Well, having this “security level” in mind, IPFire is certainly not good enough for you.