Re: [tlug] low power home server: Separate Router and Server Boxes: Security in Depth

[jep200404 <jep200404@example.com>]

On Tue, 11 May 2010 08:40:23 +0900, Darren Cook <darren@example.com> wrote:

[> On Mon, 10 May 2010 23:28:11 +0900, Janos Gyerik <janos.gyerik@example.com> wrote:]

> > I realized it's
> > not such a good idea to have my storage on the same box as the router,
> > in terms of security,  so I'll definitely go with a router + NAS setup
> > (separate boxes). ...
> 
> The counter-arguments are:
>  * Two boxes ruins your goal of low-power;

It frustrates it, although it does not ruin it. 
I have a router that consumes about 3 Watts. 
An idle SheevaPlug consumes about the same. 

Also, one might let the router be on all the time, 
but only turn on the storage box as needed, 
so that the storage box power use might not be so important. 

Life is full of compromises. 

>  * Are your files any safer if your router is compromised, 
>  if the files are on local LAN as opposed to local disk?

Yes!

"Security in depth" is an old concept known in more than one realm. 

   http://en.wikipedia.org/wiki/Defense_in_depth
   http://en.wikipedia.org/wiki/Defense_in_depth_(computing)
   http://en.wikipedia.org/wiki/Layered_security
   
> Yes, okay, theoretically they are safer as you would configure the NAS
> to not allow access from the router IP address. 

Not just theoretically safer, but actually safer. 
A compromised router would have to authenticate with the storage server. 
Encryption goodies can make it difficult for a rogue router to get into 
a storage server. Use security in depth. 

> But, more practically,
> if all your configuration is perfect then your router isn't going to be
> compromised anyway, ...

True, ...

> ... and the point is moot.

... but I do not confirm the antecedent. 
Security in depth is about how to cope with an imperfect world, 
about how to still have security even when one defense is compromised, 
there are still n-1 things to get through. 

> But one interesting idea is one box, two OS: one for the router, one for
> the NAS and everything else.

That's better than one OS in one box, 
but still not as robust as separate boxes. 

We did not even get to DNS and MAC fun.