Re: Outbound SMTP

[Michael Sinatra <michael () RANCID BERKELEY EDU>]

Roger Safian wrote:

> This brings me to one of my concerns.  Why do we have to engineer our
> entire networks in one fashion?  How about a research network, where
> port 25 was open, and an administrative network where it's not?  If
> every time I say lets do X, you respond with but so and so needs X,
> we make no progress.  How about we do X, where practical, and still
> allow so and so the use of an open network?  If network security
> is going to make significant strides we need to quit catering
> to the least common denominator.

You know, I thought about this while in the shower this morning.  The
analogy that came to mind is that a lot of places seem to engineer the
network for "bunny-slope networking"--non-technical users who don't
really have much in the way of needs (email, web, youtube, IM,
whatever).  Maybe they make exceptions on a single-user basis either
using an automated web-page or a review process, but how scalable is
that?  What if we instead engineered networks to offer bunny-slope all
the way through double-black-diamond?  You would still need a ski
patrol, especially for the last category, but for people who wanted to
be in a secure place where they couldn't get hurt and they could still
do their jobs, you could provide that, while not affecting the power
users.  It does, however, imply no more firewalling at the campus
border.  That's precisely where "one-size-fits-all" policies originate.

University of Washington does something similar with its "project 172"
where it provides campus-only RFC1918 addresses, with the option of
outbound NAT, for people who want security and don't need e2e
transparency.  What I am suggesting is probably a bit more involved, but
perhaps still doable with a combination of use of RFC1918 and
virtualizable firewalls (like FWSM blades) in some parts of the network
and globally-routable, public vlans in other parts.  It would be a way
to provide both security and service (imagine that!).

michael