[TuxFrw-devel] Let's get started!

[Marcelo de S. <ma...@ac...>]

Greetings TuxFrw developers!

I think it's time for us to start our work. 

It would be fine if we, before any other stuff, started to define the outline of the project.

This message posts some of my ideas. Feel free to comment it!

I'm also posting an attachment file with some "gold words" written by Mr. Alex Shnitmann, a guy that used to have a project called Fwadmin, but that unfortunately did not take off the ground. I'd like to thank Mr. Shnitmann for his great ideas about firewall management under Linux. I'd also like to thank Mr. Tzafir Cohen who advised me about that project.


This way I'm trying to gauge interest in such a project from potential
developers and potential users alike. Please feel free to comment. Please
post your opinions to the list, and depending on the replies we will see how we're going forward with TuxFrw. (No flamewars, please! We should stay as much together as possible!)

So, here it goes:

Our main focus should be the design of UI for the firewall-related administration under Linux. In other words, no new technology: just a UI for the existing. Make the neat linux firewalling and network stuff available to simple network administrators.

The software could be separated into two different parts: the interface itself and a helper application that executes all desired functions applied on the interfaces, opening fields for a client/server spec. The server layer is the one that accesses the Linux kernel and applies settings. It can do that either by calling "iptables" and the related tools. In any case, all accesses to change things in the kernel or read their state would go through this layer.

It'd be good to have CLI (NCurses) and GUI (GTK or Qt) interfaces running on many platforms. GTK would allow us to run on mostly any Unix platform, as well as Windows. That would be the client side of TuxFrw. A Web interface would be ok, but it does not permits too much functionality, narrowing configuration possibilities.

Next, there's the notion of a "configuration". A configuration is one
state of all the settings in the application. Such a configuration can
be saved in an XML file. A configuration could also be loaded from a
running machine's kernel. Therefore, the user will load the application, which loads the running configuration from the kernel, and then he'll be able to modify it applying them to the kernel and/or to a file. There would be a command created in order to apply a configuration from an XML file into the system. It would be useful in order to run from the machine's init
scripts.XML files are good for this purpose because they'll make it easily
possible to create fragments of configurations. 

It can be made possible to control logging from the UI, i.e. specify what is to be logged and what isn't.

To summarize its basic fucntions:

- Netfilter/IPtables firewall builder.
- automated Policy routing / Traffic control
- firewall auditoring / traffic analyzer (???)

User interface to Netfilter/IPtables and Linux policy routing or traffic
control, allowing you to edit firewall rules and configure the firewall to "mark" packets for policy routing or for class based queueing (CBQ). Also a firewall auditor and traffic analyzer (tcpdump, nmap, log analysis, connection viewer)

-

Please pour your comments and suggestions, in particular about points
that I've raised above, the rough architecture of the software as I
outlined, and generally where *you* see it going, what things in your
opinion are especially important, and what things I have missed if I
have.

Let's start with these basic points. Specific details later.

That's all, folks! Hope to be hearing from you soon...

------------------------------------------------------------


 - MARCELO DE SOUZA -                <ma...@ac...>





   Computer Science / UNESP - S. J. Rio Preto, SP, Brazil   





          -- ACME! Computer Security Research --





             http://www.acme-ids.org/~marcelo


------------------------------------------------------------



---------------------------------------------------------
            ACME! Computer Security Research
                http://www.acme-ids.org/