 |
The Question is:
We want to make our VAX cluster available on the Internet. We have a VAX
4000-200 and a VAX 4000-400 running Decnet, no TCP-IP. We are thinking of
using another machine as the "front end" to the Internet. It can be either a
VaxStation 4000VLC or a Micr
oVax 3100 Model 10, or we can buy whatever system is necessary. The front end
would take care of receiving the TCP-IP from the Internet and passing it to
the cluster as Decnet. Any suggestions or ideas greatly appreciated!
Thank you
The Answer is :
Route-through from IP to DECnet is the least of your considerations.
Making your OpenVMS Cluster available on the Internet may well mean
you are (unintentionally) providing more access than you had intended.
Get a (reputable) firewall router. Keep its filters current.
Get to the current OpenVMS version.
Get to the current OpenVMS ECOs.
Get to the current TCP/IP Services version, and ECO.
Disable SMTP route-through or configure the provided filter on any
system exposed to the internet.
Acquire SSL or SSH or other encrypting transport.
Consider one-time passwords for remote logins -- you will definitely
want to look at encryption, and particularly look at the information
(sensitive documents, passwords, etc) that might be in cleartext.
You will want to enable and periodically review auditing.
You will want to harden your environment -- consider the use of CD-R
based system disks or other non-writable media -- and you will most
definitely want to archive anything you care about at regular intervals.
Segment your network into a trusted and an untrusted zone, and
potentially a "hot" zone in between these. While you will obviously
not want to trust any systems outside your firewall, you will also
want to avoid trusting systems behind your firewall -- if these are
compromised...
Educate your users on appropriate security and particularly appropriate
email practices.
Read and follow the directions in the OpenVMS Guide to System Security,
and specifically the appendix on configuring for NCSC Class C2 security.
|
|
|
|
|
