Securing YUM

cancel
Showing results for 
Search instead for 
Did you mean: 

Securing YUM

L1 Bithead

Currently there is a requirement for all our remote linux servers (Which have static IPs and numbers around 250) to have access to various public YUM servers. The public YUM servers (I am told) cannot be defined statically because they constantly change. Our Corporate Security Policy does not allow web-browsing from servers, such as our remote linux servers. My first thought was to create a Palo Alto Security Policy that only allowed access to the the Internet for the YUM application. However, I noticed in the Palo Alto Application Research Center that the YUM App-ID has an Implict Use Application of web-browsing. The standard ports used are 80 and 21. To me this means, that standard web browsing to a non YUM server is possible using a Security Policy that has the linux servers as the source and the destination being any but APP-ID being YUM.  Am I correct? Any ideas how to further tighten this policy down and still allow the needed flexibility to access changing public YUM servers? How do others secure YUM communications? Thanks in advance

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

Hello Doug,

Acording to the following article, you are correct:

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-is-Application-Dependenc...

 

Snippet from the article:

When we look at the application detail window for 'facebook-base', you can see 2 things listed.

  1. Depends on Applications is blank. This means that it does not need any other applications to be allowed in the same rule for this to work.
  2. Implicitly Use Applications has SSL and web-browsing listed. This means that if you allow facebook-base, that it will also be allowing SSL and Web-Browsing applications implicitly.

One thing you can do to further lock it down would be to use destinations. As you mentioned IP's change too frequently, however you can also use FQDN or URL's.

 

Hope this helps.

 

Regards,

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

Hello Doug,

Acording to the following article, you are correct:

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-is-Application-Dependenc...

 

Snippet from the article:

When we look at the application detail window for 'facebook-base', you can see 2 things listed.

  1. Depends on Applications is blank. This means that it does not need any other applications to be allowed in the same rule for this to work.
  2. Implicitly Use Applications has SSL and web-browsing listed. This means that if you allow facebook-base, that it will also be allowing SSL and Web-Browsing applications implicitly.

One thing you can do to further lock it down would be to use destinations. As you mentioned IP's change too frequently, however you can also use FQDN or URL's.

 

Hope this helps.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!