Securing YUM

[Doug_Hogue]

Currently there is a requirement for all our remote linux servers (Which have static IPs and numbers around 250) to have access to various public YUM servers. The public YUM servers (I am told) cannot be defined statically because they constantly change. Our Corporate Security Policy does not allow web-browsing from servers, such as our remote linux servers. My first thought was to create a Palo Alto Security Policy that only allowed access to the the Internet for the YUM application. However, I noticed in the Palo Alto Application Research Center that the YUM App-ID has an Implict Use Application of web-browsing. The standard ports used are 80 and 21. To me this means, that standard web browsing to a non YUM server is possible using a Security Policy that has the linux servers as the source and the destination being any but APP-ID being YUM.  Am I correct? Any ideas how to further tighten this policy down and still allow the needed flexibility to access changing public YUM servers? How do others secure YUM communications? Thanks in advance

[OtakarKlier · Accepted solution]

Hello Doug,

Acording to the following article, you are correct:

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-is-Application-Dependenc...

Snippet from the article:

When we look at the application detail window for 'facebook-base', you can see 2 things listed.

1. Depends on Applications is blank. This means that it does not need any other applications to be allowed in the same rule for this to work.
2. Implicitly Use Applications has SSL and web-browsing listed. This means that if you allow facebook-base, that it will also be allowing SSL and Web-Browsing applications implicitly.

One thing you can do to further lock it down would be to use destinations. As you mentioned IP's change too frequently, however you can also use FQDN or URL's.

Hope this helps.

Regards,