firewalling

each machine at CAL is going to run a software Firewall that manages network traffic.

While we could write iptables rules by hand for everything, it's often simpler to maintain rules in a higher-level language or configuration syntax. So we're going to use ​ShoreWall to maintain those rules, at least on the servers.

the CW firewalling approach hasn't been decided yet.

You can see some of the shorewall configuration rules here for some of our common configuration files.

we may want to limit the outbound traffic on the more sensitive servers as well, as an additional security precaution.