Comment by colemannugent
5 hours ago
Reading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.
5 hours ago
Reading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.
Further indication is that PHP 7.4.33 and PHP 8.30.0 are mentioned which are an exact match for PAN-OS 11.1/11.2 and 12.1/12.2 respectively
Why does a world-class firewall stack need PHP? I'm sure PAN-OS has some neat DPI features, but I would love to see firewalls that are implemented in FPGA, where the tasking was compiled down to gates to be performed deterministically, much like the low port count network switches we have today.
What else would you use to power the configuration gui frontend? Allow me to eliminate some of the obvious and inevitable answers:
- Rust didn't exist at the time
- Go didn't exist at the time
- nodejs didn't exist at the time
- Java and Python likely used too much resources for a once-in-a-while used GUI
Irrational hatred aside, that's literally what PHP was designed for.
6 replies →
This makes me kinda furious. The us government makes me do so much goddamned work to comply with their cyber security regulations (only about half of which actually contribute to my security posture), and here they are running their fucking firewall management page publicly exposed (the globalprotect portal was not vulnerable, only the _actual_ management page).
The title is misleading as the article says "including systems in a US government-affiliated environment" which reads more like a 3rd party the government is contracted with versus actual government systems.
The government tends to have the magical combination of total power combined with low to moderate skill.
public markets point to FORTINET