I think network security best practices addresses that issue. Keep network management interfaces off unrestricted local area or routeable networks. Huge swaths of popular software as well as very expensive hardware have many unresolved security issues. There is nothing you can do to make a lot of that stuff secure short of putting them on their own isolated network and explicitly controlling all ingress/egress traffic to it.

The HIPAA Technical Safeguards are compact, readable, and basic: https://www.law.cornell.edu/cfr/text/45/164.312

Okay, but how does running one of the most commonly exploited languages as root pass any HIPAA audit? That was the question asked in my prior comment.

We ended up ripping out PFSense at a few medical practices due in part to this issue.

You seem to be under the impression that the management UI is on a public network. Ideally locked down to certain vlans.

The UI controls setting up the network and other services. Please explain how to do this without root access. (Write another process which runs as root and controls the settings and is talked to over a Unix socket actually isn't a bad idea, however, it is not void of its problems either.)

Also "most commonly exploited languages" is a bit of hyperbole, no? First, C probably takes that slot. Second, being one of the most common languages for web development makes it a target. Third, most php exploits are bad code, which, while easy to write in php (and c!), can be and is done in all languages.

Isn't the administrator interface on _any_ router essentially root access on said router? Do you complain that juniper or Cisco equipment is insecure because you can login?

BMCs (Baseboard management controllers) are something with very ... questionable ... security, yet network segregation is used to ensure its use securely. Given that many HIPAA complaint organizations such as AWS and GCP (Google Cloud Platform) I find it hard to believe that a management interface would disqualify something from HIPAA compliance.

Which part of the HIPAA audit did pfsense fail? Was it simply an abundance of caution" on your part? If so, what did you replace it with that didn't have a management or has a management interface with no bugs (hint: even Cisco and juniper have CVEs for the management interface)?

PHP makes it trivial to write bad code, and hard to write good code.

So does C?

Also, php in no way makes it hard to write good code, it's just easy not to.

Why not? Which part of the Security Rule would it violate?

It's probably a bad idea. But HIPPA is a specific and public block of text, which says less than most people seem to imagine it does. (I'm no lawyer. I've just read the thing).

You can always roll your own headless openBSD + pf

I can only recommend the same, OpenBSD + pf is simply perfect. If you manage a couple of firewalls add Ansible and you'll never consider vendor firewall appliances again: https://github.com/liv-io/ansible-roles-bsd/tree/master/open...

This is really cool!

Thank you, happy to read! I hope more people discover the beauty of OpenBSD. Sane defaults, security standards and developers. Can't be grateful enough for their work.

> Running PHP as root

OPNsense was created to fix that. Now it is better than pfSense.

How is a disappearing network interface handled? What about package deperecation?

On both issues, PFSense left me with a non-working router, which is unacceptable when every other router software and hardware appliance out there will bring itself up in a hobbled state to pass traffic.

An optional ethernet port disappearing is not a good reason for your router to halt and catch fire.