Re: [fw-wiz] A fun smackdown...

From: Devdas Bhagat (devdas_at_dvb.homelinux.org)
Date: 05/20/05

  • Next message: Chuck Swiger: "Re: [fw-wiz] A fun smackdown..." 
    To: firewall-wizards@honor.icsalabs.com
Date: Fri, 20 May 2005 04:17:11 +0530

    On 19/05/05 17:32 -0400, Paul D. Robertson wrote:
    <snip>
    > >
    > > I used Cisco's proxying of SMTP as a well-known example of a "security
    > > feature" which breaks legitimate protocol extensions (ESMTP), yet
    >
    > That's the point; You stop things (I don't think it really "breaks it,"
    > since it should default to HELO instead of EHLO- so "doesn't allow

    Yes it does. Minimally, it breaks the requirement that the server
    advertise its fully qualified hostname to the remote SMTP client in the
    greeting.

    > increased functionality" is probably more accurate.) Heck, I try not to

    The increased functionality enhances security by allowing for
    1> SMTP AUTH
    2> TLS
    3> being able to reject before 'data' based on size as offered by the client.
    (otherwise you have to accept all the data and that can lead to a DoS).
    4> Catching broken spamware and proxies which spew out SMTP protocol
    stuff before responses without offering EHLO and explicitly being
    offered pipelining.

    > run browsers that do ActiveX when I run a browser on a Microsoft OS,
    > that's reduced functionality too- but I'm willing to accept it because it
    > reduces my risk.
    >
    > Guards with guns stop the free flow of people, and reduce the
    > functionality of a place- but they also reduce the risk if they're doing
    > their jobs- and many places are happy to deploy them.
    >
    > > doesn't seem to really improve security, but if you aren't very
    > > familiar with it, I won't insist on debating this particular example.
    > > :-)
    >
    > Does it stop the MS-only extensions? In that case it does provide some
    > security value- unless you feel that overflows in SMTP verbs aren't that
    > big a security deal...

    But those could be stopped by a ESMTP speaking defensive proxy as well.

    Devdas Bhagat
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Chuck Swiger: "Re: [fw-wiz] A fun smackdown..."

    Relevant Pages

    • Re: [fw-wiz] Re: Firewalls breaking stuff: [Was re: fwtk]
      ... > functionality or backwards-compliance with older protocols. ... canonical examples of "security software" that should have been ... Please explain why SMTP AUTH or performing SSL-based ... Encryption isn't a magic bullet- suddenly you're providing remote access ...
      (Firewall-Wizards)
    • Re: Email and DMZs (iptables)?
      ... Having it in the DMZ is simple, ... Put in the DMZ only de SMTP that is the MX of yuor domain and inside put a ... this is not a risk because your inside zone is protected. ... About the SMTP server security I think that sendmail is updated frequently ...
      (Focus-Linux)
    • Re: MS ISA any good?
      ... I think ISA is fabulous! ... to integrate the logs into SQL server which makes things quite nice. ... I'm sure you can set up most of the same functionality ... > security device, as well as providing web cache services. ...
      (comp.security.firewalls)
    • RE: ESTMP Exploits & Security
      ... telnet attempts to an SMTP service by the fact that a manual telnet ... Subject: ESTMP Exploits & Security ... send it through the _client's_ SMTP server, and if I asked employees to ... breaking the mail server, as most servers do not use this. ...
      (Security-Basics)
    • Re: starwreck
      ... web browsing and email are still very vulnerable -- email because it includes automatic forwards, causing it to act like a push service in every sense except the IP layer; web because most clients are rich (causing them to be especially vulnerable to attacks) and because cross-site scripting can allow deliberately accessed machines to be used to launch attacks on behalf of third parties. ... I can absolutely guarentee the intergerty of POP and SMTP software if I must, ... Well, perhaps I'm paranoid,, Perhaps I have a history of ticking off 14 year old hackers (and trust me, they did sure try to get me, failed miserably because I had very solid security but they did over 2,000 in damage to a server in the process, This server happed to belong to an internet security company.. ...
      (rec.music.filk)