Re: [fw-wiz] Blackberry MDS Connection Bypassing firewall



If you don't want any 3rd party app : ) It looks like if they already have it then another approach needs looked at, but the Blackberry seems to have its own IT Policy. The URL below shows how to get the SSH running if it does not work, but reverse engineering it will tell you what you can put in place that causes these errors, hence not allowing access outbound for SSH for the Blackberry.

1. Open the BlackBerry Manager.
2. On the Tree tab, right-click the BlackBerry Enterprise Server server and select IT Policy. The IT Policy settings for BlackBerry Server window appears.
3. Click Edit. The Edit IT Policy window appears.
4. Clear the Disallow Third Party Application Downloads checkbox.
5. Click OK.

Note: Depending on the version of your BlackBerry Enterprise Server, this IT Policy setting may also be called DisallowThirdPartyAppDownloads or Disallow 3rd Party Applications.


http://www.rovemobile.com/support/faqs/ssh/



On Jan 17, 2008, at 10:38 AM, Erik LaBianca wrote:

My guess is that the best way to solve this problem would be to isolate the BES on its own system (blackberry recommends this anyway) and then restrict that computers egress access as necessary. All BES/MDS connections coming in from RIMM and through the proxy will then get handled by your regular firewall.

--erik

From: firewall-wizards-bounces@xxxxxxxxxxxxxxxxxxxxx [mailto:firewall-wizards-bounces@xxxxxxxxxxxxxxxxxxxxx ] On Behalf Of miedaner
Sent: Friday, January 11, 2008 10:47 AM
To: firewall-wizards@xxxxxxxxxxxxxxxxxxxxxxx
Subject: [fw-wiz] Blackberry MDS Connection Bypassing firewall

Hi,

Wondering if anyone has dealt with this problem with BES.


Blackberry enterprise server is configured by default to allow TCP traffic from the Blackberry clients through the encrypted BES connection to a internal network. As the Blackberries are java based some clever folks have built things like SSH clients for them.

The problem is that this type of access bypasses firewall and VPN rules.

I know that there are ACL's possible on the MDS connection service that allows this but I am told that it is either block all tcp or block none.

I am wondering if anyone knows if the BES ACl really is all or none and if anyone has implemented a solution to restrict internal network access through BES to only protocols like http or hhtps.

TIA
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards


Relevant Pages

  • Re: [fw-wiz] Blackberry MDS Connection Bypassing firewall
    ... Although for obvious reasons we really wanted to use a server side solution, and were hoping that the BES MDS Connectrion service supported fine grained ACL filtering. ... If you don't want any 3rd party app:) It looks like if they already have it then another approach needs looked at, but the Blackberry seems to have its own IT Policy. ... Depending on the version of your BlackBerry Enterprise Server, this IT Policy setting may also be called DisallowThirdPartyAppDownloads or Disallow 3rd Party Applications. ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Blackberry MDS Connection Bypassing firewall
    ... hoping that the BES MDS Connectrion service supported fine grained ACL ... to move the server into an isolated DMZ so that consistent logging can be ... it then another approach needs looked at, but the Blackberry seems to have ... and select IT Policy. ...
    (Firewall-Wizards)
  • Re: Blackberry - Outlook - Exchange question
    ... to connect to MS Exchange, but I have an application where just one user wants to use a Blackberry, so the BES isn't justified. ... In 2005 I tried this using the Blackberry connected to the Workstation, with Outlook on the workstation connecting to the Exchange server. ... BlackBerry Enterprise Server can be installed on the same machine as Microsoft Exchange as long as the total number of BlackBerry users will not exceed 15. ...
    (uk.telecom.mobile)
  • Re: Questions about upgrading my smartphone.
    ... upgraded from a Blackberry to an iPhone. ... But I'm in the state of Washington ... As of sometime last year they changed the policy that they will not ...
    (alt.cellular.verizon)
  • Re: Pen-Test Blackberry
    ... Since the BES is the source connection internally, your handheld will be able to bypass internal FW rules and allow anyone with a BES-keyed blackberry to access those internal sites. ... To add onto that, I would also like to know the security threats, vulnerabilities being faced by the blackberry devices, servers, etc. ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)