RE: [Full-Disclosure] Proxies

From: Bassett, Mark (mbassett_at_omaha.com)
Date: 10/31/03

  • Next message: Kenneth R. van Wyk: "[Full-Disclosure] Re: Gates: 'You don't need perfect code' for good security" 
    To: "Charles E. Hill" <chill@herber-hill.com>, "Earl Keyser" <Earl.Keyser@wayzata.k12.mn.us>
Date: Fri, 31 Oct 2003 14:41:38 -0600

    Doesn't matter, you can still set up a squid http proxy on port 80 and
    funnel everything through it. Web traffic will appear through port 80.
    If you analyzed the protocols, and made sure nothing but http traffic
    was going through port 80 you would eliminate using other apps through
    the port 80 proxy, but you cannot eliminate a port 80 http proxy for
    http traffic. You could set a policy in your domain to restrict proxy
    settings, but a user could always use a different browser (group policy
    only effects IE) Currently I use a squid http proxy on port 80 to
    bypass my own firewall to listen to shoutcast radio, IRC, and ftp to
    non-standard ports. Protocol inspection and analysis could eliminate
    some of this, but would the overhead be worth it? You could do a couple
    things to detect that people were using proxies though. Parse through
    your logs / ip accounting for repeated hits to hosts on port 80 and the
    source ip, have it email you those ips and investigate.

    Mark Bassett
    Network Administrator
    World media company
    Omaha.com
    402-898-2079

    -----Original Message-----
    From: Charles E. Hill [mailto:chill@herber-hill.com]
    Sent: Friday, October 31, 2003 12:36 PM
    To: Earl Keyser
    Cc: full-disclosure@lists.netsys.com
    Subject: Re: [Full-Disclosure] Proxies

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    You can never get around it, as you're aware -- proxies on ports 80, 20,
    21,
    22 or something else really common will always be available.

    However, since you need to show due diligence, you can do the following.

    1. Have the administration set a policy with some teeth. "If you avoid
    the
    proxy, your account gets suspended" or some such.

    2. And I'm not sure how easy this will be... restrict protocols to their
    known
    ports. Configure your firewall to only allow HTTP traffic through Port
    80,
    and not other ports. FTP only through 20 & 21. SSH only through22,
    etc.

    Don't allow HTTP headers through any other port.

    On Friday 31 October 2003 09:20, Earl Keyser wrote:

    - --
    Charles E. Hill
    Technical Director
    Herber-Hill LLC
    http://www.herber-hill.com/

    > Help needed, please.
    >
    > We use all cisco networking gear. Currently using a cisco cache engine
    > with SmartFilter to "manage" the surfing for our staff/students. As
    > usual, the little devils figured a way to get around it.
    >
    > They went to Google, entered "open proxy list" and bingo-bango. From
    > this list they found open proxies to use in IE.
    >
    > Besides suspending them, we made one technological change. Outgoing
    > ports 8000, 8080, 8888 and 3128 are now blocked at the firewall.
    >
    > Can anyone suggest further refinements to reduce this kind of abuse? I
    > know some proxies run on port 80, but I'll have to live with that.
    >
    > TIA
    >
    > Earl
    >
    > Earl Keyser, Network Specialist
    > Wayzata Public Schools
    > 763-745-5105
    >
    > "Unix IS user-friendly. It's just picky about who its friends are."
    >
    >
    > This outbound message has been scanned for viruses by ISD#284.
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE/oquDeljutq/VnacRAhvXAJ0ZHREfG345O+vx/3at6m4g+zjh3wCfYra2
    J34T2QGPXZ9Nn4DWKBiu9/g=
    =hOps
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    ************************************************************
    Omaha World-Herald Company computer systems are for business use only.
    This e-mail was scanned by MailSweeper
    ************************************************************

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Kenneth R. van Wyk: "[Full-Disclosure] Re: Gates: 'You don't need perfect code' for good security"

    Relevant Pages

    • Re: SBS 2003 and Outlook RPC over HTTP issues
      ... , but some of my clients do not want users to ... definitely closed now cause when I open it up http: ... the article is incorrect in stating that port 80 is needed. ... that port 443 and port 80 must be open to use RPC over HTTP. ...
      (microsoft.public.windows.server.sbs)
    • Re: Public Website on SBS 2003
      ... hosting and PROTECTING a website is specialist field and ... As leythos says you need to open HTTP port to the www. ... network settings are on servers internet connections. ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS 2003 and Outlook RPC over HTTP issues
      ... Look in IIS at your Exchweb, Exadmin, exchange-oma, and RPC sites' directory ... Why is it called RPC over HTTP if HTTP is not really needed to be ... As pointed out by others, port 80 does NOT need to be open, and yes, it ... I have about 20 of these SBS machines at other locations and have ...
      (microsoft.public.windows.server.sbs)
    • Re: Help understanding error message
      ... Saravana Kumar [MVP - BizTalk Server] ... Receive port is reported to be HTTP but I don't any see HTTP packets in ... Maybe you set up a two-way send port being directed to a one-way ... Details:"Unable to read data from the transport connection: The ...
      (microsoft.public.biztalk.general)
    • Re: [fw-wiz] tunnel vs open a hole
      ... It does depend on what protocols you are passing through the port or the ... If the protocol is pure HTTP, ... If the protocol is new whizbang multi-media binary with no RFC or complete ... or tunnel over currently open port 80? ...
      (Firewall-Wizards)