Re: how to block ALL AIM traffic ?

From: Gabriel Orozco (gabriel_orozco_at_mx.sumida.com)
Date: 04/27/05

  • Next message: Scott Schwendinger: "Re: Secure web site access and PKI Certs" 
    To: "Realized Mofo" <realized@gmail.com>, <security-basics@securityfocus.com>
Date: Wed, 27 Apr 2005 16:19:18 -0500

    Maybe if you sniff a AIM connection

    you can check if they are using a MIME type or a string to Authenticate

    then you can filter it on the firewall. not all the ports, but the
    communication itself.

    I use linux for the firewall and open only port 80 using Squid proxy +
    squidGuard. it works well, but I have no user with AIM due to policy.

    if any user tries to pass over the policy and install AIM, I would try to do
    what I already wrote.

    Regards

    Gabriel Orozco
    Sysadmin

    ----- Original Message -----
    From: "Realized Mofo" <realized@gmail.com>
    To: <security-basics@securityfocus.com>
    Sent: Tuesday, April 26, 2005 6:32 PM
    Subject: how to block ALL AIM traffic ?

    I am at an office with 50~ machines , out of thoes about 20 or so use
    AIM. I would like to block AIM and normally i'd just block the AIM
    port (5190) or whatever it is..

    BUT AOL seems to have found a great way around this and has 4000+
    diffrent ports they use and i'd assume lots of diffrent hosts.

    Whats the best way of blocking all AIM traffic ?

  • Next message: Scott Schwendinger: "Re: Secure web site access and PKI Certs"

    Relevant Pages

    • Re: Denying Users access to Instant Messenger
      ... to find and use other ports that are difficult to block, ... In addition to blocking those ports, blocking AIM is usually done by ... in case they ever change the server IP addresses. ... >> users from being able to connect to MSN Messenger and AOL ...
      (microsoft.public.inetserver.iis.security)
    • Re: how to block AIMEXPRESS in a domain
      ... I'd first want to block it using a firewall. ... the ports commonly used by AIM, but because it can also use TCP 80 and other ... Search www.google.com for something like "block aim ... is there anything in domain group policy? ...
      (microsoft.public.win2000.security)
    • Re: Denying Users access to Instant Messenger
      ... AIM and other messenger software have been ... > to find and use other ports that are difficult to block, ... in case they ever change the server IP addresses. ... >>> users from being able to connect to MSN Messenger and AOL ...
      (microsoft.public.inetserver.iis.security)
    • Re: N00b Question
      ... There is a great product called packet shaper by packetteer. ... AIM, iTunes, etc... ... ports and IP's this device will detect it. ... > For MSN/yahoo chat you can block the ports in your external firewall. ...
      (Security-Basics)
    • Re: Security reasons to block hotbar.com ?
      ... I don't care how much kaaza, aim or others like to ... > AIM ports, but AIM can use other common ports like TCP 80. ... > firewall logs for a week or so to see which ports are being used. ... what would be the best way to block spyware? ...
      (microsoft.public.security)