Re: Kazaa Block !

From: hazard (platon@hazard.gr)
Date: 11/29/02


From: "hazard" <platon@hazard.gr>
Date: Fri, 29 Nov 2002 10:21:13 +0200


> What the world?
> Are you the net admin?
> First off, if this is a work LAN, and you're the admin, uninstall all
KaZaA
> from all computers and tell your boss what is going on: that this is a
mild
> security breach, but worse, it is a blatant abuse of work computers.
Then,
> block all dynamic ports (1024-65535) both in and out, if you're brave, or
> just re-setup the firewall to only allow in what you want in: i.e. http,
> etc. If they don't need to download, you can safely disable ftp. The
best
> method is block everything, then only allow what is absolutely needed to
do
> their job. Period. No matter how old your users are at work, they will
> always act like children -- they will try to get away with whatever they
> can, somehow thinking that their work computer belongs to them. Blame
> Microsoft for starting the psychology of "MY documents", "MY email", "MY
> music", etc lol.
> If this is a home LAN, and these are your children, ground them first,
then
> block KaZaA from their computers, using password protection and/or windows
> 2000 user priveleges. However, being a home LAN, there's not much you can
> do, but security also isn't a big deal, although it should at least be
> implemented.
>

It's the lan on the work. I have already blocked everything, perimiting only
http and some https they need BUT the newest version of kazza have an option
which says that if the client can not connect on the specific port, then it
goes over port 80. So, i'm trying to to figure if the client connects first
to a kazaa server (which port) and then to the other client to
download/upload. On the firewall log i found only the rr1.kazaa.com on port
80 which is the first page of kazaa and the the connections to the other
clients, all in port 80. The solution i provided with the ports 1214 & 3306
is working but after an hour or so it connects !!

Even if i uninstall the software, even if i tell it to my boss nothing will
happen. It's a software company, everyone here is a programmer or a
marketing/sales etc man and only one IT person. They believe that the IT man
is useless because he doesn't produce something and he doesn't brings money
to company. But he is responsible if the secretary pc is full of viruses and
trojans, he is responsible if the mouse of another secretary doesn't work
and other stupid things !!!
So, i prefer to be the bad guy by blocking the ports/domains and not be the
bad guy by uninstalling software and talking to boss.
Sad but true....



Relevant Pages

  • Re: pf and ftp from gateway
    ... # ephemeral port, so that the remote SIP proxy knows what session we belong ... pass in quick on $ext_if inet proto udp from any port bootps to ... pass out quick on $ext_if inet proto udp from $ext_if to any port bootps ... # allow lan requests from lan clients to exit EXT ...
    (comp.unix.bsd.openbsd.misc)
  • active ftp
    ... Does anyone have a pf config for active ftp? ... # Redirect lan client FTP requests ... # to the ftp-proxy running on the firewall host (via inetd on port 8021) ... rdr on $int_if inet proto tcp from $int_if:network to any port www -> ...
    (comp.unix.bsd.openbsd.misc)
  • Re: Remote desktop & Netgear router
    ... if you can connect to the PC from another PC using the "private LAN IP address" over your ... local LAN then Remote Desktop is obviously setup right and working. ... The issue then is the port forwarding on the router. ...
    (microsoft.public.windowsxp.work_remotely)
  • pftpx failing on freebsd 5.4-stable
    ... I'm trying to get ftp working from my lan to the internet. ... # when being port scanned. ... pass in quick on $ext_if inet proto udp from $isp_dhcp_server port bootps to ...
    (freebsd-net)
  • Re: Kazaa Block !
    ... >> security breach, but worse, it is a blatant abuse of work computers. ... >> If this is a home LAN, and these are your children, ground them first, ... >> block KaZaA from their computers, ... > goes over port 80. ...
    (comp.security.firewalls)