Re: TCPIP port restriction for network security

[Larry Bolhuis <lbolhuis@xxxxxxxxxx>]

I didn't mean to imply that you shouldn't open 25, or 110, rather that
as your pointed out, IF they are open you should take steps to make them
as secure as possible. If you don't want to open ANY ports, just unplug
the firewall!

 - Larry

"L. S. Russell" wrote:
> 
> IF you are doing mail relay then ports 25 and 110 have to be open to
> each box that you will relay from.  For an ISP that means just about all
> of them.  There are things you can do to protect yourself even if you
> leave 25 and 110 wide open.  Disable EXPN and RPLY, alter the sendmail
> rules so that the FROM addy must resolve to a valid user id...  Ditch
> sendmail and replace it with qmail.
> 
> Larry Bolhuis wrote:
> >
> > Opening ports always creates a security risk, even well know ones like
> > 25, 80, 110. What you need to do is balance the need for the port to be
> > opened with the relative exposure.  Often you can open the port to only
> > specific machines thus reducing the risk. When opening a port across the
> > board, you should have a very good understanding of what that port is
> > used for. If there are multiple uses and an open system is using one
> > different from that intended, that is a much greater risk.
> >
> > Personally I prefer chat tools which do not require open inbound ports
> > like AOL Instant messenger, or ICQ.
> >
> >  my $.02
> >
> >  - Larry
-- 
Larry Bolhuis
Arbor Solutions, Inc.
(616) 451-2500
(616) 451-2571 -fax
lbolhuis@arbsol.com
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---