Re: TCPIP port restriction for network security

["L. S. Russell" <leslier@xxxxxxxxxx>]

LOL!  I heard someone once say that he thought there should be servers
out there left wide open so that the kiddies could hack them all they
wanted to.  These servers would be such tasty treats, like a goat used
to bait a lion trap, that the wannabe hackers would waste all their time
there.  It might work, never know.

Larry Bolhuis wrote:
> 
> I didn't mean to imply that you shouldn't open 25, or 110, rather that
> as your pointed out, IF they are open you should take steps to make them
> as secure as possible. If you don't want to open ANY ports, just unplug
> the firewall!
> 
>  - Larry
> 
> "L. S. Russell" wrote:
> >
> > IF you are doing mail relay then ports 25 and 110 have to be open to
> > each box that you will relay from.  For an ISP that means just about all
> > of them.  There are things you can do to protect yourself even if you
> > leave 25 and 110 wide open.  Disable EXPN and RPLY, alter the sendmail
> > rules so that the FROM addy must resolve to a valid user id...  Ditch
> > sendmail and replace it with qmail.
> >
> > Larry Bolhuis wrote:
> > >
> > > Opening ports always creates a security risk, even well know ones like
> > > 25, 80, 110. What you need to do is balance the need for the port to be
> > > opened with the relative exposure.  Often you can open the port to only
> > > specific machines thus reducing the risk. When opening a port across the
> > > board, you should have a very good understanding of what that port is
> > > used for. If there are multiple uses and an open system is using one
> > > different from that intended, that is a much greater risk.
> > >
> > > Personally I prefer chat tools which do not require open inbound ports
> > > like AOL Instant messenger, or ICQ.
> > >
> > >  my $.02
> > >
> > >  - Larry
> --
> Larry Bolhuis
> Arbor Solutions, Inc.
> (616) 451-2500
> (616) 451-2571 -fax
> lbolhuis@arbsol.com
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---