Text 311, 128 rader
Skriven 2004-08-12 08:49:48 av Ellen K. (1:379/45)
    Kommentar till text 299 av Robert Comer (1:379/45)
Ärende: Re: further re FTP security
===================================
From: Ellen K. <72322.enno.esspeeayem.1016@compuserve.com>

Yes, that was in my mind but I didn't write it!   Good that you reminded
me, I would probably have forgotten to put it in my recommendations -- thanks. 
 :)

On Wed, 11 Aug 2004 16:06:27 -0400, "Robert Comer"
<bobcomer_removeme@mindspring.com> wrote in message
<411a7a8f$1@w3.nls.net>:

>> No, we have an ftp server and apparently all our call center clients are
>> using it.
>
>Okay, I thought you were just doing client side -- but like I said,
>restricting the IP address and virus scanning is probably enough, though I
>wonder if you have anonymous FTP -- I would require a valid user ID and
>password...
>
>- Bob Comer
>
>
>"Ellen K." <72322.enno.esspeeayem.1016@compuserve.com> wrote in message
>news:rptkh0hq8hlucc4ljrkq79s0rc2s0gpiij@4ax.com...
>> No, we have an ftp server and apparently all our call center clients are
>> using it.
>>
>> On Wed, 11 Aug 2004 13:40:26 -0400, "Robert Comer"
>> <bobcomer_removeme@mindspring.com> wrote in message
>> <411a5855@w3.nls.net>:
>>
>>>> I guess the ideal would be encrypt the files with PGP, and restrict
>>>> traffic on the FTP port to the IP addresses of our FTP partners during
>>>> each one's prearranged timeslot.  But even if I can only get the first
>>>> two that wouldn't be bad, right?
>>>
>>>I would be comfortable with that.  I'd virus scan as you mentioned before,
>>>but I don't have as much problem with FTP as some of the other people
>>>here,
>>>especially if all you are doing is the client side. (I have the server
>>>side
>>>here.)
>>>
>>>- Bob Comer
>>>
>>>
>>>"Ellen K." <72322.enno.esspeeayem.1016@compuserve.com> wrote in message
>>>news:pujkh01lspktl0vbvduf7rtdffjuhssg8u@4ax.com...
>>>> Well...
>>>>
>>>> I guess the ideal would be encrypt the files with PGP, and restrict
>>>> traffic on the FTP port to the IP addresses of our FTP partners during
>>>> each one's prearranged timeslot.  But even if I can only get the first
>>>> two that wouldn't be bad, right?
>>>>
>>>> (I don't have time to figure out and write the script and I don't think
>>>> anyone else here would be able to.)
>>>>
>>>> On Wed, 11 Aug 2004 12:19:35 -0400, "Robert Comer"
>>>> <bobcomer_removeme@mindspring.com> wrote in message
>>>> <411a4560$1@w3.nls.net>:
>>>>
>>>>>>Do you happen to know if the Cisco
>>>>>> Pix firewall supports this?
>>>>>
>>>>>No, I don't, We use a Watchguard firewall, and fwiw, it can't do time
>>>>>filtering with the FTP proxy. (Only with the HTTP proxy.)
>>>>>
>>>>>The scripting for time blocking would be just as easy to do, it's just a
>>>>>bit
>>>>>snarky looking.
>>>>>
>>>>>- Bob Comer
>>>>>
>>>>>
>>>>>"Ellen K." <72322.enno.esspeeayem.1016@compuserve.com> wrote in message
>>>>>news:ftekh0l9aklm1f567o2t6qlqbb5v3e8m7f@4ax.com...
>>>>>>A time filter on the firewall was what I had in mind, why make things
>>>>>> more complicated than necessary.   Do you happen to know if the Cisco
>>>>>> Pix firewall supports this?
>>>>>>
>>>>>> On Wed, 11 Aug 2004 08:48:45 -0400, "Robert Comer"
>>>>>> <bobcomer_removeme@mindspring.com> wrote in message
>>>>>> <411a1431$1@w3.nls.net>:
>>>>>>
>>>>>>>> In Linux, at least, that would be almost trivial - a cron job to
>>>>>>>> rewrite iptables.
>>>>>>>
>>>>>>>It'd be just as easy on Windows as well (using scheduled jobs and
>>>>>>>scripted
>>>>>>>route commands), but I think most decent firewalls have time filters
>>>>>>>available.
>>>>>>>
>>>>>>>- Bob Comer
>>>>>>>
>>>>>>>
>>>>>>>"Tim Boyer" <tim@denmantire.com> wrote in message
>>>>>>>news:a8uih0h1754tt2ggp43b7kc027744mfgnf@4ax.com...
>>>>>>>> On Mon, 09 Aug 2004 20:52:59 -0700, Ellen K.
>>>>>>>> <72322.enno.esspeeayem.1016@compuserve.com> wrote:
>>>>>>>>
>>>>>>>>> I'm intrigued by this last one, is it possible to
>>>>>>>>>configure the firewall to restrict this port not only by IP address
>>>>>>>>>but
>>>>>>>>>also by day and/or time?   I.e., can we say "allow incoming from
>>>>>>>>>xxx.xxx.xxx.xxx daily between 3:55 and 4:05 p.m.", "allow outgoing
>>>>>>>>>to
>>>>>>>>>yyy.yyy.yyy.yyy daily between 11:45 and 11:55 p.m."?
>>>>>>>>
>>>>>>>> In Linux, at least, that would be almost trivial - a cron job to
>>>>>>>> rewrite iptables.
>>>>>>>>
>>>>>>>> In other version of Unix... somewhat harder.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>> Tim Boyer
>>>>>>>> tim@denmantire.com
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)