Vain. Ed Crowley MCSE+Internet MVP kcCC+I Tech Consultant hp Services Protecting the world from PSTs and Bricked Backups!
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Andy David Sent: Thursday, June 06, 2002 5:27 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp You're so vein, I bet you think the web is about you. -----Original Message----- From: Symon Thurlow [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 8:10 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp A SYN attack renders the IP stack useless (if not the server), so unless your internal users talk to it with IPX or something they will be denied. I mentioned this as an example of why not to directly expose your mailbox server to the world. As many people have rightly mentioned, this particular attack is pretty much isolated by any decent firewall, and I think NT4 service pack 4 or 5 did something towards mitigating it also. However, there are many "Un-documented Features" in operating systems, so the next one could be just around the corner. I wish I had never started talking about this, it is way OT now. Shall we move on? Symon -----Original Message----- From: Ely, Don [mailto:[EMAIL PROTECTED]] Sent: 07 June 2002 00:33 To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp I'm fully aware of what a SYN attack is. That's still not going to kill internal access though it will render external access useless. A SYN attack is a DoS and as Mr Scharff mentioned, if your firewall doesn't block it, you have more troubles to worry about than that. So... It will deny external service, but it will not deny internal. Unless of course, your users are sitting on the public internet of course... -----Original Message----- From: Symon Thurlow [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 5:28 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp No, a successful SYN attack will kill network connectivity totally, not just on TCP port 25. Sure it _may_ not cause the server to crash, but it will deny service to users. Good explanation here: http://www.networkcomputing.com/unixworld/security/004/004.txt.html Symon -----Original Message----- From: Ely, Don [mailto:[EMAIL PROTECTED]] Sent: 06 June 2002 21:45 To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp That's still not going to take the server itself down... Just the receipt of email... Don Ely - NMBOTWBAS and then some [EMAIL PROTECTED] -----Original Message----- From: Symon Thurlow [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 4:45 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp I am no expert on this, but what about a syn attack to port 25? If it worked, it would knock out your Exchange server for anyone who has a mailbox on it, and it is pretty easy to do. Symon -----Original Message----- From: Ely, Don [mailto:[EMAIL PROTECTED]] Sent: 06 June 2002 21:31 To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp You're still missing the point... If you performed what you propose, port 25 is the least of your problems. That would wack your entire external network. That being the case, DMS, no DMZ, firewall, no firewall... If something like that happened the entire network is DoS'd not just port 25. Your theory is not a DoS on port 25, it is a DoS on the network itself. Unless of course, one is lucky enough to have a OC48 or something to the internet... :P Don Ely - NMBOTWBAS and then some [EMAIL PROTECTED] -----Original Message----- From: Cook, Jason [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 4:33 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp Whoa...Don, take it easy. You asked a question, "How can you DoS a mailserver on 25" and I answered. Sure, there's protection against but the fact still remains. Also, what your server can do is totally irrelevant since it's all about your pipe. Jason Cook J.H. Ellwood and Associates Network Administrator [EMAIL PROTECTED] -----Original Message----- From: Ely, Don [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 3:18 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp Ahhh... You bring up good point. 1. Your pipe couldn't handle 100k messages any better than mine. My server itself however, could. And if you "did" do something like that, you'd better be prepared for what's coming back at you. ;o) 2. You'd get all those messages with attachments sent right back to you since I have size restrictions in place. I realize not everyone out there might have the skills I have and I know most of the folks here have at least the skillset I have, so performing any of these ideas on our networks would be the demise of yours... Not to mention, if such a thing happened, more than "just" internet mail would be down. The entire network would be down... -----Original Message----- From: Cook, Jason [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 4:13 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp Don, what if I sent you 100,000 messages at the same time? What if your clients configured no limit to messages and I sent you 1,000 messages with 100mb attachments. Internet mail is down. Explain that to the ceo. Jason Cook J.H. Ellwood and Associates Network Administrator [EMAIL PROTECTED] -----Original Message----- From: Ely, Don [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 2:58 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp How the hell can a server be taken down with a DoS to port 25? You don't open the entire exchange server to the internet, only a dumba$$ would do that. All that is required for exchange having external access is port 25. Your theory suggests someone would actually open the entire server up to the world. As a side note, if I want to DoS you, I'm not going to "just" pick your mail server, I'm going to pick your entire network. Don Ely - NMBOTWBAS and then some [EMAIL PROTECTED] -----Original Message----- From: Jon Butler [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 3:53 PM To: Exchange Discussions Subject: RE: lesser of the evils - ssl or smtp Andy & Chris -- I guess our needs here are somehwat different, perhaps. We don't use Exchange in the DMZ (that's ridiculous overkill) but we do have relays out there ... and we lock 'em down to specific ports internally as well. I disagree that it would be "just as harmful as in the DMZ", though ... perform a DoS on a box in the DMZ, you only kill communications through that one box. DoS the Exchange Server, bam -- you just lost ALL email services. Granted, we've got more systems to support, but that's the price we pay for the security and redundancy that comes with it. And Chris, you asked to "demonstrate an exploit" ... we prefer to not wait for one to be demonstrated, but rather do the best we can to preemptively protect ourselves before one is found: use relays in the DMZ, and mix relay products so what exploits one may not be expoitable on another. Have different flavors of antivirus protection at the relay, Exchange, and at the client. Like I said before though, it ain't right for everybody ... it takes some bank to make it happen. Our requirements here are a little more anal than others'. Jon > -----Original Message----- > From: Webb, Andy [mailto:[EMAIL PROTECTED]] > Sent: Thursday, June 06, 2002 3:38 PM > To: Exchange Discussions > Subject: RE: lesser of the evils - ssl or smtp > > > On specific ports? Sure, why not? > > I'd allow 443 to an inside box. It requires authentication and it's > encrypted. Any vulnerability in the application itself would be just > as harmful in the DMZ. > > I'd allow 25 to an inside box. The endpoint is a system that accepts > the mail and scans it for viruses and malicious content. Any > vulnerability in the application would be almost as harmful in the > DMZ. > > As it stands I have half the number of systems to secure in my design > as you do in yours. If we both block 98% of the vulnerabilities on > those systems, you're less secure. I contend that I can do better > than you given fewer systems to focus on. > > Now, I'm not saying that there aren't good uses for a DMZ. There are. > Exchange just isn't one of them. > > -----Original Message----- > From: Jon Butler [mailto:[EMAIL PROTECTED]] > Posted At: Thursday, June 06, 2002 1:53 PM > Posted To: Microsoft Exchange > Conversation: lesser of the evils - ssl or smtp > Subject: RE: lesser of the evils - ssl or smtp > > > So you'd allow "from any" to your inside boxes? That would keep me > awake at night. :) > > > > -----Original Message----- > > From: Webb, Andy [mailto:[EMAIL PROTECTED]] > > Sent: Thursday, June 06, 2002 2:47 PM > > To: Exchange Discussions > > Subject: RE: lesser of the evils - ssl or smtp > > > > > > but you're not talking about a good use of the DMZ. the > DMZ should be > > an end point, not a hop. it doesn't really matter where your SMTP > > virus scanner sits - you should have one, I agree. but on the DMZ > > doesn't really make much difference based on your loose > restrictions > > between the DMZ and the LAN. > > > > OWA also doesn't make much difference. you have to open up rpc > > traffic from the DMZ to the LAN. might as well keep the DMZ more > > secure and put OWA inside. relative security of the LAN is > about the > > same. > > > > now, if you want to discuss multiple physical DMZ segments, perhaps > > it's more interesting, but not much. > > > > there's quite a lot of this discussion in the archives, by > the way. > > no new arguments so far. so, if you want to jump forward > to the end > > of the discussion, look back a couple years. > > > > ======================================================= > > Andy Webb [EMAIL PROTECTED] www.swinc.com > > Simpler-Webb, Inc. Austin, TX 512-322-0071 > > -- Eating XXX Chili at Texas Chili Parlor since 1989 -- > > ======================================================= > > > > > > -----Original Message----- > > From: Jon Butler [mailto:[EMAIL PROTECTED]] > > Posted At: Thursday, June 06, 2002 1:30 PM > > Posted To: Microsoft Exchange > > Conversation: lesser of the evils - ssl or smtp > > Subject: RE: lesser of the evils - ssl or smtp > > > > > > Perhaps I shouldn't have used the term "rule", but rather > perhaps "a > > good security practice." It's better to let the kiddies > play with a > > hardened DMZ bastion then your production Exchange Server ... but I > > also understand that's often not feasible for smaller companies. A > > good security paradigm can take some dough. > > > > > > > -----Original Message----- > > > From: Cook, Jason [mailto:[EMAIL PROTECTED]] > > > Sent: Thursday, June 06, 2002 2:18 PM > > > To: Exchange Discussions > > > Subject: RE: lesser of the evils - ssl or smtp > > > > > > > > > Seems a little rash mr. butler, a lot of small companies use the > > > scenario presented by Rob Ellis originally. A firewall, a good > > > hardware one anyway is great protection if used effectively. OWA > > > with ssl is a good and secure solution, so I'm curious as > to why you > > > > believe that it's a "rule" to use a dmz? > > > > > > > > > Jason Cook > > > J.H. Ellwood and Associates > > > Network Administrator > > > [EMAIL PROTECTED] > > > > > > > > > -----Original Message----- > > > From: Rob Ellis [mailto:[EMAIL PROTECTED]] > > > Sent: Thursday, June 06, 2002 1:06 PM > > > To: Exchange Discussions > > > Subject: RE: lesser of the evils - ssl or smtp > > > > > > No, not remote users, server smtp traffic. > > > > > > We are proposing citrix full desktop, OWA for some remote > users, no > > > POP/smtp access for end users. > > > > > > The Webshield I mentioned is as you say, part of TVD. > > > > > > Our design sounds very much like your setup. > > > > > > > > > Regards, > > > > > > > > > Rob Ellis > > > > > > -----Original Message----- > > > From: Mellott, Bill [mailto:[EMAIL PROTECTED]] > > > Sent: 06 June 2002 18:49 > > > To: Exchange Discussions > > > Subject: RE: lesser of the evils - ssl or smtp > > > > > > Ill throw in .02 > > > > > > Assuming you are referring to allowing remote users to get their > > > e-mail. > > > > > > I'm doing the OWA thing for "remote/roaming" users. > > > I do some Citrix for full desktops. > > > I do NOT allow users to connect to the exch box at this time via > > > SMTP/POP. > > > > > > I do at this time use the Simple Webshield product > bundled with the > > > NIA/Mcafee TVD suite. It does reside on it's own machine. > > > so Internet smtp > webshield > Exch. > > > yes the webshield sit's before Exch box. > > > Yes it provides me with an additional layer of pre exch virus > > > protection...works ok yes it also provides some prefiltering on > > > attachments...sucks...does not go any deeper the first level i.e. > > > FWD> FWD it will miss. > > > Note: Their full blown product webshield APP is supposed to work > > > well..no exp with it, Ill keep my opinions to myself.. > > > > > > If I had to let user(s) directly get to either port 110/POP and > > > port25/smtp to do their e-mail... > > > 1.) I would not ..thats me.. > > > 2.) Forced too only via some secure connection like a VPN. > > > > > > bill > > > > > > PS for those interested I run the AV product to at the file level > > > and scan all files on the exchange box with no exceptions. > > > ;-) > > > > > > -----Original Message----- > > > From: Bendall, Paul [mailto:[EMAIL PROTECTED]] > > > Sent: Thursday, June 06, 2002 1:38 PM > > > To: Exchange Discussions > > > Subject: RE: lesser of the evils - ssl or smtp > > > > > > > > > Okay I'll add another spanner to your works, I would > advise an SMTP > > > relay server on your DMZ but I really wouldn't use McAfee > Webshield. > > > > Why I hear you cry for one it is pretty bad at blocking > viruses and > > > two we have had no end of problems with it crashing or > not sending > > > to certain domains when it gets a DAT update. Why not use > the SMTP > > > component of IIS as your SMTP relay server and then use > ScanMail or > > > Antigen on your Exchange server. Either that or use someone like > > > MessageLabs to outsource your antivirus too. > > > > > > Regards, > > > > > > Paul > > > > > > -----Original Message----- > > > From: Rob Ellis [mailto:[EMAIL PROTECTED]] > > > Sent: 06 June 2002 18:26 > > > To: Exchange Discussions > > > Subject: lesser of the evils - ssl or smtp > > > > > > > > > Ok, I've got a couple of scenarios, which of them is the > > least risky? > > > > > > Exchange 2000 mailbox server on the LAN, accepting/making > > > connections using SMTP through a firewall to the internet > > > > > > Exchange 2000 mailbox server on the LAN, accepting SSL secured OWA > > > connections from the internet, again, protected by a firewall. > > > > > > > > > Basically I am being told I may have to do both with the same box, > > > but I'd rather have the smtp traffic going through a DMZ based > > > gateway running McAfee Webshield, and let the OWA clients > come into > > > the internal box over SSL (which I see as less of a risk than > > > opening up port 25. > > > > > > If you had to choose one of the 2 above scenarios, which > > would it be? > > > > > > Regards, > > > > > > Rob Ellis > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > > > > > > > ---------------------------------------------------------------------- > > > If you have received this e-mail in error or wish to read > our e-mail > > > > disclaimer statement and monitoring policy, please refer to > > > http://www.drkw.com/disc/email/ or contact the sender. > > > > > > ---------------------------------------------------------------------- > > > > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Archives: http://www.swynk.com/sitesearch/search.asp > > To unsubscribe: mailto:[EMAIL PROTECTED] > > Exchange List admin: [EMAIL PROTECTED] > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Archives: http://www.swynk.com/sitesearch/search.asp > > To unsubscribe: mailto:[EMAIL PROTECTED] > > Exchange List admin: [EMAIL PROTECTED] > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] ------------------------------------------------------------------------ ------ The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. ======================================================================== ====== _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
