Brute-force and IIS/w2k logs

2003-04-02 Thread Cushmeer, Barnar
Hello, I've just reviewed a short range of security logs on a W2k/IIS box and there is an over abundance of repeated invalid login attempts. The attempts seem to focus on weak user ids (ie; admin, administrator, root, sql, etc.). However I've seen a few successful anonymous

RE: Email Encryption Between Servers

2003-04-02 Thread Craig Humphrey
Some people have already mentioned using various forms of VPN, but there are also other products that either plug-in to Exchange 2000, or act at a gateway between Exchange and the Internet. We use MailMarshal from Marshal Software (recently acquired by NetIQ), which is a great product, supporting

RE: Win2000 Directory Permissions

2003-04-02 Thread Chris Berry
From: Sander de Rijk [EMAIL PROTECTED] I would say change EVERYTHING to admin+system full control and users instead of everyone read permissions. Besides that change the repair indeed to no access for the users. No need for power users. No need for creator owner. The documents and settings folder

RE: Email Encryption Between Servers

2003-04-02 Thread Michael Osten
On Tue, 2003-04-01 at 11:27, Robinson, Sonja wrote: We evaluated three enterprise solutions and bid them out. I believe that once e-mail leaves your network using exchange it is automatically sent clear text, hence the need for encryption. I am not an exchange administrator so... And if you

RE: Email Encryption Between Servers

2003-04-02 Thread Dr. S. A. Vetha Manickam
Hi, Even though IPSec enabled communication between two mail servers, there are some PKI based solutions called Secure Email Gateway from Baltimore, which just meets your requirements. There may be some more products from other PKI vendors. --- Michael Leigh [EMAIL PROTECTED] wrote: I think

Hardware vs Software Firewall/Router

2003-04-02 Thread nsm
I work for a consulting company that services businesses with 30 to 200 clients. Our IT Manager likes to use a Linksys, or a 3Com hardware firewall solution. He is also thinking of introducing the Symantec Raptor (I could be incorrect on the name) software solution. We are mostly a windows

Legislation on employee monitoring

2003-04-02 Thread Trevor Cushen
There has been a bit of publicity lately that new EU legislation would make it illegal to monitor email content, run an IDS system and watch web activity. I have looked through the various acts in place but cannot see anything specific. Has anyone heard more or does anyone have a few URLs that

Re: USB port access protection

2003-04-02 Thread Theodoros Charalabidis
In-Reply-To: [EMAIL PROTECTED] Hi there. SECTION A 1.Look for the usbstor.sys file under \winnt\system32\drivers directory.If this file exists that means you had installed a USB driver sometime in the past and you have to go to section B.Otherwise go to step 2. 2.Right click on the

RE: Email Encryption Between Servers

2003-04-02 Thread PWBakker
All of the suggestions on the list for Point to Point VPNs creating partner extranets are excellent suggestions, however you need to make sure the same level of diligence and security is maintained on your partners networks. You would also explicitly deny and/or allow traffic only to a

RE: Email Encryption Between Servers

2003-04-02 Thread White-Tiger
Just another .2$ in the ports there is pgpsendmail. Havn't tried it yet, but what that will do for you is automagicly pgp encrypt and decrypt email for anyone that you have there public key in your keyring. that way the users do not have to worry about it. also. look into sendmail's TLS that

FW: Email Encryption Between Servers

2003-04-02 Thread check
-Original Message- From: Michael Osten [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 01, 2003 4:53 PM To: [EMAIL PROTECTED] Subject: RE: Email Encryption Between Servers On Tue, 2003-04-01 at 11:27, Robinson, Sonja wrote: We evaluated three enterprise solutions and bid them out. I

RE: Legislation on employee monitoring

2003-04-02 Thread Moeckel, Sharon
If anyone does have info on this thread, not just EU legislation, but US as well, please include me in your reply. Many Thanks, Sharon Bucks County, PA -Original Message- From: Trevor Cushen [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 02, 2003 4:23 AM To: [EMAIL PROTECTED] Subject:

RE: Email Encryption Between Servers

2003-04-02 Thread Michael Leigh
Also, keep in mind local security policies in Windows 2000 allow for IPSEC traffic. If they other end points are linux boxes you can implement IPSEC box to box traffic as well. It is my opinion though that this put's a lot of load on systems that already can get overloaded quickly. I typically

Re: Legislation on employee monitoring

2003-04-02 Thread Jacob
They should also include firewalls and Cisco ACLs. EU better not complain when their systems are compromised... At 10:22 AM 4/2/2003 +0100, you wrote: There has been a bit of publicity lately that new EU legislation would make it illegal to monitor email content, run an IDS system and watch web