Tack
join:2007-10-23
Waterloo, ON | reply to shepd
Re: Argg.... UCEPROTECT... very frustrating! said by shepd:It should be optional, preferably opt-IN*. And no blocks on anything outside of port 25. If you can't use your computer responsibly, that's your problem. Unfortunately reality isn't quite this simple. The way RBLs tend to operate, if you can't use your computer it often is my problem.
Blocking outbound 25 for dynamic IPs is a simple measure that can drastically reduce the chance of a bunch of infected Windows hosts preventing my ability to send mail to my mother.
If you couldn't opt-out, I could understand being opposed to this. I think TSI's proposal is sensible, responsible, and effective. |
|
Corm
join:2008-12-09
Canada | reply to R0CKY
First I have to say I'm a little unbiased here as I don't have port 25 open, but I dont want any restrictions imposed upon me, that's why we're here (partially), right?
From a network management perspective blocking a port is a quick and dirty fix which I'm not totally opposed to provided that there is an opt out. I've been in the network game and have seen the amount of Infected PC's and Open relays that can cause havoc on a network.
My ideal solution would be IDS, target port 25, look for virus signatures, flag those accounts to be provisioned on a special subnet.
Or even some sort of manual audit process to find open relays, that's probably just as big of an issue as the viruses. |
|
| reply to R0CKY
I'm just like most of the users that came here because Teksavvy does not block any ports. Their proposal to block ports is okay in my opinion as they have great people that work for their ISP. Anyone that doesn't know to ask for port 25 to be unblocked probably doesn't need it unblocked. On the other hand, if you call in to get port 25 unblocked, they have knowledgeable staff at Teksavvy that can get the job done in a matter of minutes. This isn't any other ISP, who would say "port 25?? why do you need it unblocked?", this is Teksavvy and they will say "Okay, done."
Go for it Rocky / Marc, you have my vote. (not that it means anything..) |
|
|
|
| reply to fcisler
said by fcisler:These ports (135, 139, 445) should NEVER be routed out of a LAN. It's absolutely one of the worst ideas. Security wise, you have opened yourself up to a HUGE hole. I would seriously be surprised if your machines aren't infected. You really do need a VPN....your domain controller should never be published directly to the internet. I can remember when you could map network drives from microsoft.com... great for Windows software.
I can remember when I could add printers of random people and print off silly messages ... great for fun.
 |
|
