wingman8
join:2000-12-05
San Jose, CA
clubs:
| Norton AV listens on POP3 port
FYI, Norton AV 2001 listens on POP3 (TCP port 110) if you enable email protection. You can see POP3 listening with the netstat -a command (in Win2k at least).
I was experimenting with inexpensive email servers (specifically FTGate from »www.floosietek.com, a strange name but a decent product at least on first inspection, and WorkgroupMail from »www.workgroupmail.com.) I was able to get SMTP to work great, but nothing from POP3. I could connect to POP3 locally, but it kept refusing my username. When I enabled detailed logging on FTGate I saw the POP3 server wasn't able to load because the port was already in use! Took me some time to track it down to Norton AV email protection.
Maybe sharing this will save someone else a bit of frustration.
BTW, I was loading an email server so I could have my SonicWALL firewall send email alerts directly to my PC instead of via my ISP email. However, I'm headed down a different path now and looking into writing my own utility to grab data from the SonicWALL via SMTP directly and display it in a useful format.
|
|
Anon | There are instructions at Symantec's website on how to Stealth port 110. I'm sure you can find them by doing a search. |
|
magicpro1
join:2000-10-05
Westmont, IL |  reply to wingman8
Ummmm.....so what? Does this represent somewhat of a vulnerability? Please advise.  |
|
magicpro1
join:2000-10-05
Westmont, IL
|  reply to wingman8
Never mind, I found it. Here's the link to the Symantec Bulletin. Email Port Patch
It seems that Symantec issued a patch back on 12/27/99 that automatically closes Port 110. This patch auto loads when you run Live Update. So, as long as you have run Live Update in the last year or so, it's all good!! |
|
Kalford
Seems To Be An Rtfm Problem.
Premium,MVM
join:2001-03-20
Ontario
| reply to wingman8
I am currently running A Winproxy ( »www.Ositis.com ) as a firewall with InternetAnywhere Email Server (www.tns.com Software). I ran into similar problems in configuring them on the same server but was able to get around this by remapping the ports so that the proxy server uses 25 (outgoing) and 110 for pop3 while the email server uses 8025 and 8110 to pass thru the proxy.
You may find you have to do something similar to this, as Norton anti-virus takes on the role of proxy server when you activate the Email Scanning option. Probably just port 110 that will need remapping as I do not believe that AV does anything with outgoing mail. |
|
wingman8
join:2000-12-05
San Jose, CA
clubs:
| reply to wingman8
I believe Migliore and Magicpro missed the point of my post:). I'm not looking for help with the the open POP3 (I'm behind a hardware firewall after all...), and not looking for how to close it. (BTW, my last LiveUpdate was 3/23/01. This is NAV 2001, not 2000, so looks like the fix didn't carry over. I'll email Symantec.) What I WAS trying to do is save someone else the time I wasted debugging this. The cause wasn't immediately obvious since the POP3 port was responding, but not acknowledging my username. Kalford got the idea, and gives a workable solution (I used 3110 for my second POP3).
|
|
sadowski
I Am My Own Doppelganger
Premium,MVM
join:2000-04-14
Buffalo, NY
clubs:
| reply to wingman8
I don't remember the details but check how it setup your email client. It uses something like real-pop-host-alias\userid instead of just userid.
I had to unistall the thing anyway. It would stall from time to time looking like the real pop servers were down when they weren't. In other words, if you start getting intermitent can't connect to pop host messages, start suspecting Norton. |
|
CyberStretch
join:2000-11-23
Worcester, MA
|  FWIW, Norton adds entries to the host file to accomplish this:
127.0.0.1 pop3.norton.antivirus # Added by Norton AntiVirus for e-Mail scanning
127.0.0.1 pop3.spa.norton.antivirus # Added by Norton AntiVirus for e-Mail scanning
--
If man can think it, man can achieve it... |
|
