Full Disclosure mailing list archives
RE: Proxies
From: "Bassett, Mark" <mbassett () omaha com>
Date: Fri, 31 Oct 2003 14:41:38 -0600
Doesn't matter, you can still set up a squid http proxy on port 80 and funnel everything through it. Web traffic will appear through port 80. If you analyzed the protocols, and made sure nothing but http traffic was going through port 80 you would eliminate using other apps through the port 80 proxy, but you cannot eliminate a port 80 http proxy for http traffic. You could set a policy in your domain to restrict proxy settings, but a user could always use a different browser (group policy only effects IE) Currently I use a squid http proxy on port 80 to bypass my own firewall to listen to shoutcast radio, IRC, and ftp to non-standard ports. Protocol inspection and analysis could eliminate some of this, but would the overhead be worth it? You could do a couple things to detect that people were using proxies though. Parse through your logs / ip accounting for repeated hits to hosts on port 80 and the source ip, have it email you those ips and investigate. Mark Bassett Network Administrator World media company Omaha.com 402-898-2079 -----Original Message----- From: Charles E. Hill [mailto:chill () herber-hill com] Sent: Friday, October 31, 2003 12:36 PM To: Earl Keyser Cc: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] Proxies -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 You can never get around it, as you're aware -- proxies on ports 80, 20, 21, 22 or something else really common will always be available. However, since you need to show due diligence, you can do the following. 1. Have the administration set a policy with some teeth. "If you avoid the proxy, your account gets suspended" or some such. 2. And I'm not sure how easy this will be... restrict protocols to their known ports. Configure your firewall to only allow HTTP traffic through Port 80, and not other ports. FTP only through 20 & 21. SSH only through22, etc. Don't allow HTTP headers through any other port. On Friday 31 October 2003 09:20, Earl Keyser wrote: - -- Charles E. Hill Technical Director Herber-Hill LLC http://www.herber-hill.com/
Help needed, please. We use all cisco networking gear. Currently using a cisco cache engine with SmartFilter to "manage" the surfing for our staff/students. As usual, the little devils figured a way to get around it. They went to Google, entered "open proxy list" and bingo-bango. From this list they found open proxies to use in IE. Besides suspending them, we made one technological change. Outgoing ports 8000, 8080, 8888 and 3128 are now blocked at the firewall. Can anyone suggest further refinements to reduce this kind of abuse? I know some proxies run on port 80, but I'll have to live with that. TIA Earl Earl Keyser, Network Specialist Wayzata Public Schools 763-745-5105 "Unix IS user-friendly. It's just picky about who its friends are." This outbound message has been scanned for viruses by ISD#284. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE/oquDeljutq/VnacRAhvXAJ0ZHREfG345O+vx/3at6m4g+zjh3wCfYra2 J34T2QGPXZ9Nn4DWKBiu9/g= =hOps -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ************************************************************ Omaha World-Herald Company computer systems are for business use only. This e-mail was scanned by MailSweeper ************************************************************ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Proxies, (continued)
- Re: Proxies Ben Nelson (Oct 31)
- Re: Proxies Gary E. Miller (Oct 31)
- Re: Proxies nosp (Oct 31)
- Re: Proxies Charles E. Hill (Oct 31)
- Re: Proxies Valdis . Kletnieks (Oct 31)
- Re: Proxies Ben Nelson (Oct 31)
- Re: Proxies Richard Spiers (Oct 31)
- RE: Proxies adam.richards (Oct 31)
- Re: Proxies Ben Nelson (Oct 31)
- Re: Proxies Richard Spiers (Oct 31)
- Re: Proxies Jakob Lell (Oct 31)
- RE: Proxies Bassett, Mark (Oct 31)
- RE: Proxies S G Masood (Oct 31)