Is known IP-number filtering pretty much all that is needed for website security/vulnerability?

ship · 2006-05-17T19:55:38+00:00

Sounds like a swell product to me...*Please note that this is a scan-only version. To remove spyware or viruses and get automatic updates, you will need to subscribe to the full version.IMPORTANT: If you decide to download and install the Protection Control Center, it will uninstall any current anti-virus software you may have on your computer. Please note that this is an industry standard to prevent any software conflicts. The Protection Control Center is for users of Windows 2000 and XP operating systems only. All others, please see Norton Security Products for alternative software options.

V

Volker Birk 20 years ago

To be picky, neither nor can. You don't need "control ports", because a port is not a door or gate nor a harbour, but just a maintainance number.

F'up2csf, where this is on-topic.

Yours, VB.

Vote

F

Frankster 20 years ago

"Control Ports", in this context, means: Block, Allow, Deny, Drop, Allow only specific running services on that port, inbound AND outbound, etcetera.

A Web server cannot do that. A network firewall can.

-Frank

Vote

V

Volker Birk 20 years ago

If you want to, it can. If the web server is the only server on the box, any other things are denied. And the web server can decide, which connection to accept.

Yours, VB.

Vote

S

Shawn K. Quinn 20 years ago

["Followup-To:" header set to comp.security.firewalls and comp.security.misc.]

begin quotation from ship in message posted at 2006-05-19T01:56

Such a protocol is a must if one doesn't want something trivial like a packet sniffer to reveal one's secret authentication info.

It's actually a completely different protocol, layered over ssh (secure shell).

What about all the other software? There's a *lot* more than just a database, Web server, and a kernel; there is the rest of the operating system as well (the "GNU" in "GNU/Linux").

I wouldn't really trust anything which runs as part of Windows boxes, except maybe to set policy for certain programs you don't trust. If you want to enable it in addition to a real, multiple bastion host firewall device, great.

[referring to Microsoft]

Not surprisingly, I disagree, but neither of these two groups I'm setting followups to are really an appropriate forums for this debate.

Nobody ever got "owned" by having too much security.

I know OpenBSD has a "synproxy state" option when used as a firewall/router that pretty much stops SYN floods cold, as well as the ability to normalize packets as desired.

I use the term to mean "computer entrusted to securing a network as its primary reason for existence". I never use it to refer simply to, say, Windows software running on the same single PC that it's trying to protect, and believe that Microsoft is being intentionally deceptive by calling its offering in Windows XP.2 a "firewall".

Vote