kerio 2.1.5 (last freeware version), strange behaviour, related to port logger and svchost.exe

Maybe your goal is not "filtering out all executables" but "filtering out SPAM and virus mail using own heuristics". Correct?

As long as you're not lying to yourself, this is OK. As long as this is true.

No.

There are reachable goals in the field of security. Please let us define such goals, which are as good as possible, and please let us discuss how to reach them.

Yours, VB.

So you are running an SMTP server? Is it Exchange?

I should have made it clear that postfix and exim (and squid) run on Unix-like systems. The whole idea is to keep the more vulnerable Windows system off the public network. I just don't see a personal firewall (that is what PFW stands for, right?) as doing the job.

Smoothwall, which I mentioned, is basically appliance system. But you need to provide the hardware. (any Pentium will do). It's worth checking out if you want to move to an appliance from a personal firewall. I don't think that it does SMTP, but you could probably hire someone to set it up as an external facing SMTP server.

But I'm really confused by your situation. I simply don't understand why someone who is running an SMTP server is talking about PFWs. Could you describe your situation a bit more?

-j

Yes. For you the distinction between (1) and (2) below seems to matter a great deal.

(1) My goal is the filter out X using heuristics.

(2) My goal is to filter out all (and only) X, but with the full knowledge that the goal is unachievable, so will accept certain approximations of reaching that goal.

For me, it doesn't really matter which way it is stated. But since you seem to care about it, I'm happy to say (1).

Consider spam filtering as an analogy. When tuning a system, I need to consider what false positive (incorrectly labelling something spam) and false negative (not identifying some spam as spam) rates are acceptable. For most businesses, false positives are far far more costly than false negatives. So I tune conservatively. People see in their inboxes on a daily bases that I'm not filtering all spam. They see the false negatives all the time.

Users need to be reminded that the virus and executable scanning of email is like spam. Some bad stuff will get through. My biggest fear in this regard is that users will think that if something gets through it must be safe. That is a risk that I am knowingly taking.

Also filtering while accepting mail isn't the only line of defense. At one company almost everyone is using Thunderbird on Linux desktops. The few Windows machines around are running their own AV stuff.

I guess I don't demand perfection in any line of defense. I just have to weigh the costs of the various lines of defense with the risks. For example, I might have a great deal of confidence in the perimeter firewalls, but I'm also going to run host-based firewalls as well. Adding that extra layer low cost, even if it will rarely be used in action.

I guess it depends on what is meant by "security". If security means reducing risks to an acceptable level, then you are right; it is certainly achievable.

Cheers,

-j

Why not there, where it's possible?

Yours, VB.

Please give an example of where perfection is possible.

-j

I plan on it. Will try a linux or bsd SMTP server too.

What I meant was - can it be done with a PFW. you answered that very well by saying No, but it can be done with an xyz.

somebody with some technical interest trying to improve his knowledge. Currently just building some computers up, will practice with linux. But am interested in windows too. So I am thinking about setting things up before actually having any experience with it. I guess maybe that's an ineffective way of doing things.

so if just testing ms exchange and am limited in the number of machines I have, I may put ms exchange on a workstation. If the FW is on the workstation too, then it'd be a windows one. So, hence I was asking about a PFW with MS Exchange! I have since seen a few windows alternatives mentioned that'd run on that same machine - WIPFW and CHX-I I may start using these on windows machines in place of any PFW, since they are more interesting to meddle with. If running something on a nearby machine I might also try the proxy-firewall MS ISA.

I was thinking of -filtering incoming packets on an outgoing connection - specifically, so when a client computer accesses a pop server, the attachment is stripped off. I suppose that is more a "rewriting" function than a filtering/firewall function. Also, -blocking http requests to web pages with active x content. So that whatever browser is used, however it's set , and even if an activex plugin is installed, the activex is not downloaded.

So, my interest here is in uses of firewalls to block things other than just incoming connections(like the Win xp FW does). I can see that a lot of blocking outgoing in order to avoid malware is pointless. But there are still reasonable uses of blocking outgoing. I see a lot of mention here of it being pointless to block outgoing. And not a lot objecting to that. Leythos has provided some very interesting objections, but his posts disappear from the archives, and I haven't been monitoring the group consistently throughotu the year. So if it's not in google's archive, i've missed it. It's that side of the argument that i'm interested in seeing. The "pointless to block outgoing to prevent spyware", has almost become "pointless to block outgoing" full stop! it's almost a mantra, and archived objections are rare - yours is the first i've seen. So i'm interested in cases where blocking or filtering outgoing is useful, and how it would be implemented. I think this is very rarely discussed/in archives. So I think newbie readers like myself are getting a slanted view. All credit to Volker for arguing his case so effectively. It's the lack of archived activity on the other side over a period of time that has created the slant.

thanks

That's what I thought. This, as you point out, is about talking to a POP3 server. It is not about running an SMTP proxy. Googling on "pop imap proxy" I find

You can, of course, run your own mail (SMTP) server, and there are tools like MIMEdefang and others that can be plugged into the mail server which will do what you want. But running your own mail server is not something to be taken lightly. Part of my business is setting up mail servers for business, but for my own domain, I choose not to run my own mail server, but used fastmail.fm instead.

That would be Squid. There may be other Squid-like tools out there, but Squid is what I know.

I block and log some outgoing, but not on a personal firewall. I do it on a separate dedicated firewall appliance. (I use m0n0wall running on a Soekris net48xx).

I simply don't know enough about Windows to say anything useful about the advantages and disadvantages of doing so on a personal firewall on Windows.

-j

But I like being able to block all access to my machine for when I'm not using the internet. Win98 gives no way to do that like I can on XP so I use Kerio firewall to do it.

Can't you use the hosts file to do that?

That may be true in your case but Opera is a much better browser than IE and is worth switching just for the feature set it has.

Which is entirely pointless, because you DON'T NEED TO DO THAT on Win98 in the first place. Disable file and printer sharing and make sure you didn't install Personal Web Server and Win98 doesn't offer any services that would make it accessible from the Internet.

cu

Well, there is always unplugging the network cable.

-j

I already do it. But, besides that, I also prefer to block internet access outwards of certain applications that seem to try to 'call home'. Running Kerio in 'Ask Me First' mode reveals that. Not everything undesired happens by piggybacking IE or other browsers.

Does anybody know whether current web browsers in Windows have autoupdate capabilities, using port range 1024-1030? Could they be exploited? I mean, some years ago the firewall informed of access attempts from outside at such range and also that port was 'owned' then by Mozilla browser?

Are you asking about source ports or destination ports in that range?

-j

Incoming traffic to those ports is most likely to be Messenger Spam. Just let the firewall block it and don't worry about it. It's nothing but noise..

Well, there *are* programs you might not want to use. Duh.

cu

You sure about that? MS has stopped all support for Win98 even though they know it has a security vulnerability in explorer.exe. How can leaving Win98 wide open to the internet be safe when it has a known vulnerability? I call BS.

Yea, but it is quicker and more convenient to just set Kerio to stop access.

Please explain to me how an attacker would exploit that vulnerablity FROM THE OUTSIDE.

You just don't have any clue what I was talking about.

cu