[Xitami] Windows client: opening non-standard ports

[Thomas J. Hruska]

At 06:42 PM 6/26/2003 +0200, Marc Doigny writeth:
>At 15:24 26/06/03, you wrote:
>>At 10:27 AM 6/26/2003 +0200, Marc Doigny writeth:
>> >Hello !
>> >
>> >I know port 119 is used for news.
>>
>>If you know this, why are you using that port?  I made specific note of it
>>and suggested using a different port altogether...but that seems
>>unacceptable to you for some reason that I'd like to know.
>
>Our ISP only makes the standard internet ports available.
>That is: 25, 80, 119, ...
>Only 119 is left over.
>Port 80 is used for our normal webserver, port 119 is used for a limited 
>group of users.

Ahh...that helps answer a few things.  There are two solutions to this
problem that make sense and one that might work:

1)  Get a different ISP (probably the better route).
2)  Get another static IP Address with a different domain from your ISP.
3)  Ask your ISP to open a specific port for you (not likely to happen, but
worth asking about).

>I'm not a firewall specialist, but how could a request from Netscape be let 
>through, and a request by IE blocked? (Using the same computer)
>After upgrading from IE 4.0 to IE 6.0 the request was also blocked.
>So i assume it's a Internet explorer thing.

Upgrading IE from 4.0 to 6.0 also applies kernel-level and driver patches
to the Windows OS itself...I've fixed several machines with this approach
that had viruses on them (I removed the viruses first, of course, but this
fixed the collateral damage).  So, when I say it has to do with HINTERNET,
that is the communication mechanism IE uses.  Mozilla/Netscape uses normal
socket communications...hence, it works and IE doesn't.  The HINTERNET
library, during the upgrade process to IE 6.0 probably got replaced with
something "better" that breaks the communication with your server by
sending a NEWS request instead of an HTTP request.  I originally suggested
dropping the firewall temporarily so that you could see the exact packets
coming through in case some packets were being malformed by HINTERNET (most
decent firewalls usually drop malformed packets).

>> >For now i suggest users to use Netscape. For now the site is only for a
>> >limited user group.
>>
>>Well, you will be continuing to limit your user group if you force them to
>>use older versions of IE or use Mozilla/Netscrape.
>>
>> >I'm looking for some register fix to allow IE to connect.
>>
>>This is probably the best way to lose users/customers...tell them they have
>>to modify the Windows registry to visit your site.
>
>I'm not afraid of losing users ... there are very captive indeed: the 
>server is used by our sales representatives to get some (private) 
>informations from our site when there are on location or at home.
>They are all used to IE and don't quite like netscape...

Then enable them to use IE without requiring them to make changes to their
OS.  Besides, Netscape hasn't been usable since v3.0 (IMO).

>Having to use port 119 is a good thing (no virus of other malevolent user 
>is actually trying to connect)...

That may be true right now.  However, port scanners will eventually see
that 119 is open and discover that it isn't a news server running, but a
rogue HTTP server...then you will have serious security and data integrity
problems if the data is worth getting at and manipulating.

>I'm not used that the correspondents completely understand my questions 
>from the first run (english is my 3rd language), so i tried again from the 
>beginning. Maybe i didn't made it clear enough that it is just some sort of 
>communication between "registered" users who don't mind that i mix with 
>their computer's registry.

Trust me, they DO mind and they probably talk behind your back as well if
you consistently require them to do such things to use your system like
edit their Windows registry.  Your job should be to make sure they can
_EASILY_ do whatever they need to do...even if it takes more money, effort,
and time on YOUR behalf to make it easier for _THEM_.  Enough of this part
of the discussion, your attitude about your own salespeople/registered
users/etc. says to me that you really don't care about them...let alone
your real customers.  If you aren't willing to go out of the way for your
internal people, how much more does that apply to those who are external!

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/