[Xitami] Windows client: opening non-standard ports

[Marc Doigny]

At 19:37 27/06/03 +0000, you wrote:

>Why not get yourself a less restrictive (and more knowledgable) ISP?
The amount of ISP's in my region is very limited.
We have one national telecom operator (Belgacom: phone/gsm/dial 
up/adsl/sdsl) and one cable operator (Telenet, that is even more restrictive).
Smaller companies that could be more user-fiendly uses the telecom 
operator's network and settings and eventually provide their own servers.

[... lots of bashing removed ...]
The server is for private use, we do not request that customers abide by 
these rules.


>Will IE6 not work if provided with a FULL URL, including schema, host,
>and port?  If it does work, then make sure you always publish links in
>full like that.
I always use the full url in the redirect (i'm writing html stuff for 
nearly 10 years)



> > Having to use port xxx is a good thing (no virus of other malevolent user
> > is actually trying to connect)...
>
>Now you really ARE displaying incredible ignorance and naivety.

Logs don't show any strange connect activity. I even installed a packet 
sniffer (ethereal).
Using another server and another port for our more sensitive data is just 
part of a broader set of measures:
- load some page (could be located anywhere)
- this page contains a <script src=http://mypublicserver/cgi-bin/...>-tag 
displaying nothing, but get the client's IP registered for one minute
- go to the private server default page (it's a cgi that also checks the IP).
- This page contains a <input type=hidden> field with a hash (or is a 
redirection to the main server if the IP was not registered).
- login to the private server with login, pass (and hidden field)
- the hash is modified each time a new page is asked for
- without correct hash, any request on the private server is redirected to 
the main server
- and so on

We are not such a big company that hackers will try for hours to find out 
how to get past the login screen, if they ever get there.
The only thing they will get is the server name (Xitami rules!) and a 
un-conspicuous redirection to the main server.
I could install a point-to-point tunnelling protocol, but the isp asks LOTS 
of money for making this service available (we simply can't afford it).

Could we go back to the question, now that some points of details have been 
cleared out?


Marc Doigny