[Xitami] Firewall/Routers & UDP

[Admin (MRJ)]

The only time I have had to allow anything special on any firewall setting
was for the DNS servers to open and they should be the only part that
requires both TCP and UDP ports to work. Thus port 53 must remain open.

A word of caution is that if you don't know what you're doing on DNS you may
allow recursive searches which can pose a security issue in BIND dns
versions below 4.9.10 and it is by default set to allow recursion on all
versions.

For Windows DNS this should not be a problem but it gives you less control.

They also specify that Zone alarm standard version is not a good alternative
for a firewall on a server however, I have had people run nessus scans of
servers with only ZoneAlarm Personal edition installed and in the regular
mode they cannot break through it and get kicked all the time. Besides, a
proper nessus scan will take several hours to perform so the likelyhood of
remaining undetected is limited, as ZA also logs every IP hitting anything
and anywhere.

If you use DNS, Xitami and SMTP/POP3 server on machines with ZA you should
specify "allow unusual servers to run under high security" in the advanced
properties but nothing else than this.

Unless you're doing p2p systems for Extranet services or something, there
should be no reason to allow UDP, but I could be wrong on this.

    MRJ



----- Original Message -----
From: "Rick Headly" <rickhead@gmail.com>
To: <xitami@lists.xitami.org>
Sent: Saturday, January 22, 2005 10:24
Subject: [Xitami] Firewall/Routers & UDP


> Hello,
>
> I've been using Xitami for the past three or four years, both for FTP
> and HTTP purposes.  Throughout this time, I've achieved satisfactory
> results, simply by forwarding ports 21 and 80 [TCP only] from the
> router to the applicable PC, and opening TCP ports 21 and 80 on the
> software-firewall installed to that machine.
>
> What troubles me however, is that I constantly find myself reading
> posts on various message-boards which have been written by people of
> questionable knowledge, and with unknown skill and experience, about
> the set-up and configuration of Xitami and similar web-servers in
> general.  Quite often, they specifically instruct the user to open
> incoming TCP **AND** UDP ports 20 (???), 21, and 80... but ALWAYS fail
> to explain why.
>
> I admit having very little understanding of UDP protocol... and
> because I have very little trust for my information sources, I've
> refused to open any incoming UDP ports (or port 20) for Xitami's use.
>
> Is it wise of me to keep unnecessary ports closed, or am I just being
> paranoid, and robbing myself of true optimization and efficiency?
>
>    Rick
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>