|
Focus on Microsoft
Shared drives through a firewall Mar 22 2007 02:01AM aeheald gmail com (4 replies) Re: Shared drives through a firewall Apr 17 2007 08:53AM Nicolas RUFF (nicolas ruff gmail com) (1 replies) Re: Shared drives through a firewall Mar 22 2007 01:44PM Mailing Sécurité Focus (mailingsecurite maisonlaprise com) |
|
|
Privacy Statement |
and revision.
For instance, Windows began using SMB (TCP:445) on Windows 2000 and
later for remote file shares (although NetBIOS connections are still
supported for downlevel compatibility.
The problem with allowing either or (FSM help us) both across one; much
less two firewalls is that file shares aren't the only things that use
these transports.
Remote registry, remote service control are two of my favorite examples
of SMB-carried traffic.
My favorite p1553d-0ff domain admin trick is:
for %i in (list of dcs) do sc \\%i config netlogon start= disabled & sc
\\%i stop netlogon
You won't reverse this action without a recovery console, since the DCs
in question can no longer authenticate any logon attempt. Of course,
you have to order your list properly so as to do the GCs last, but for a
domain admin, that's trivial info gathering.
The point is; if you allow direct file share access between your
security zones (or else why have a firewall between them), you create a
much larger threat than simple file mangling.
You might consider using FTPS or SSH connections; they're relatively
secure, depending on the server/client package you select.
Jim
-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of aeheald (at) gmail (dot) com [email concealed]
Sent: Wednesday, March 21, 2007 7:01 PM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: Shared drives through a firewall
Hello Group;
I am trying to persuade a client NOT to map a drive through two
firewalls to
an untrusted server in a DMZ to run an application. I've tried Googling
Netbios and security, but get so many entries as to be useless.
Other than the latency issues, and my ten cents that it seems to me to
be an
enormously foolish idea, can you folks offer me any further ammunition?
Big Thanks if you can
Eigen
All mail to and from this domain is GFI-scanned.
[ reply ]