| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 4436.1 | | BBRDGE::LOVELL | � l'eau; c'est l'heure | Sun Feb 02 1997 16:21 | 15 |
| >> Can anyone tell me what method is used to transfer the file from the
>> local system to the remote system outside the firewall?
Probably http encoded stream, but what the heck - who cares?
Your customer is fighting a losing battle. This "loophole" through an
external mail relay is no different than if the file had been sent
directly by e-mail - it could just as easily have been UUencoded and
sent by SMTP through his standard Internet mail relays. Even if the
customer has mail logging in place, a simple ZIP password would render
the transfer impermeable to further scrutiny.
Security. Technology is not the entire answer.
/Chris/
|
| 4436.2 | All well and good, but... | CHEFS::AYLESBURY_L | | Mon Feb 03 1997 05:12 | 15 |
| Thanks for the reply. I know that mail can have encoded files attached
and that is the same thing as pushing files outside a firewall but what
I really want to know is why isn't the data transfer logged anywhere.
When the attachment is done using mail then the mail-log record shows
the data transfer.
The http doesn't get logged in the proxy log file nor can I find it
recorded anywhere. My customer is getting jumpy that people can send
huge files outside his company with no record of them passing.
Any more ideas?
Les
|
| 4436.3 | logged | TEMPER::koba | Noriaki.Kobayashi@tko.dec.com | Mon Feb 03 1997 20:09 | 10 |
| > The http doesn't get logged in the proxy log file nor can I find it
> recorded anywhere. My customer is getting jumpy that people can send
> huge files outside his company with no record of them passing.
You'll be find the POST entry (to the address specified in the "compose"
page - may be a numeric address, so you cannot 'grep' it by hotmail) in
the proxy log file.
_koba
|
| 4436.4 | Attached file is not logged anywhere. | NEWJWR::AYLESBURYL | | Tue Feb 04 1997 08:29 | 12 |
| I quite agree that the POST entry does go to the numeric ip address. I
have tested this situation by having another DECterm running tail -f
proxy-log to see what transactions take place.
The POST entry that is returned to hotmail contains approx 2K bytes
whereas the file I attached contained 10K bytes. So, I assume that if I
attached a 200K file (the max allowed by hotmail.com) this POST entry
would still be 2K bytes.
Is there no way of logging this data transfer on the firewall proxy??
Les
|
| 4436.5 | Re-post of 4436 - any answers? Moved by Moderator | CHEFS::AYLESBURY_L | | Mon Mar 03 1997 07:42 | 7 |
| Does anyone have an explaination of how data is transferred as
described in entry 4436?
It's really quite important to find out a method of logging this
data as it passes through a firewall proxy.
Les
|
| 4436.6 | Firewalls generally connection-level, not content-based | xdelta.zko.dec.com::HOFFMAN | Steve, OpenVMS Engineering | Mon Mar 03 1997 10:54 | 12 |
|
: It's really quite important to find out a method of logging this
: data as it passes through a firewall proxy.
There's likely no reliable way to record anything beyond the existence
of the transfer, given the number of ways one can transfer information
from inside out through a firewall. (Unless, of course, the customer
wants to log everything, that is...)
Here at DIGITAL, FTP transfers outwards require additional access
rights at the Firewall, to push files through it...
|