topic How to block Open Proxy within WSA in Web Security

How to block Open Proxy within WSA

kisanak_ironport — Thu, 27 Sep 2007 11:05:34 GMT

I test WSA with tools pxytest.pl (from: http://www.unicom.com/sw/pxytest/pxytest) and found that WSA is open proxy which mean it's vurnerable to be used by spammer to send junk mail.

Result:

>>> (smtp dialog with probe email)
<<< 220 smtp.cbn.net.id ESMTP\r\n
*** ALERT - open proxy detected
Mail message has been sent to <yahya>
Test complete - identified open proxy proxy-new.cbn.net.id:8080/http-post

How to block this Open Proxy?

TIA.

Re: How to block Open Proxy within WSA

jdohrman — Thu, 27 Sep 2007 21:14:04 GMT

Sounds like you allow HTTP connect to port 25 correct? That means somebody can use telnet to throw a
CONNECT mail.server.com:25 at the proxy and then talk SMTP through the so created HTTP Tunnel.

You can specify what ports are supposed to be 'open' in that sense in the Web Access Policies. There you have the field 'Allow CONNECT on Ports:'

It is important here that a blank field used to result in a 'allow all' in Versions pre 5.2.0. As this was confusing we changed the behavior and as of AsyncOS 5.2 you'll have to enter 1-65536 to allow all ports while leaving the field blank blocks all ports.

Please let me know if I misunderstood your question - some more info would be handy then. Thanks a lot.

Jakob

Re: How to block Open Proxy within WSA

jdohrman — Wed, 10 Oct 2007 15:05:36 GMT

FYI

This information is now published in the IronPort Knowledgebase:
http://tinyurl.com/2zmmej

Cheers,
Jakob

Re: How to block Open Proxy within WSA

Vinesh_ironport — Sun, 13 Jan 2008 16:04:51 GMT

Hi,

I've just installed an S650 for an ISP for testing and it seems that it's acting as an open proxy.

Currently, it's in explicit proxy for testing purposes on port 8080.
Apart from allowing the specific ports to connect, can we specify a specific range of IP(which is internal for the ISP) , which can use the proxy?

We are running version 5.1.2 for Web build 001

thanks

Re: How to block Open Proxy within WSA

jowolfer — Mon, 14 Jan 2008 23:25:35 GMT

Mauritius,

You would need to create a policy group that applies to the subnets you want to be able to proxy. This is your allowed access group.

Change the default policy so that it denies everything (Under 'Applications', just check the boxes to deny HTTP, HTTPS, FTP).