IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
The command SYST, with which a client asks for the operation system
version of the server, should be linked to an authorisation administration and
blocked for untrustworthy users.
Moreover, it must be possible to encrypt the transmission of files, directory
information and passwords.
SMTP
Simple Mail Transfer Protocol (SMTP) is a simple protocol for transmitting
electronic mail on the Internet consisting of only a few commands.
The commands VRFY and EXPN can call up internal information, so the use
of these commands should only be allowed within the protected network. For
untrustworthy users, VRFY and EXPN must be blocked. The firewall should
be able to encrypt SMTP connections between trustworthy users, although this
is only advisable if a strong authentication mechanism is used.
DNS
Domain Name Service (DNS) is used to convert computer names into IP
numbers and vice versa and provides information on computer systems using
the network. The information transmitted is not protected by cryptographic
procedures, so spoofing attacks are possible using forged data. This should be
taken into consideration especially in the event of DNS responses from the
Internet.
To gain access to computers on a network, an intruder first needs their
addresses which he can either get by random searching or more simply by
analysing the DNS information. Once he has the address the intruder can, for
example, forge an address (IP spoofing) by pretending that his computer
belongs to the network to be protected and sending packets to it.
It must always be remembered that all information made available by DNS
can be misused. How a firewall must be configured in order to provide risk
protection when using DNS is described in Safeguard S 2.77 Secure
Arrangement of Further Components.
NNTP
Network News Transfer Protocol (NNTP) is used for transmitting news
articles.
The firewall must be able to prevent the transport of certain news groups
entirely or only admit them for certain computers. There must be a guarantee
that when sending news, no information percolates via the network to be
protected (e.g. computer names) into the external network.
HTTP
Hypertext Transfer Protocol (HTTP) is used for transmitting data between
WWW clients and WWW servers. It supports four operations: Connection,
Request, Response, and Close.
The firewall must be able to analyse the commands of an HTTP packet and
restrict it with filters. It must, for instance, be possible to prevent
implementation of the POST command and the associated file change during a
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000