Subject: ICQ in/out of firewall

From: MONZ <[email-masked]>
Date: Fri, 21 Apr 2000 19:07:45 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I am more or less forced to enable ICQ from the inside of our firewall,
just not sure how to handle it. Don't have much experience with ICQ, and
I don't like the idea of merely allowing access though normal ports
(4000). How about setting up a private ICQ server on the private net and
let it handle connections.
Ideas and product hints more than welcome. We are using both Linux and
Windoze9x/2k workstations.
-- 
Mogens Valentin  WWW: http://www.danbbs.dk/~monz/  mailto:[email-masked]
Web, Programming, Network, Security - Installguides and docs for Linux..
Skaane/Sjaelland Linux User Group (5300++ members) - http://www.sslug.dk
Use http://www.linux.org/ for freedom of choice with OpenSource software

---

From: Robban <[email-masked]>
Date: Sun, 23 Apr 2000 13:38:48 +0200

Hi Mogens,

I'm running ICQ behind FWTK home.
What I did to make it work? ;p
First i downloaded UDPRELAY (after a while I discoverd the standard version of
udprelay didn't work under linux... but there's a version of it to linux)
and in the /etc/udprelay.conf, i just added:
relay 192.168.2.0 mask 255.255.255.0 * 4000 icq.mirabilis.com 4000 any
And configured the icq-client to connect to the firewall @ port 4000...

But (yes... there allways a but...)
You can't etablish a direct contakt with anyone =(, so if you don't
check the box: "auto-send trough server" an "error box" will apear on the
screen and tell you that... and you can't send or recive files...

I don't know how it works with an internal icq-server
(mirabilis haven't released one to linux...yet...)...
There is noway to get filetransfers to work with udprelay...

I know there wasn't to much help, but i hope
you solve the problem...

Best Regards
//Robban

---

From: "Ken Long" <[email-masked]>
Date: Mon, 24 Apr 2000 08:49:28 -0600

Settting up an internal ICQ server would be a good solution security-wise as 
long as you don't need outside ICQ connections.  If you do need connections 
to the outside, the best ICQ functionally is through a Socks5 proxy.  NEC has 
one at http://www.socks.nec.com/socks5.html, though I understand there are 
security implications with Socks5.  I've also been quite successful with 
using ICQ for chatting and file transfers through IPCHAINS/IPMASQ on Linux.

Regards,
Ken Long

---

From: "Ken Long" <[email-masked]>
Date: Tue, 25 Apr 2000 09:23:21 -0600

On a scale from best functionality to best security the choices for ICQ are:
1. Direct connection with a dedicated ip address
2. Socks5 proxy
3. Ipchains/Ipmasq with the icq module
4. Ip

As we all know, there are always trade-offs between program functionality and 
security. The most secure method is to remove the power plug from the wall. 
At the other end of the spectrum, the best functionality is achieved with a 
direct connection to the Internet and individual public ip addresses.  Most 
of us will fall somewhere between those two extremes.

If allowing ICQ has already been decided then we as administrators need to 
show what options and consequences are available.  Flexibility is key here in 
order to support the business.  Sometimes we have to strongly insist that 
certain functions not be allowed but we have to have our facts in order and 
not rely on a simple "it's against our security policy" argument.  Once in a 
while we find ourselves on the losing end of the argument.  It's important to 
implement the new function with as much security as possible and maybe even 
do a little cya in the process.

If it was easy, anybody could do it.

Ken

On 25 Apr 2000, at 19:00, [email-masked] wrote:

> nuqneH,
> 
> It depends on what you call "best".
> I think it is "best" not to allow icq direct connections because of
> security, control and monitoring reasons (not to speak about socks security
> implications in general i already wrote about some months ago)
> 
> "Ken Long" <[email-masked]> said :
> > 
> > to the outside, the best ICQ functionally is through a Socks5 proxy.  NEC
> > has one at http://www.socks.nec.com/socks5.html, though I understand there
> > are security implications with Socks5.  I've also been quite successful with
> > > just not sure how to handle it. Don't have much experience with ICQ, and I
> > > don't like the idea of merely allowing access though normal ports (4000).
> > > How about setting up a private ICQ server on the private net and let it
> > > handle connections. Ideas and product hints more than welcome. We are
> > > using both Linux and Windoze9x/2k workstations. -- Mogens Valentin  WWW:
> > > http://www.danbbs.dk/~monz/  mailto:[email-masked]
> > 
> 
>                                      _     _  _  _  _      _  _
>  {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
>  (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
>  [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.3i
> Charset: noconv
> 
> iQCVAwUBOQWy9KH/mIJW9LeBAQFxqAP6A0Maxig6p9o7kOwMnaFWzQ1DH/Zgktlr
> iTu+JBBJd6qEJaAqESlY9jqvVCTrE883cjYG/9zEoSVckUYIOVAOX3QPohBuP3gV
> 6dcFjchJu3E4sXir0gqs/MlpRhziuRIFetVmKT42JHitx/qVqS3v2Lp8bBccimxP
> 4nRIk69KWeI=
> =RyiN
> -----END PGP SIGNATURE-----

---

From: [email-masked]
Date: Tue, 25 Apr 2000 19:00:05 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

                                     _     _  _  _  _      _  _