There is a new version of the ISA Client Firewall that has been released today:
Please make sure to update your technician thumb drives and SBS Premium installations with the new file. This will be especially important for new Vista installs on SBS infrastructure that has or will be RipCurled (previous blog post).
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.
Showing posts with label ISA Client. Show all posts
Showing posts with label ISA Client. Show all posts
Thursday, 4 October 2007
Tuesday, 13 March 2007
SBS, ISA & Senstive Data Transmission Security?
Obviously we never made it to the TechNet event! :D
This morning, we fielded a call from one of our clients indicating that their payroll service software was unable to transmit a Record of Employment to the payroll service server.
It was a priority situation, as the ROE needed to be transmitted by today.
It took a few steps to clarify just where the transmission was breaking down.
The ISA client was installed and connected properly, so no issue there.
The IE settings were correct, and IE was browsing the Web fine via the SBS ISA proxy settings.
With the client computer connected via one RWW Remote Assistance session, and the SBS server via another RWW TS session (two monitors), I was able to watch the ISA activity log in real-time.
What I saw astounded me!
This particular payroll application was trying to FTP the information out to their own servers! Perhaps I am wrong here, but FTP? We are talking about transmitting usernames, passwords, and highly sensitive data via an open to the public protocol.
There is a reason why the outgoing FTP protocol is disabled on the default SBS install of ISA 2004!
Call me paranoid, but in this day and age of the need for transmission security, the least the payroll application creators could do is build on SFTP, or HTTPS/POST authenticated via their software for security purposes!
They could also build a VPN structure into their software as well. The options are there for them, they just need to apply them.
We will mention to our client our concerns regarding the security setup for the payroll service software, and then I am sure they will mention it to the payroll service provider.
We have worked with a number of other payroll services companies and their proprietary software. And, in our experience, there are those out there that have adopted SSL, SFTP, and/or other secure methods of moving data between their client and their own servers. Just not this particular one.
Something to keep in mind if there is a need to outsource payroll IMNSHO.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
This morning, we fielded a call from one of our clients indicating that their payroll service software was unable to transmit a Record of Employment to the payroll service server.
It was a priority situation, as the ROE needed to be transmitted by today.
It took a few steps to clarify just where the transmission was breaking down.
The ISA client was installed and connected properly, so no issue there.
The IE settings were correct, and IE was browsing the Web fine via the SBS ISA proxy settings.
With the client computer connected via one RWW Remote Assistance session, and the SBS server via another RWW TS session (two monitors), I was able to watch the ISA activity log in real-time.
What I saw astounded me!
This particular payroll application was trying to FTP the information out to their own servers! Perhaps I am wrong here, but FTP? We are talking about transmitting usernames, passwords, and highly sensitive data via an open to the public protocol.
There is a reason why the outgoing FTP protocol is disabled on the default SBS install of ISA 2004!
Call me paranoid, but in this day and age of the need for transmission security, the least the payroll application creators could do is build on SFTP, or HTTPS/POST authenticated via their software for security purposes!
They could also build a VPN structure into their software as well. The options are there for them, they just need to apply them.
We will mention to our client our concerns regarding the security setup for the payroll service software, and then I am sure they will mention it to the payroll service provider.
We have worked with a number of other payroll services companies and their proprietary software. And, in our experience, there are those out there that have adopted SSL, SFTP, and/or other secure methods of moving data between their client and their own servers. Just not this particular one.
Something to keep in mind if there is a need to outsource payroll IMNSHO.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Labels:
Data Security,
FTP,
ISA,
ISA Client,
SBS 2003 Premium,
SBS Troubleshooting
Sunday, 11 February 2007
SBS 2003 SP1 Premium - Can no Longer Connect to Companyweb
Within the last couple of days our Companyweb page would no longer show up on our client workstations here at home.
Nothing has changed, other than the fact that I have just done Phase 2 of a Swing Migration on this network. We have a new server to replace the ageing 1U that is currently serving our SBS needs.
I thought that it might have been TempDC's presence in AD and DNS that was messing things up. But cleaning out AD of TempDC's presence did nothing to fix it.
With the help of a tool called WFetch 1.4 which is part of the IIS Diagnostics Toolkit, and can be obtained here, I was able to figure out that I could connect to Companyweb when the tool specifically had port 8080 as the port to connect to.
I received a host not found error if port 80 was the port to connect to.
It has been a bit of a puzzle. The only other thing that I could think of that has changed was the update for the ISA firewall client to make it compatible with Vista. I am not sure if this is the culprit yet as I will need to test it further.
Armed with the above info, it came to me that when WFetch was directed to port 8080 it was being told to work WITH the proxy server for local addresses, and not BYPASS it.
I opened the Connections properties for IE's LAN Settings, unchecked, "Bypass proxy server for local addresses" and voila!
We now have our Companyweb back.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Nothing has changed, other than the fact that I have just done Phase 2 of a Swing Migration on this network. We have a new server to replace the ageing 1U that is currently serving our SBS needs.
I thought that it might have been TempDC's presence in AD and DNS that was messing things up. But cleaning out AD of TempDC's presence did nothing to fix it.
With the help of a tool called WFetch 1.4 which is part of the IIS Diagnostics Toolkit, and can be obtained here, I was able to figure out that I could connect to Companyweb when the tool specifically had port 8080 as the port to connect to.
I received a host not found error if port 80 was the port to connect to.
It has been a bit of a puzzle. The only other thing that I could think of that has changed was the update for the ISA firewall client to make it compatible with Vista. I am not sure if this is the culprit yet as I will need to test it further.
Armed with the above info, it came to me that when WFetch was directed to port 8080 it was being told to work WITH the proxy server for local addresses, and not BYPASS it.
I opened the Connections properties for IE's LAN Settings, unchecked, "Bypass proxy server for local addresses" and voila!
We now have our Companyweb back.
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Subscribe to:
Posts (Atom)