Security Basics mailing list archives
RE: Blocking ssl vpn connections
From: "Brent P. Gardner" <brent.gardner () gmail com>
Date: Fri, 24 Mar 2006 16:52:31 -0700
OpenVPN cannot run as a monolithic executable. It requires installation of a software NIC. This means it can't run from removable media such as CD-ROM or USB drive. Are we talking about Windows machines? If you block driver installation that will keep it off your machines. The software NIC driver is unsigned. If you need driver installation you can set policy to reject unsigned drivers. I don't know how you'd block OpenVPN by watching the traffic. OpenVPN defaults to listening on UDP 1194 on the server side. But of course that can be changed. A strict egress filtering policy may catch it... Brent Gardner
-----Original Message----- From: Andrew Stewart [mailto:astewart () Gestampna com] Sent: Thursday, March 23, 2006 2:34 PM To: security-basics () securityfocus com Subject: Blocking ssl vpn connections How would one go about blocking an SSL VPN (e.g. openVPN) on a firewall (or even detecting it via an IDS)? I was wondering what a network/security administrator should do to prevent an employee from connecting to a SSL VPN from internal to the administrator's network to some unknown SSL VPN server. I could see this being used for numerous things that are not in agreement with most companies acceptable use policies. --------------------------- Andrew Stewart Gestamp Alabama, Inc. IT Support Tech astewart () gestampna com -------------------------------------------------------------- ------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus -------------------------------------------------------------- -------------
--------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Blocking ssl vpn connections Andrew Stewart (Mar 24)
- Re: Blocking ssl vpn connections Aaron Rohyans (Mar 27)
- RE: Blocking ssl vpn connections Brent P. Gardner (Mar 27)
- RE: Blocking ssl vpn connections David Gillett (Mar 27)
- <Possible follow-ups>
- RE: Blocking ssl vpn connections Hayes, Ian (Mar 28)
- Re: RE: Blocking ssl vpn connections barcajax (Mar 28)
- Re: RE: Blocking ssl vpn connections Joe (Mar 29)