Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening up the various components.

For example, it stands to reason that the key server bit (ports 389/636) needs to be open fairly broadly so that the public keys of your clients are accessible. What about the port (https over 443) used by the Desktop application to download updates and policies? What would be the implications of opening this up globally?

share|improve this question
As a security product, doesn't PGP offer any guidelines on how to secure their own server? – Yoav Aner Feb 8 '12 at 18:08
@YoavAner: Not really. They give you a list of the ports, and what they're used for, but there is no engineering level guidance on what risks are associated with the data presented through each. – Scott Pack Feb 8 '12 at 19:36

1 Answer

up vote 1 down vote

To be honest, opening these ports on your firewall doesn't present that much risk at all, especially if you consider the tightest possible cases:

The key server ports - this is an outbound rule that can be limited to specific keyservers, but even if it isn't limited, it is still an outbound rule, so an attacker would have to ascertain sequence numbers and spoof a reply.

Similarly, opening port 443 presents the same risk as opening for desktop users.

Your most likely risks are presented from misconfiguration (as it is a complicated behemoth), but the firewall rules aspect is actually pretty straightforward.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.