The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening up the various components.

For example, it stands to reason that the key server bit (ports 389/636) needs to be open fairly broadly so that the public keys of your clients are accessible. What about the port (https over 443) used by the Desktop application to download updates and policies? What would be the implications of opening this up globally?

  • As a security product, doesn't PGP offer any guidelines on how to secure their own server?
    – Yoav Aner
    Feb 8, 2012 at 18:08
  • @YoavAner: Not really. They give you a list of the ports, and what they're used for, but there is no engineering level guidance on what risks are associated with the data presented through each.
    – Scott Pack
    Feb 8, 2012 at 19:36

1 Answer 1


To be honest, opening these ports on your firewall doesn't present that much risk at all, especially if you consider the tightest possible cases:

The key server ports - this is an outbound rule that can be limited to specific keyservers, but even if it isn't limited, it is still an outbound rule, so an attacker would have to ascertain sequence numbers and spoof a reply.

Similarly, opening port 443 presents the same risk as opening for desktop users.

Your most likely risks are presented from misconfiguration (as it is a complicated behemoth), but the firewall rules aspect is actually pretty straightforward.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .