Re: [Acme] Issue: Allow ports other than 443
Yoav Nir <ynir.ietf@gmail.com> Tue, 24 November 2015 16:46 UTC
Return-Path: <ynir.ietf@gmail.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 416EC1B2CB9 for <acme@ietfa.amsl.com>; Tue, 24 Nov 2015 08:46:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tJixkOyHqv2R for <acme@ietfa.amsl.com>; Tue, 24 Nov 2015 08:46:32 -0800 (PST)
Received: from mail-wm0-x22c.google.com (mail-wm0-x22c.google.com [IPv6:2a00:1450:400c:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 681AE1B2C8C for <acme@ietf.org>; Tue, 24 Nov 2015 08:46:32 -0800 (PST)
Received: by wmec201 with SMTP id c201so35118187wme.1 for <acme@ietf.org>; Tue, 24 Nov 2015 08:46:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=cxMLCfhwkMqRuYvFrqpXLHlw39WZfjE105f80GzYrV4=; b=TZhjbsafdCKyKRTxN/4oPqEtzKahSYXlJdAIkq8KX8vlcx9SLIBB2UxkEruXZoG3C9 9k2rbKhVlr8N//+3HAUqtvdesnIEr3l0jY1RIbGe9wnNNsFSoYKYkK8W+aRxihwsNiL1 By6kJmwVBhPP7iZJli3mlDF7eXQ+dyNofnmtETRpIcx0HBB96NnczZW9E5KZ2WDG+4Zq V9zUQsDGIIVfCHvtZx2CfXwakOAHYUIMoo6UH/OKWcpoAUIRm9KyB5aX8sKZVmEgqaWC 48u3oQ19dZwxT+b60eCHConCeTqDrNrrPOX9GeUjxYz5fNhoVamvAyFIKCr82RbZ6xqX gukw==
X-Received: by 10.28.47.8 with SMTP id v8mr24545134wmv.30.1448383591093; Tue, 24 Nov 2015 08:46:31 -0800 (PST)
Received: from [192.168.137.224] ([176.12.149.6]) by smtp.gmail.com with ESMTPSA id t2sm3483936wmt.1.2015.11.24.08.46.28 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 24 Nov 2015 08:46:30 -0800 (PST)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <CAHbuEH4Yh-UUin1F0ajsRAHrzrEZ+eDraXd9xLxcnY5kQVxPUg@mail.gmail.com>
Date: Tue, 24 Nov 2015 18:46:23 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <59394DAB-E7B3-487F-9DC0-2820709F5252@gmail.com>
References: <5e9b22a3942d4a39981878b13e4a7752@usma1ex-dag1mb1.msg.corp.akamai.com> <0630035C-E4F6-41AA-A339-7101B448F0FA@vigilsec.com> <CABkgnnUxSwMmOR=QVE-gMvj9dHW6Tk2Z=EO7RDx6E5zVAp_SrQ@mail.gmail.com> <20151124033325.GH18430@eff.org> <56545B4C.3020406@cisco.com> <m2io4ro83g.wl%randy@psg.com> <CAHbuEH4Yh-UUin1F0ajsRAHrzrEZ+eDraXd9xLxcnY5kQVxPUg@mail.gmail.com>
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
X-Mailer: Apple Mail (2.3096.5)
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/Gg84yz5ZkpBMzJ5CMssrTo_le90>
Cc: Peter Eckersley <pde@eff.org>, Eliot Lear <lear@cisco.com>, IETF ACME <acme@ietf.org>, Russ Housley <housley@vigilsec.com>, Randy Bush <randy@psg.com>, Martin Thomson <martin.thomson@gmail.com>
Subject: Re: [Acme] Issue: Allow ports other than 443
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 16:46:34 -0000
I think Eliot meant RFC 5785 /.well-known/ locations, rather than well known ports Yoav > On 24 Nov 2015, at 6:37 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote: > > I agree with Eliot, I don't think a scan is needed to make a decision > here. Having managed several networks that would not have allowed you > access from some random scanner, I don't think you'll get all the data > you are looking for. In a well managed network, the IDS/IPS should > detect that it is a scan and block all future probes once you hit a > small number of ports/IPs. So you may get a small sample with > everything else failing within an address block. Granted, not all > networks are managed well and you may get a good amount of data. > > If this connection was expected to a few servers, then a network > manager might just allow those only on the assigned port. > > Without any hat on, I agree that a port + 443 as an alternate is a good plan. > > Kathleen > > On Tue, Nov 24, 2015 at 8:11 AM, Randy Bush <randy@psg.com> wrote: >>> Isn't this precisely what .well-known was meant to address? >> >> fun small research project. what percentage of well-known ports can >> you connect to from the outside to a machine inside cisco? hell, to >> what percentage of well-known ports outside cisco can you reach from >> inside? >> >> well-known does not correlate well with open to access by IT security >> departments. >> >> randy >> >> _______________________________________________ >> Acme mailing list >> Acme@ietf.org >> https://www.ietf.org/mailman/listinfo/acme > > > > -- > > Best regards, > Kathleen > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme
- [Acme] Issue: Allow ports other than 443 Salz, Rich
- Re: [Acme] Issue: Allow ports other than 443 Russ Housley
- Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
- Re: [Acme] Issue: Allow ports other than 443 Douglas Calvert
- Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
- Re: [Acme] Issue: Allow ports other than 443 Randy Bush
- Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
- Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
- Re: [Acme] Issue: Allow ports other than 443 Randy Bush
- Re: [Acme] Issue: Allow ports other than 443 Hugo Landau
- Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
- Re: [Acme] Issue: Allow ports other than 443 Randy Bush
- Re: [Acme] Issue: Allow ports other than 443 Kathleen Moriarty
- Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
- Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
- Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
- Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
- Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
- Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
- Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
- Re: [Acme] Issue: Allow ports other than 443 Phillip Hallam-Baker
- Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
- Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
- Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
- Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
- Re: [Acme] Issue: Allow ports other than 443 Rob Stradling
- Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
- Re: [Acme] Issue: Allow ports other than 443 Darren J Moffat
- Re: [Acme] Issue: Allow ports other than 443 Eliot Lear