Blocking programs with IPtables

Blocking programs with IPtables

[Leonardo Teves]

Hi,
I´m new in this forum, and i have a little question.
Is there a way to block some programs with Iptables?
I want to block Microsoft Outlook recovering mail from Imap server.
I want to force all users to use Thunderbird as mail client without 
deinstalling Outlook from every workstation.
Is my question clear?
Any ideas?
Thanks in advance,

Leo.

pd: Sorry for my poor English. I´m from Argentina, so my first 
"protocol" is spanish :-)

Re: Blocking programs with IPtables

[Antony Stone]

On Friday 30 July 2004 3:38 pm, Leonardo Teves wrote:

> Hi,
> I´m new in this forum, and i have a little question.
> Is there a way to block some programs with Iptables?
> I want to block Microsoft Outlook recovering mail from Imap server.
> I want to force all users to use Thunderbird as mail client without
> deinstalling Outlook from every workstation.
> Is my question clear?
> Any ideas?

Your question is clear.

This cannot be done with netfilter (because all imap connections look the same 
to netfilter, no matter what client or server software is being used)

I cannot think of another way to do it either, because I would be surprised if 
Outlook sent anything in its connect message to identify itself as Outlook 
(the server end of a connection often does, but the client end usually 
doesn't, except for web browsers).

Sorry - but perhaps someone else here can prove me wrong?

Regards,

Antony.

-- 
Microsoft may sell more software than any other company, but McDonald's sell 
more burgers than any other company, and I think the other similarities are 
obvious...

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Blocking programs with IPtables

[Leonardo Teves]

Thanks Antony,
i will continue looking for a solution,
sorry if subject was a off-topic.
Leo.

Antony Stone escribió:
> Your question is clear.
> 
> This cannot be done with netfilter (because all imap connections look the same 
> to netfilter, no matter what client or server software is being used)
> 
> I cannot think of another way to do it either, because I would be surprised if 
> Outlook sent anything in its connect message to identify itself as Outlook 
> (the server end of a connection often does, but the client end usually 
> doesn't, except for web browsers).
> 
> Sorry - but perhaps someone else here can prove me wrong?
> 
> Regards,
> 
> Antony.
> 

Re: Blocking programs with IPtables

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 1051 bytes --]

On Fri, 2004-07-30 at 16:38, Leonardo Teves wrote:
> Hi,
> I´m new in this forum, and i have a little question.
> ient without deinstalling Outlook from every workstation.
> Is my question clear?
> Any ideas?

It's a planned feature of NuFW. So it can not solved your problem but it
will soon.
In fact, NuFW is a authenticating firewall which extend Netfilter. It's
basic goal has been extended with interesting features (QOS per user,
SSO capabilities, user activities logging). One of the next planned
feature is to have the client warn about the soft that established the
connection and to be able to filter on this parameter. You will be able
to say things like :
"I want user of the group accountant to be able to connect to IMAP
server with thunderbird if there OS is newer than WIN2K"

"I want admins to be able to connect to IMAP server with any client
software if OS is Linux"

More informations on :
	http://www.nufw.org

BR,
-- 
Eric Leblond <eric@regit.org>
NuFW, Now User Filtering Works : http://www.nufw.org

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Blocking programs with IPtables

[Leonardo Teves]

Thanks Eric!
I was checking info about NuFW, and it's very interesting. Will look for
more news about this project.
Anyway, could this:

http://www.netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO-3.html#ss3.18

be a solution?
Thanks again,
Leo.

-- 
"Cristo vuelve pronto, prepárate"


Eric Leblond wrote:
> It's a planned feature of NuFW. So it can not solved your problem but it
> will soon.
> In fact, NuFW is a authenticating firewall which extend Netfilter. It's
> basic goal has been extended with interesting features (QOS per user,
> SSO capabilities, user activities logging). One of the next planned
> feature is to have the client warn about the soft that established the
> connection and to be able to filter on this parameter. You will be able
> to say things like :
> "I want user of the group accountant to be able to connect to IMAP
> server with thunderbird if there OS is newer than WIN2K"
> 
> "I want admins to be able to connect to IMAP server with any client
> software if OS is Linux"
> 
> More informations on :
> 	http://www.nufw.org
> 
> BR,

RE: Blocking programs with IPtables

[Steve Wakelin]

Easiest way is to setup your IMAP server on a different port other than 143 and then configure Thunderbird to use that port.  Disable access to 143.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: 30 July 2004 15:48
To: netfilter@lists.netfilter.org
Subject: Re: Blocking programs with IPtables

On Friday 30 July 2004 3:38 pm, Leonardo Teves wrote:

> Hi,
> I´m new in this forum, and i have a little question.
> Is there a way to block some programs with Iptables?
> I want to block Microsoft Outlook recovering mail from Imap server.
> I want to force all users to use Thunderbird as mail client without
> deinstalling Outlook from every workstation.
> Is my question clear?
> Any ideas?

Your question is clear.

This cannot be done with netfilter (because all imap connections look the same 
to netfilter, no matter what client or server software is being used)

I cannot think of another way to do it either, because I would be surprised if 
Outlook sent anything in its connect message to identify itself as Outlook 
(the server end of a connection often does, but the client end usually 
doesn't, except for web browsers).

Sorry - but perhaps someone else here can prove me wrong?

Regards,

Antony.

-- 
Microsoft may sell more software than any other company, but McDonald's sell 
more burgers than any other company, and I think the other similarities are 
obvious...

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Blocking programs with IPtables

[Antony Stone]

On Friday 30 July 2004 4:04 pm, Steve Wakelin wrote:

> Easiest way is to setup your IMAP server on a different port other than 143
> and then configure Thunderbird to use that port.  Disable access to 143.

Except that Leonardo obviously doesn't trust his users not to surreptitiously 
continue using Outlook when they've been told to use Thunderbird - so he 
doesn't trust them not to configure Outlook to connect to the same port that 
Thunderbird connects to.

Antony.

> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
> Sent: 30 July 2004 15:48
> To: netfilter@lists.netfilter.org
> Subject: Re: Blocking programs with IPtables
>
> On Friday 30 July 2004 3:38 pm, Leonardo Teves wrote:
> > Hi,
> > I´m new in this forum, and i have a little question.
> > Is there a way to block some programs with Iptables?
> > I want to block Microsoft Outlook recovering mail from Imap server.
> > I want to force all users to use Thunderbird as mail client without
> > deinstalling Outlook from every workstation.
> > Is my question clear?
> > Any ideas?
>
> Your question is clear.
>
> This cannot be done with netfilter (because all imap connections look the
> same to netfilter, no matter what client or server software is being used)
>
> I cannot think of another way to do it either, because I would be surprised
> if Outlook sent anything in its connect message to identify itself as
> Outlook (the server end of a connection often does, but the client end
> usually doesn't, except for web browsers).
>
> Sorry - but perhaps someone else here can prove me wrong?
>
> Regards,
>
> Antony.

-- 
"Linux is going to be part of the future. It's going to be like Unix was."

 - Peter Moore, Asia-Pacific general manager, Microsoft

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Blocking programs with IPtables

[Gavin Hamill]

On Friday 30 July 2004 16:04, Steve Wakelin wrote:
> Easiest way is to setup your IMAP server on a different port other than 143
> and then configure Thunderbird to use that port.  Disable access to 143.

My own thoughts revolved around finding some combination of SSL options / 
authentication mechanisms that Thunderbird supports, which Outlook does not, 
thereby disabling Outlook from accessing the server..

Anyway, this is wildly off-topic - sorry :)

gdh