0

We've currently outsourced some work to a company to migrate our website over to a CMS system. They've requested we allow the web server to make direct outbound port 80 calls to external sites - allowing the entire machine unrestricted access to the internet.

For years we have operated our site without this, and I really don't like the idea of allowing this kind of access from any machine besides our gateway; particularly after a recent event where an application conflict on our ISA server caused it to waste a massive amount of bandwidth.

I can understand their reasoning (grabbing dynamic content from other sources etc), however I'd really prefer them to use the proxy server for all outbound access.

Am I being unreasonable? In my eyes, allowing full access is unneccessary and just asking for trouble...

3 Answers 3

2

I am not a security expert but I agree with you and think you have two approaches to this:

  1. Deny the request and explain that corporate policy mandates all outgoing requests go through the proxy server.
  2. Confirm their request is granted but setup some transparent proxying firewall rules thereby forcing all 80/443 traffic through the proxy server.

Answer 1 is more inline with corporate policies, Answser 2 keeps all parties happy :)

Hope these answers agree with your train of thought and maybe you will get some great answers from more enlightened people than myself.

2

I think "bollocks to that" is the only reasonable response. If they can give you a list of sites/addresses, or a really good reason for it, then it can be considered, but just "give us unfettered external access" shouldn't wash.

1

It's not unreasonable, just make sure they have a good reason if it makes you uncomfortable. Every web application I've been involved in required some sort of outgoing access to hit partner APIs, download data feeds or send notifications to customers. At larger sites with many such applications and hundreds, if not thousands of partners, it becomes a pretty unreasonable task to expect each endpoint to be specially granted access.

On the practical side, it also becomes a pain if your production servers can't fetch software updates.

Our arguments are always whether to NAT or not NAT and the question of no access or proxies have never come up. Re proxies: that's just another likely point of failure, how much bandwidth would you save by putting one in?

Seriously, what are you afraid of?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .