Bypassing SMTP and POP block

Hi Guys,

I have been trying to sus this out most of the evening.
Where I have just started things are a bit disorganised.. little details, like passwords for Admin, VOIP Admin, and basic network config are still to be supplied.. that and My weakest areas of skill is where I have been in greatest demand.. thats life..

The problem I have.. I have number of Sub-contractors who wish to acces their companies email.. but.. it appears that atleast ports 25 and 110 are blocked ie smtp and POP access.. for some of these guys its ok they can use yahoo/google/(yetch) MSN etc.. one company has a webmail setup.. I had been instructed by one of City Admins to tell them to use Mail2Web
Problem is A couple of the noisest contractors - and more valuable to the project.. want/demand to be able to use their email client software.. these old roosters are bloody good at their job of knowing their steel and how to weld it.. but need super hand holding in front of a PC..

So my list of possable solutions to the blocked Ports.. Proxy the connection.. I know the co has had proxy connectins for clients.. I have never used a proxy for anything.. is this reliable?
is there such a thing as a SMTP/POP Proxy?

As commented .. further encourage the use of a email to Web mail server

Talk the Admins for the MAilservers to change their SMTP and POP ports.. prob here is I Know one (OZ's big one) will not comply....

Other solution.. I havent approached..

Ideas here to help me to take submissions to respective Admins tomorrow will be helpful..

BTW: I am only on the site a day a week at the moment.. but the issue seemed insignificant last week, but is serious this week.. I wont be letting this go to many days..

Cheers

I for one would never ever allow 3rd parties on my network with their own equipment.. I would give them an account and emailbox so they can logon and use our machines....

Simplest solution would be to create a seperate (small) LAN with their own Internet acces..

under: what about a http tunnel? Although i cant agree about these kind of software usage (can open a hole on the network) i think it will work for tunnelling outlook to access pop3/smtp servers.

some kind of tunne like this: http://www.htthost.com/faq.boa?question=mail

I've never tried with mail, but it works with instant messenger and other sock4 compliant software.

Can you not just unblock SMTP and POP to the relevant mail servers and leave them blocked to all others?

Are the emails being checked directly from a pop server or an exchange server?

Is this Intranet email or Internet email?

One thing I can think of is if they use email in the office have them setup a rule to forward email to an Internet Based account and check it through gmail/yahoo/hotmail.

Simple and sweet.

http://e-mailanywhere.com works great as well, No server info needed in most cases. However if they have 25/110 blocked it may not work.

Thanks guys..

Been on the job for 2 days and am yet to be briefed on policies and network layout/profile etc.. While in many areas I just change location, in the most important areas I am still just finding my legs.

SirDice, yes I agree.. problem .. All our communications is via fiber direct to Brisbug, and with the exception of voice (ala VOIP), is then routed via Syd-vegas to dot-FR..there it pops to the net.. so if I logon to AO from Work I have a FR IP..
BTW: ATM those that need access to the network are allowed limited access in the Domain. the ppl in question only have internet access and access to printers..it is usually on our machines .. so I have the task of checking the safety of the machines

TS - I am stuck between the French HQ's Firewall and a Sub contractor about to throw an expensive tantrum. To the best of my knowledge I am not in a position to change firewall settings

My preference would be a mail to web service, but as I said the preference of the simple useres is their OLEXP and OL. I heard that some dont handle large attachments well. These guys have obviously had issues before

I made the recomendation of the regular web based services..Yahoo/MSN/Google.. not acceptable

cacosapo - I will check out your idea..

Quote:

---

Originally posted here by Und3ertak3r
... A couple of the noisest contractors - and more valuable to the project.. want/demand to be able to use their email client software.. these old roosters are bloody good at their job of knowing their steel and how to weld it.. but need super hand holding in front of a PC..

---

I realise you said that they are demanding it, so I guess taking a stand and just saying no, citing security, cost and/or operational limits, is out of the question?

Sometimes when we are faced with more 'experienced' colleagues we think we need to bow to their every demand, but if this is going to cause more problems than it fixes (and you are the man with the keys...), then it might be best to stick to your guns... and say No.

Al.

Undies:

You are in the "shitty spot" right now.....

But.... Since you are stuck between the Frogs who control the FW and the contractor that has the "goods" it's the perfect time to palm it off "upwards". Two days in the job - no access to the "system" - pushy users = required users - all equals a management decision.... It certainly isn't yours since you don't have the power to effect any decision you might want to make....

Trot on up to the boss and tell him you have no access to the systems that would allow the contractors to do what they want to do and that the people that do won't alter their system to allow the contractors to do what they need to do.... Then step back and duck.... ;)

BTW, WTF are you doing working for a company where Frogs have any power..... Are you working for the UN????? 'Cos that has to be the only place anyone would allow them power.... They probably shouldn't be allowed electricity in the first place - problem solved.... :D

Nice answer TS.

Personally since they are contractors I would tell them that the company email/computers etc are for full time company employees only. They will have to use the nearest Internet Cafe if they want to check their email.

I had a similar prob a while ago, but I was in the position where I could configure the neccessary hardware/software to allow or deny it. I was about to do it but then realised that company employees sign a contract and are bound by the companies acceptable use policy when using the network and network resouces.

They know and aggree that their email/web surfing can and will be monitored. Your contractors may not have signed such a contract and if the find out your are monitoring what they are doing whilst online they could have some kind of claim againt you/your company, likewise if one of them somehow manages to download a virus/trojan that brings the network down etc (worse case i know but hey, its possible) you will have no come-backs unless they have agreed to your acceptable use policy.

My advise, if you can get away with it, tell them tough **** they will have to check their emails when they get home!

Quote:

---

They will have to use the nearest Internet Cafe if they want to check their email.

---

town is 50km away, and the email is for corp traffic..well that is the primary reason.. the wages meter in one room spins faster than a a turbo jets intake fan...

I was told it is a Swis co.. untill i sat in on a video conf.. bit like a scene out of a french version of Are You being Served...(nihil may be just able to remember that..the english version)

In my opinion subcontractors are people that have YOU as a client .... You pay them, they shouldn't be able to rant !!! Quite a nerve if you ask me ...

Anyway I have to agree with Nokia, and I would advise my boss in such matters. That way at least your back is covered. Typical case to escalate up to a boss ....

Cheers

There really shouldn't be an issue here.

Your security policy should already clearly outline how non employee network access is treated. In my case, if they walk in with a laptop, they get placed on a VLAN out to the internet that has no ACLs to our WAN. Period. End of story.

We do get contractors inhouse that need access to our WAN. In this case, they get a Govt. issue laptop that we *know* meets the security requirements in our policies. If the vendor starts complaining, we simply show him the door and let his company know why they lost a nice profitable contract. We have a clause in all contracts that allows us to remove contractors for failure to comply.

In my world, the squeeky wheel doesn't get the grease, it gets replaced with a new wheel. ;)

--th13

Quote:

---

In my world, the squeeky wheel doesn't get the grease, it gets replaced with a new wheel.

---

HORSE !! that actually sounds intelligent .....
So no, really what do you do when your wife squeeks ? Replace it with a new one ? I like the idea though.

Cheers.

Quote:

---

I have number of Sub-contractors who wish to acces their companies email.. but.. it appears that atleast ports 25 and 110 are blocked ie smtp and POP access..

---

Why not simply unblock port 25(SMTP) and port 110 (POP3)? Also,

Quote:

---

I had been instructed by one of City Admins to tell them to use Mail2Web

---

You informed them of this information but they still want yet DEMAND

Quote:

---

want/demand to be able to use their email client software

---

They don't like it tell them to go take it up with your boss.

Und3ertak3r why would you 'Proxy the connection'?

Quote:

---

So no, really what do you do when your wife squeeks ? Replace it with a new one ? I like the idea though.

---

That rule doesn't apply/work at home. ;)

th13 has it right. They are your customers not the other way around.

The contractors need to have certain realities explained to them.

1. They are already allowed to place thier own laptops on Your Network. They should be happy you even allow that. In most sites I visit this is cited as one of the number one security risks to the enterprise....unmonitored, unmanaged devices on the network.

2. Your security administrator, perhaps as high as the CSO has made the decision to block the ports. It's as solid as that, and without knowing better probably above your paygrade to change. Let your boss know, and start refering them to your management.

3. You already allow them internet access across your network. Thats about as much and truly more than they should expect. And if they are as experienced and knowledgable as they claim then they are well aware of thier fortune and are simply "pushing the FNG" to see how far they can get. Take the stand now while you still can.

Other advice, I agree with previous statement along here, if you HAVE to allow them to use thier own laptops than insist on certain security measures (anti-virus etc) on thier systems and make sure they are locked into the VLAN.

While most client sites I go to do Not allow outside hardware, one or two that do have always instisted on a complete virus scan and security cataloguing of my system before I took it onto thier network.



Cheers,

FyreMouse