Re: a whitelist for outgoing syn port 80, 443 traffic for hosting

[Ken A <ka@pacific.net>]

R. DuFresne wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Wed, 7 Feb 2007, franck wrote:
> 
>> --[PinePGP]--------------------------------------------------[begin]--
>> Ken A wrote:
>>>>>> Is anyone aware of a whitelist of hostnames of port 80,443 OUTGOING
>>>>>> traffic that should be considered 'normal' in a hosting environment?
>>>>>> ie: SYN traffic to ups.com, authorize.net, technorati, for ecommerce,
>>>>>> blogging, etc..
>>>>>>
>>>>>> Categorizing traffic as good/bad is useful in this day of many php
>>>>>> remote file include bugs.
>>>>>>
>>>>>> Thanks,
>>>
>>> Maybe this is what you are looking for :
>>>
>>> http://someonewhocares.org/hosts/zero/
>>>
>>>> Thanks, but I'm looking for a whitelist for a fairly wide range of web
>>>> applications, not a blacklist. There are plenty of good blacklists out
>>>> there. surbl.org, uribl.com , etc. :-)
>>>> Ken
>>
>>
>> As a matter of fact, I thought something you can put in a blacklist
>> could be useful, because it cannot be in the whitelist you are looking
>> for. But, thinking about it again, it is quite clear I would prefer a
>> small whitelist rather than a very huge blacklist.
>>
> 
> 
> Would this not require that one beable to conclude that such "whitelist" 
> ensures tha the hosts in it are "secure"  have never been compromised, 
> and never will be compromised?   If this is what is sought, such a list
> would be impossible to build. 

What I need is a list of hosts that are commonly connected to via port 
80,443 by common web applications in a common web hosting environment, 
with blogs & shopping carts. Perhaps 'whitelist' was a bad choice of 
words? I don't think the DoD would use this list. The security of remote 
systems in such a list is of significant importance, but, the difference 
between allowing outgoing SYN packets to ups.com as opposed to 
geocities.com is level of trust.

Ken A.
Pacific.Net


  It is not possible to ensure the
> integrity of a system over time, only at a point in time to the dregree 
> the server was audited to.
> 
> Thanks,
> 
> Ron DuFresne