pop3 open?

Russ · 02-06-2004, 23:25

I've just done a firewall test and it came up saying port 110 was open - I use Spam Inspector if that's any help and I'm running Zone Alarm Pro....help!

carlingman · 03-06-2004, 01:01

Quote:

Originally Posted by Russ D

I've just done a firewall test and it came up saying port 110 was open - I use Spam Inspector if that's any help and I'm running Zone Alarm Pro....help!

AFAIK this port should only be open if you are running a mail server.

Not sure what AV your using but for Nortons 2003.

Norton Personal Firewall 2003 for port 110.

Normally the port is used by e-mail to send and receive mail.

You can configure rules though for port 110.

Open Norton Internet Security window, choose personal firewall.

Choose Configure, then advanced, then general rules then add and the add rule box should appear.

Choose allow internet access and next.

You should then get a new box.

Choose connections to and from other computers and next.

Another box appears and if you are not running a mail server choose "Only the computers and sites listed below" and then add.

You should then see a specify computers box appears..

You can then enter addresses on their own or in a range if you have a network.

You can also limit this to your ISP.

There then should be an option to click and close the box and choose next.

Then you should get a new box where you can select TCP & UDP,

Choose only them types and then add.

You will then get the option to specify ports.

Choose known ports and local and look down the list and tick port 110 and ok.

In the tracking box, wack on tracking options and next and in the next box that shows up give the rule you have just created a name then next and finish.

Look down to the bottom of the rules list and and click the move up button so the rule is at the top and click ok.

Alternatively ignore all of the above if you have not got Nortons etc.

But you can do similar in Zone Alaram as well by creating rules.

**Paul** · 03-06-2004, 01:17

Quote:

Originally Posted by Russ D

I've just done a firewall test and it came up saying port 110 was open - I use Spam Inspector if that's any help and I'm running Zone Alarm Pro....help!

That would be Spam Inspector.

It runs locally on port 110 - your e-mail client then connects to Spam Inspector and SI then connects to your ISP's mail server.

Many anti-spam programmes work this way (such as PopFile which I use).

greencreeper · 03-06-2004, 17:34

In Spampal, which sounds a similar product (email proxy), you can configure whether it just listens locally or not. Basically, you set it to listen on 127.0.0.1 and only accept requests from 127.0.0.1 (i.e. localhost).

Russ · 03-06-2004, 17:35

Ok ok, someone speak english please......I'm running ZAP and Norton AV 2004, how do I deal with this?!?

greencreeper · 03-06-2004, 17:39

Quote:

Originally Posted by Russ D

Ok ok, someone speak english please......I'm running ZAP and Norton AV 2004, how do deal with this?!?

Find the configuration settings for Spam Inspector - look for settings relating to the IP address it listens on and some sort of access control that specifies what IP addresses can connect. Should only listen and allow locally. Sounds like you're providing a service to the Internet

You could block incoming connections but that would be a bodge and may prevent Spam Inspector from working correctly.

**Paul** · 03-06-2004, 18:05

Quote:

Originally Posted by Russ D

Ok ok, someone speak english please......I'm running ZAP and Norton AV 2004, how do I deal with this?!?

You don't - there is nothing you need to do - it is working as expected.

Russ · 03-06-2004, 18:09

But can someone get in that way though? It's an open port.

**Paul** · 03-06-2004, 18:14

Quote:

Originally Posted by Russ D

But can someone get in that way though? It's an open port.

Someone has been reading too many security warnings

- open port does not equal problem.

Short answer is no - every pop3 server in the world has port 110 open, but I've yet to see anyone hack into them via it - and in this case it's almost certainly only open on your machine anyway - not to anyone else.

greencreeper · 03-06-2004, 18:18

Quote:

Originally Posted by Pem

You don't - there is nothing you need to do - it is working as expected.

I don't see how a firewall test could say that port 110 was open unless you could connect to the port from the Internet, which suggests that an email server or proxy has a "proper" IP address rather than 127.0.0.1 This isn't correct surely

greencreeper · 03-06-2004, 18:29

Quote:

Originally Posted by Pem

Someone has been reading too many security warnings

- open port does not equal problem.

Short answer is no - every pop3 server in the world has port 110 open, but I've yet to see anyone hack into them via it

Surely that's entirely dependant on the software providing POP services? Flakey software could well expose the host machine to an attack.

Quote:

Originally Posted by Pem

- and in this case it's almost certainly only open on your machine anyway - not to anyone else

Heck of an assumption to make!

darkangel · 03-06-2004, 18:32

russ do u have an ntl proxy specified?

Russ · 03-06-2004, 18:34

No - I'm running through pipex...

darkangel · 03-06-2004, 18:47

Quote:

Originally Posted by Russ D

No - I'm running through pipex...

ah k forgot that

, it certainly look likes 1 app is holding the port open, have u check to make sure the port is actually open using netstat?
you could eliminate the programs 1by1(unless somebody knows a app) and then specify that the programs only connects port 110 to specific ip?

SMHarman · 03-06-2004, 19:01

Your mail client is effectivly asking a local port 110 for mail. That then tells ZA to ask the pipex mail server. It drops it into the ZA inspection area, checks it then passes it back to the mail client.

Port 110 has to be open for this to work.

If you look at the pop mail settings in your mail client they will be slightly different to those you may have originally input as ZA has modified them to act in this manner.