| User and Source [message #147001] |
Thu, 07 November 2019 12:48  |
jalal.attar
Messages: 2
Registered: November 2019
|
|
|
|
Dear Sir,
first sorry for my BAD english. ok?
i was used working with Cyberoam/Sophos appliance for some years and I'm testing to migrate to KERIO. so i decided to test it.
I'm working with 9.3.1 version:
The Most important missing in the software are User-Level. in the Firewall Rule, Sources concept are (user;ip-address;group; and ....) but it was so useful if user was separated from source. so, We can create a rule that indicate to specific User with Specific IP.HOST separately. (same as Cyberoam)
|
|
|
|
|
|
|
|
| Re: User and Source [message #147016 is a reply to message #147009] |
Sat, 09 November 2019 23:02  |
billybob
Messages: 35
Registered: October 2018
|
|
|
|
I have used astaro (sophos) for years, first at work and then at home. When astaro was acquired by sophos, I tried Kerio control. Its one of the easiest firewall I have ever used and has ALL the features that you are going to need. Too bad they don't offer a home license even for a small fee as I would not use anything else if there was such an option.
|
|
|
|
| Re: User and Source [message #147026 is a reply to message #147016] |
Tue, 12 November 2019 04:57 |
ehsan-nikavar
Messages: 3
Registered: October 2019
|
|
|
|
Dear guys,
I want to share my experience with you.
As you know when a user intends to use the Internet, he/she must be authenticated. Authentication URL is as below:
kerioserver:4080/login/?orig=baaaaaaaaa%3D%3D&dest=aaaaa aaaaaaaaaaa&host=Maaaaaaaaaaaaaaaa%3D%3D
I have found a vulnerability in Kerio Control that could be misused by attacker to obtain a valid user account.
By using this vulnerability, attacker could send the link to the victim and ask him to logging to his account.
When user logged in, attacker could referesh the browser and has access to victim account.
In other hand, attacker who has not yet authenticated will log in with the victim account and can use the Internet.
It should be noted that testing has been performed when the authentication settings are set to "NTLM".
I already reported this vulnerability to Mr. Ian Bugeja, so thanks to him for his attention.
Ehsan Nikavar
|
|
|
|
|
|
|
|
| Re: User and Source [message #148274 is a reply to message #148266] |
Sun, 14 June 2020 18:47 |
billybob
Messages: 35
Registered: October 2018
|
|
|
|
No doubt sophos is great for home users as it is FREE. However recent hack that caused remote code execution from user and admin portals from WAN (default configuration) was a deal breaker for me. I can overlook a lot of things but if I can't trust the integrity of my firewall, what the point of having one.
Regards
|
|
|
|
Members
Search
Help
Register
Login
Home
