Re: Proxy server hit... Any ideas?

Software Update Services (SUS) may help you, see:

http://www.microsoft.com/windows2000/downloads/recommended/susserver/default.asp

or

http://www.microsoft.com/windows2000/windowsupdate/sus/susfaq.asp

If you don't trust automatic updates, don't bother reading any further (then again, if you have 30,000 hosts how else are you going to do it?).

Setup a protected server to get the updates from M$. Then test the updates in your test environment. If the updates pass all your tests, then Approve and distribute the updates to another internal SUS Server. Your client hosts then pick up the only the updates that you have approved from your own internal SUS server.

Trouble is, you need to have installed the Automatic Updates client software on all your Windows clients beforehand :-( It's available for Win2000 (included in SP3 but is also available separately) and WinXP but it's not available for WinNT :-(

                    Valdis.Kletnie

                    ks@vt.edu            To:     Emeric Miszti

                                         cc:
incidents@securityfocus.com, (bcc: Toby Felgenner/ICC)
                    22-11-02 05:12       Subject:     Re: Proxy server
hit... Any ideas?
                    AM

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

On Fri, 22 Nov 2002 00:52:42 GMT, Emeric Miszti said:

> 1) Ensure that you have an effective perimeter firewall that blocks all
> incoming traffic to the new box

Excuse me while I fall over laughing. I have some 30K hosts on my network, and there's no really scalable way to say "OK, this box is about to be upgraded, disable its HTTP access to anything other than windowsupdate" and then 3 hours later "OK, let it talk to the rest of the web again".

The rest of Emeric's points are quite good - but sometimes it's not as easy as it looks... ;)

--
                                          Valdis Kletnieks
                                          Computer Systems Senior Engineer
                                          Virginia Tech


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com