I beg to disagree with your comment. Allowing admins of networks to personally decide the level of security they want to have in their individual networks flies in the face of all security standards!
Those standards were designed to protect everyone who installs server based software. If we start allowing vendors, ie: IPSwitch, to create a new security standard for a product that is designed to access the internet as part of its overall design, we're throwing those standards out the window. Any product that is designed to work in conjunction with any kind of internet access should be designed to take into consideration the security standards and best practices that have become commonly acceptable over the history of the networking products and hardware with which they are designed to work. If anyone modifies the security access levels of their servers, either as part of a software installation, or as part of a deliberate measure, they are opening themselves up to every hacker, virus and worm crawling through the internet. Security on any web or mail server should be set to the maximum possible level, giving both users and software only the absolute minimum access level necessary to complete the task for which the software is designed. Any variation in that model will invite chaos! Given the current security problems within IMail we will not deploy the product until we are 100% satisfied that all of the security access issues have been addresses and fully resolved. Bruce Barnes ChicagoNetTech Inc -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Gregg Sent: Thursday, January 05, 2006 08:15 To: [email protected] Subject: Re: [IMail Forum] Status of IMail 2006.02... > At 1/4/2006 08:50 PM, you wrote: >>As for your statement addressing explaining the long hold times >>(staying with a customer as long as it takes). In all fairness to >>your other paying customers, IPSwitch should support *one* set of web >>installation instructions and not spend time working with people who >>want to run modified/secured environments that require settings not >>included in the installation instructions. Securing servers is a >>basic hosting need and it is solely up to the admin of the server to >>tighten things up as required. You guys aren't IIS gurus - don't waste >>our support hours trying to be. Most .NET applications are written to >>run on default IIS installations and the burden of securing the >>underlying filesystem, impersonating users, etc... etc... are all duties of the system admin. > > On many levels I'd agree, however, in this case, the vendor is > *requiring* a specific configuration, and depending on certain > software. The fact that we can't, say, run Apache, means that they > have to support another product only to the degree that their software > will work. They need to be able to tell the customer how to setup a > system so that they're not liable for anything that may come of using > the third-party software. It shouldn't be hard, just a simple set of > instructions, but they need to be made available so no harm is done. That was the point I was making... Publish a set of instructions detailing the exact steps required. If admins don't like the security model or level used by the product, it should fall to teh admin to implement what they want. Regards, David Gregg dgSoft Internet Services +1 (949) 584-1514 -- mxGuard for IMail The no-nonsense antispam and antivirus solution. Download a free 30-day trial at http://www.mxguard.com/postmaster/freetrial.asp -- To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
