Blokace sitovych spojeni pro sluzby
Resim problem s Vista32bit. Mam nekolik SW, ktere potrebuji spoustet jako sluzby z duvodu hlidani jejich neustaleho behu (FTP, HTTHost, MurMur, atd atd...) Problem je v tom, ze od dob Vist tu mame "session 0" pro sluzby, ktera je kompletne "odstrihnuta" od session 1+, ale vsechny sluzby se prave spousteji pouze v "session 0".
Pokud spustim programy vypsane vyse jako sluzby, nelze se k nim z venku pripojit - ve firewallu samozrejme vyjimky pro porty jsou, ale s nejvetsi pravdepodobnosti je problem prave v tom, ze "session 0" je blokovana dusledneji (je to urcite krok dobrym smerem). Ja potrebuji tento blok pro specificke sluzby zrusit. Nasel jsem neco o tom, ze to snad lze
Citace:
Service network access restrictions
Over the years, services running in Windows have become more and more dependent on being accessible to the network or accessible by other computers on your network. Services that face the network in this way are more vulnerable to attack since, in order to work their magic, these services are just waiting for remote connections, making them more susceptible to malicious activity.
Under Windows Vista, a developer can restrict a service's access by TCP/UDP port, protocol, or even by the direction that network traffic is flowing. When restrictions like these are in place, attempts to access a service using other methods will be blocked, protecting that service from some attack vectors.
Windows Vista services can also be configured to not allow network access in which case the service cannot be remotely exploited, but neither can the service make connections to remote services. However, not every service really needs network access.
Windows Vista's service-level network access restrictions hardening feature works in a similar fashion, as the service isolation feature in that the restrictions are implemented through the use of service-level SIDs.
Kód:
http://resources.zdnet.co.uk/articles/tutorials/0,1000002006,39288962,00.htm
nicmene nejsem z toho nejak moc chytry, kde to pripadne lze zaridit / nastavit.
Pokud tu aplikaci pustim klasicky rucne pres "session 1" nebo ji jako sluzbu potom rucne (bohuzel automat nejde) prepnu take do "session 1", tak problem s pripojenim zmizi.
Poradi nekdo zkusenejsi?
