Zone Alarm Plus/Pro Program Options: comments

Please post comments in regard to this thread over here, to avoid pollution.

Thanks in advance!

paul

 

That's great. I really like to see programs limited to using just what is absolutely necessary in order to run. (A kind of "least privilege" thing.) It's a reason why I also run a sandbox application on my system (Tiny Trojan Trap).

Another thing I'm trying out is I've made a second copy of Internet Explorer on my system. (I use IE as my default browser.) Then, in ZA Plus, I've restricted the original copy of IE (iexplorer.exe) to having only Trusted Zone access and a limited set of ports and protocols. (Specifically it gets DNS; HTTP-80, 443 & 8080; and UDP 1024-5000.)

If any malicious program fires up a default IE session, it ends up with very limited network access. Meanwhile, another version of IE, under a different name, gets more open access in ZA+, so that I can actually surf. It's been an interesting experiment, so far.

 

Hi Yinda,

Can you clarify this for me a bit? When you state: "Each time Windows is restarted, OE displays the error message..." do you literally mean that during or at the end of booting up, this OE error message pops up? Or do you simply mean that the first time you run OE after a boot, whether a minute after booting or hours later, you get this error?

It is an important distinction because the first case implies that OE is running in the boot process, and perhaps it's attempting to get out before ZA is ready to allow it. Basically, a timing issue. The second case could show a very different problem. If ZA does not handle an access right the first time you do something to trigger it, but, after making an adjustment, running it, and setting ZA back, it works correctly from then on, that could show that your ZA true vector database might have an inconsistency and need rebuilding.

 

If you need to refresh (rebuild) the ZA True Vector database because it is not saving settings or because it appears to "get confused" with settings, then you can follow the instructions at this page (item #10):

http://www.zonelabs.com/store/content/support/zapIssuesFAQ.jsp#10issues

But, be aware that the True Vector database stores all of Zone Alarm's custom settings. All the trusted sites, the program permissions, the specific firewall block and allow settings, everything. You'll need to redo these after refreshing the database. Once you've done it a few times, it's not hard, but, make sure you know what settings you've made before you wipe out the database. When they are gone, they are gone.

It may not fix your problem, but, it's one of the first recommendatioms whenever ZA starts acting oddly, such as how you described. Read the link over and if you have questions, ask them here before trying it.

Edit - typos

 

Yinda, what other hosts / servers are in your Trusted Zone, as seen in the ZA > Firewall > Zones screen? Do you have your ISP's DNS servers in the Trusted Zone? If not, you will need to add them. Since OE will only be able to access Trusted hosts in this configuration, the DNS servers must be in the ZA Trusted Zone. (I'll have to edit the original config post to reflect this.)

Let me know if this fixes it.

Thanks,
LowWaterMark

 

Yinda,

It's sounds like you have your email servers covered well, but, you need to add your two DNS servers to the ZA Trusted Zone. You don't add those by name, (since DNS servers are needed to resolve names), you add them by address or range. I can not say that the "network" that was added covers your DNS, usually it doesn't, and most times the "networks" are added as "internet" zone not "trusted", for security reasons.

Do you know the IP addresses of your ISP's DNS servers? You can just look on your system when you are connected and it'll tell you your current DNS servers. If you are on NT/2K/XP, go to a CMD window (Start menu > Run... > CMD) and type: ipconfig /all
- It will list DNS servers there.

If you are on Windows 9x or ME - goto Start menu > Run... > winipcfg
- In that screen, hit the "More Info>>" button and look for DNS servers line and notice there is a little box next to it with a "..." - you hit that to see other DNS server(s).

Add these as separate trusted addresses into ZA and try OE again.

 

Very good. This way your PC won't be "trusting" all the other users on your ISP. I'm really glad this worked for you. I'll be updating the other thread to make note of this. Thanks for helping to make it better!!

Best Wishes,
LowWaterMark

 

I thought about providing a configuration for Internet Explorer, but it's rather more complicated for people than Outlook Express simply because IE is IE, the "everything" program from Microsoft. It does too much and everyone uses it a little differently.

But, let's look at a simple set of IE rules, from a generic firewall perspective...

[pre]Access Type Source Destination Description
Allow UDP MyComputer:Any DNSservers:53 DNS
Allow TCP MyComputer:1024-5000 InternetZone:WebPorts Webservers
Allow UDP MyComputer:1024-5000 MyComputer:1024-5000 Loopback
Block Any Any Any Block the rest[/pre]DNSservers is a Group setup in Firewall panel > Expert tab > Groups button. It is simply a list of all my ISP's DNS server (added by hard-coded IP address). My ISP provides 4 DNS servers.

WebPorts is another defined group except this one is a protocol group not a locations group. In there I have TCP ports: 80, 443, 8000 and 8080.

Now this generic setup when entered as ZAP expert rules applied to Internet Explorer works on my system for basic browsing. In fact, I use a version of this that targets (destination) just the webservers of my Trusted Zone, rather than the Internet Zone as shown above. By doing that, I can browse trusted webservers and even if there are images, web bugs or other things on the webpages I'm viewing, I only end up accessing the trusted sites. All else is blocked.

There are times when I want this, for example, I use such a browser configuration when reading my ISP provided web-based email with IE. It ensures I don't fire off any webbugs out somewhere on the Internet, and blocks any other object sources not in the trusted zone.

However, the downside of the IE configuration described above is that it is restrictive. For example, normally IE can do FTP access directly. These rules prevent that because there are no FTP ports being allowed here. I'm sure there are other protocols that IE can run embedded that these rules would also prevent. But for me and what I use this for, it works great.

In any case, I rarely advise people to do this because it takes some effort on their part to figure out exactly what they need, in their specific circumstances.