Subject: RE: IPP> Firewalls etc.

From: Paul Moore <[email-masked]>
Date: Thu, 11 Jun 1998 13:20:57 -0700

I think that you'll find that many corporate IT managers would
	strenuously disagree.  Your sending a print job from your desk
could: 

	- print company confidential documents in an unsecure place
	- incur print charges on behalf of the company (if you are sending
it to
	  a commercial print shop)

	The security agrument is not valid (I can copy a file to diskette
and take it home, I can remeber it and retryp it when I get home, I can
print it locally and put the paper in my pocket, I can email it, I can do a
web based file upload to a web site, I can display it on the screen and take
photos of it, I can phone my answering machine at home and dictate it). If I
am trusted to have access to the document then I am assumed to be trustable.
The only place where this is not the case is in ultra secure enviroments
(DOD Orange book Class b or greater). This will have no external
connectivity at all.

	Actually I dont see how they can incur print charges for their
company. I use all sorts of online services from my desk - I cant see how I
could incur charges to my company (I pay for them myself with my credit
card). 

	Still if a company has that degree of paranoia they wont allow any
web access at all.
	In this case they will disallow outbound POST as you point out
later.

---

From: Harry Lewis <[email-masked]>
Date: Thu, 11 Jun 1998 16:59:59 -0400

I agree with Paul. Outbound should work, by default. There are many ways to
shuffle confidential information outside a company's firewall, or spend their
money foolishly, if someone is into risking their job for excitement. Allowing
print jobs by default does not add significantly to this capability.

I think the "Internet PRINT to my office" scenario (analogous to FAX) is a
compelling feature of IPP. Paul is probably right that this will not happen
without some SA involvement, but, in my opinion, we need to be sure we all
understand how this will be facilitated.

Harry Lewis - IBM Printing Systems

[email-masked] on 06/11/98 02:09:26 PM
Please respond to [email-masked]
To: [email-masked]
cc:
Subject: IPP> Firewalls etc.

It became clear to me during the last tele conf that we need to clearly
distinguish two cases in this discussion.

1. A user inside a corporation sending print commands out into the internet.
This is the one I was always talking about

2. A printer inside a corporation being accessed from outside. It was clear
to me that this is what some others were talking about

I think that these are two very different things and we have not be clear
about what is desirable, acceptable, etc. in each case. Also I think that
some people have been discussing #1 with people who think that they are
discussing #2 (I certainly discovered that I was)
----------------------------------------------------------------------------
---------------------------
Now my views on the two cases.

#1 must work by default. I.e. if somebody on a web site or whatever has an
ipp URL then (provided I have the right client s/w installed) I should be
able to print to it, in the same way I can send email or browse a web site.

#2 Must not work by default. I.e. if I install an IPP printer (whether s/w
on an NT server or embedded in the device) then somebody outside my company
should not be able to print to it. .

This is the solution we have today. #1 works provided that the user can post
onto the internet (usually true). #2 works because most networks dont allow
arbitrary inbound posts. This is true in routed cases and in proxy cases.

The main problem that we seem to have is 'how can an admin allow #2?'. For
example PrintShopsRUs want to make their printer(s) available. Second
example is: I want to set up an IPP printer in my office as an 'internet
fax'. How can their admin configure their router/firewall/proxy to only
allow IPP traffic in? Well today's proxies dont allow inbound HTTP traffic
which rules this scenario out in the vast majority of corporate cases
anyway. For routed/firewall cases it seems that you either allow any POST to
a given IP address (OK for a real printer but not ok for a server), or we
need someway of distinguishing the traffic. If we dont do this then this
will disable this class of usage scenarios. My view is that this is of
secondary importance - given that #2 will never work for proxied
environments we should focus on #1 scenarios, which do work. For #2 people
will have to either a)trust and cross their fingers b) place the printers
outside the firewall (like their web servers often are).

I can never see the Internet Fax one working in a corporation. I mean
allowing me to setup up a printer in my office and just having it work
without any SA work. Most network admins are fanatical (rightly so) about
not allowing inbound connections, each one has has to be approved and hand
configured. They dont even allow ping in, so there is no way an admin would
allow inbound IPP traffic to all IP adresses.

The only issue I see left then is 'how can an admin prevent #1'? My
immediate response is 'why would they want to?'

---

From: Paul Moore <[email-masked]>
Date: Thu, 11 Jun 1998 15:38:34 -0700

Let me add 1 qualification to my '#1 must work by default'

If I already have 'normal' (GET, PUT & POST) web access to the Internet from
my desktop then #1 should work by default. 

> -----Original Message-----
> From:	Harry Lewis [SMTP:[email-masked]]
> Sent:	Thursday, June 11, 1998 2:00 PM
> To:	[email-masked]
> Subject:	Re: IPP> Firewalls etc.
>