Is there a reason you have that socket open at all? Leaving it enabled
but blocked by the host-based firewall (which should block it by default,
unless you have disabled it for some odd reason) should prevent any
outsider from even seeing it see it as an option. You can still use it
yourself by either opening certain boxes to it, or tunneling in over SSH,
or accessing it from the box itself, but that's all assuming you even need
it at all.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

Is there a reason you have that socket open at all? Leaving it enabled
but blocked by the host-based firewall (which should block it by default,
unless you have disabled it for some odd reason) should prevent any
outsider from even seeing it see it as an option. You can still use it
yourself by either opening certain boxes to it, or tunneling in over SSH,
or accessing it from the box itself, but that's all assuming you even need
it at all.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.

ab;2483455 wrote:
Is there a reason you have that socket open at all? Leaving it enabled
but blocked by the host-based firewall (which should block it by default,
unless you have disabled it for some odd reason) should prevent any
outsider from even seeing it see it as an option. You can still use it
yourself by either opening certain boxes to it, or tunneling in over SSH,
or accessing it from the box itself, but that's all assuming you even need
it at all.

Thanks, ab. We have both 8028 and 8030 open as default so that we can pull up iMonitor when we need to. I did read in an article that another option is just to not load the httpstk modules as well. I'll have to check to see what our options are for host-based firewall configs. I guess what I'm reading from that, though, is that there doesn't seem to be a simple "select your supported TLS version(s)" for the HTTP stack.