Copyright: (c)2001-2002 SmartLine, Inc. All rights reserved.
Citation: PortsLock for Windows NT/2000/XP. (c)2001-2002 SmartLine, Inc. All rights reserved.


Contents
Help Contents

PortsLock™

for Windows NT 4.0, Windows 2000 and Windows XP

General Information:

•	Introduction

•	License

•	How To Register

•	Technical Support

•	Frequently Asked Questions

•	SmartLine's Software

Dialogs:

•	Main Dialog

Permissions

Auditing

Monitoring

Add/Edit Rule

DNS Name To IP Address

Set Message Count

Enter Network Password

•	Audit Log Viewer

PortsLock Log Settings

•	Batch Processing

Select Computers

•	About


Introduction

PortsLock™ is a firewall with user-level access controls for Windows NT/2000/XP. Once PortsLock is installed, administrators can assign permissions to TCP/IP connections, just as they would in managing permissions on an NTFS partition of a hard disk. It lets you control which users can access what TCP/IP based protocols (HTTP, FTP, SMTP, POP3, Telnet, etc.) on a local computer, depending on the time of day and day of the week. You can also set allowed/denied TCP/UDP ports and IP addresses for incoming and outgoing connections. PortsLock enhances access control possibilities for system administrators, helps them to build a more secure network environment, and protects corporate networks against attacks from the inside.

With PortsLock you can:

•	Block access to the selected TCP/UDP ports for defined users

•	Set allowed/denied IP-addresses for defined users

•	Control incoming and outgoing connections for each user separately

•	Control access to protocols depending on the time of day and day of the week

•	Monitor TCP/IP activity on remote computers in real-time

•	Install PortsLock on remote computers without having to physically go to them.


License

    END-USER LICENSE AGREEMENT FOR PortsLock™:

•	All copyrights to PortsLock are exclusively owned by SmartLine, Inc.

•	Anyone may use this software during a trial period of 30 days only, on one computer of a local network, at any single time. Following this trial period of 30 days, if you wish to continue to use PortsLock then you MUST register.

•	A registered user is granted a non-exclusive license to use PortsLock on one computer at a time, for any legal purpose. The registered PortsLock software may not be rented nor leased, but may be permanently transferred, if the person receiving it agrees to the terms of this license. If the software is an update, the transfer must include all updates and all previous versions of the PortsLock software.

•	An unregistered, evaluation version of PortsLock may be freely distributed, provided the distribution package is not modified. No person nor company may charge a fee for the distribution of PortsLock without written permission from the copyright holder SmartLine, Inc.

•	To register, you must complete the registration form and send it, with the registration fee, to one of the authorized registration sites.

•	PortsLock IS DISTRIBUTED "AS IS". NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. YOU USE IT AT YOUR OWN RISK. THE AUTHOR OR SMARTLINE, INC. WILL NOT BE HELD LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS NOR ANY OTHER KIND OF LOSS AS A RESULT OF OR WHILE USING OR MISUSING THIS SOFTWARE.

•	You may not use, copy, emulate, clone, rent, lease, sell, modify, decompile, disassemble, otherwise reverse engineer, nor transfer the licensed program, nor any subset of the licensed program, except as provided for in this agreement. Any such unauthorized use shall result in immediate and automatic termination of this license and may result in criminal and/or civil prosecution. All rights not expressly granted here are reserved by SmartLine, Inc.

•	Installing and using PortsLock signifies acceptance of these terms and conditions of the license.

•	If you do not agree with the terms of this license you must remove PortsLock files from your storage devices and cease to use the product.


How to register

Why You Need to Register

A registered user may use PortsLock™:

•	in any environment including commercial

•	on two or more computers in your network, depending on registration type

•	without nag screens

•	with access support and assistance

•	including ALL updates that will be released within 1 year from the date of purchase

What it Costs to Register

Following is the payment schedule to register your PortsLock software with SmartLine, Inc.:

•	Single license (ID #170345) - $50

•	Site license (ID #511266) - $2000

•	World license (ID #511267) - $5500

•	World license - $4125 (for educational institutions only!)

•	Access to Source Code - $85000

(the difference between a Site and World license is described in FAQ.)

Prices are in US dollars and subject to change without notice.

1. Order Through the World Wide Web

http://www.ntutility.com/pl/register.html

IMPORTANT! Be sure to give us the correct e-mail address when filling out the order form. We are unable to process incomplete order forms.

All registrations use SECURE protocols making it impossible for a third party to intercept your credit card information.

2. Invoices/Purchase orders

US and Canadian customers: You can fax a Purchase Order to us at (724) 850-8187, or send it to:

element 5 Inc.

P.O. Box 844

Greensburg PA 15601

USA

European customers: You can fax a Purchase Order to us at +49 221-31088-29, or send it to:

element 5 AG

Vogelsanger Strasse 78

50823 Koeln

Germany

IMPORTANT! We accept orders on account only from established companies that have faxed us a signed Purchase Order on their company letterhead. We allow an established customer a payment deadline of 30 days from purchase.

3. Fax And Phone Orders

US and Canadian customers: You can place an order by calling our toll-free order number 1-800-406-4966 or (724) 850-4689 (available weekdays from 9am to 5pm EST). Orders may also be sent by fax to (724) 850-8187.

European customers: You can fax your order to us at +49 221-31088-29, or call us at +49 221-31088-30.

IMPORTANT! Please make sure to have the program ID for PortsLock ready (see table).

4. Check And Cash Orders

If you prefer to pay by cash or check, please send payment to:

US and Canadian customers:

element 5 Inc.

P.O. Box 844

Greensburg PA 15601

USA

IMPORTANT! Please make U.S. checks payable to element 5 Inc.

European customers:

element 5 AG

Vogelsanger Strasse 78

50823 Koeln

Germany

IMPORTANT! Please make checks payable to element 5 AG (Note: do not send eurocheques in US dollars. We can only accept eurocheques in DM.)


Support

Please give the following info:

•	Product's version (see the About dialog)

•	Product's serial number (if you're a registered user)

•	Windows version (including service packs and other installed fixes or patches), US or International

•	Your computer information: CPU type and speed, installed memory

•	Description of the problem (as much detail as possible so we can duplicate the problem)

Please send your questions, comments and bug reports to:

•	pl@protect-me.com

Internet distribution:

•	http://www.nyutility.com/pl/ - PortsLock home page

•	http://www.ntutility.com - SmartLine, Inc. home page

We strongly recommend that you read these Frequently Asked Questions:

•	FAQ

If you have any comments or suggestions for future releases, please don't hesitate to e-mail us.


SmartLine's Software

The software development company SmartLine Incorporated, is dedicated to providing effective and economical solutions to small, medium and large-scale business. Our products help network administrators and systems integrators with their job of providing well-integrated and cost-effective network management solutions:

INFORMATION SECURITY SOLUTIONS:

•	DeviceLock™ - preventing the introduction of inappropriate software and data is important when trying to protect and administer a company's computer network. The traditional solution has been a physical lock on the floppy drive. DeviceLock eliminates the need for physical locks and has a number of advantages. It is easy to install and administrators can have instant access from the remote computers when necessary. There are no physical keys to store and manage - DeviceLock is a software-only solution. Once DeviceLock is installed, administrators can control access to floppies, CD-ROMs or any other device, depending on the time of day and day of the week. DeviceLock enhances access control for Windows System Administrators and helps control removable disk usage. It can protect network and local computers against viruses, trojans and other malicious programs often injected from removable disks. More information is available at http://www.ntutility.com/dl/

NETWORK MANAGEMENT SOLUTIONS:

•	Active Network Monitor™ runs under Windows NT/2000/XP and allows Systems Administrators to gather information from all the computers (even from the Windows 9x/Me computers) in the network without installing server-side applications on these computers. It is the leading enterprise network monitoring solution for corporate networks. ANM significantly reduces the total cost of network management in enterprise environments by enabling IT personnel to monitor installed service packs and hot fixes, services, devices, processes, installed applications, disks, shared resources, hardware resources (IRQs, I/O, DMA and Memory), users, local groups, global groups, and so on. More information is available at http://www.ntutility.com/anm/

•	Remote Task Manager™ is a systems control interface that can be run from any remote Windows NT/2000/XP computer. This enables a Systems Administrator to control most aspects of a remote environment. The simple-to-use, tabbed interface separates applications, services, devices, processes, events, shared resources and performance monitor, making each of these very easy to control. A Systems Administrator can start or stop services or devices, add new services or devices, manage the run level and adjust the security (permissions, auditing and owner). The Process Function and the Task Manager allows remote termination and adjusting of priority. An Event Viewer lets the Administrator view all events as though they were being run on the host computer. The Performance Monitor displays a dynamic overview of the computer's performance (CPU and memory usage). RTM even supports remote installs, enabling a Systems Administrator to set up a service on remote machines without ever having to physically go to them. RTM adds the ability to lock/shutdown/reboot and to create processes on remote computers. More information is available at http://www.ntutility.com/rtm/


Main Dialog

The left side of the Main dialog shows a list of the computers available in your network. This listing is called the computer tree. Each computer that is running PortsLock Service has an icon of a computer. Each computer without PortsLock Service running on it has an icon of a computer overlaid by a red circle containing a white X, indicating the computer is inactive. A computer will also show as inactive if you do not have the system privileges to connect to it.

If you want a listing of only active computers - computers with running and accessible PortsLock Service, you need to check Hide Inactive Computers in the Options menu. If you do not want the computer tree to be automatically expanding, you should uncheck Expand Network Tree in the Options menu. To refresh a list of computers, press F5 or select Refresh Network Tree from the View menu. Also, you can refresh the state (whether active or inactive) of a selected computer by pressing Shift-F5 or selecting Refresh Selected Computer from the View menu.

To access a remote computer, it needs to have PortsLock Service installed and running, and it needs to have a connection to your computer. To access a remote computer, simply select it from the computer tree. PortsLock Manager automatically connects to the computer immediately after it has been selected. You can use a mouse to select the computer or you can use the keyboard's arrow keys and press Enter on a selected computer. Alternatively, you can type in the computer's name in the field above the computer tree, then press Enter.

To connect to the local computer, do not specify a computer name. If Connect to Local Computer at Startup is enabled in the Options menu, PortsLock Manager automatically connects to the local computer each time it starts up.

PortsLock Service should be installed on the computer. PortsLock supports remote installing. This lets a Systems Administrator set up a service on distant machines without having to physically go to them. If the PortsLock Service isn't installed on the remote system you are trying to connect to, PortsLock Manager will suggest that you install the service. Select the PortsLock Service executable file (plservice.exe) and PortsLock Manager will copy it to the remote computer's Windows system directory (e.g. c:\winnt\system32). If the service is on the client system but is outdated, PortsLock Manager replaces it.

If you successfully connect to a computer, its name appears in the status bar of PortsLock Manager, and the following tabs become available:

•	Permissions – allows you to manage security rules. More...

•	Auditing – allows you to manage audit rules. More...

•	Monitoring – provides monitoring of TCP/IP network activity in real-time. More...

You do not need to connect to any computer directly to use Batch Processing. This function is available for use right after PortsLock Manager is loaded. To access Batch Processing you should select the Batch Processing item from the File menu or press Shift-F2. Also, you can press the appropriate button at the top-right side of the Main dialog. More...

You can select Always on Top from the View menu to keep the PortsLock Manager on top (above) any other applications.

To close this dialog and exit PortsLock Manager, select Exit PortsLock from the File menu.


Permissions

Use the Permissions tab to manage security rules. Security rules are responsible for packet filtering. It means that by using security rules you can permit or block a user's access to the network.

To achieve security, you need to define a set of security rules for PortsLock so it can determine if a packet should be allowed to pass or not. To do this, PortsLock looks through its set of security rules for a rule that matches the user who owns the packet and the contents of the packet's header. Once a match is found, the rule action is followed. The rule action could be to block (Deny) the packet or to forward (Permit) the packet. Only the first match counts, as the rules are searched in order.

The packet matching criteria varies depending on the protocol. You can specify rules that depend on the source IP address of the packet, its destination IP address, the source port number, the destination port number (for protocols that support ports), the packet's direction (incoming or outgoing), the user or user group that owns the packet, and even the time of day and day of the week the rule is active. This wide range of matching criteria allows you to create a very flexible and secure network environment.

When you open the Permissions tab for the first time, the permissions list is empty, i.e. doesn't contain any users or user groups and their rules. An empty permissions list means that there are no rules to apply, so all network packets will be allowed to pass through.

There are a few simple steps to define permissions:

•	Add the user or user group. At first, you have to decide for which user or user group you would like to set rules. To add a new user or user group to the list, click on the User button.

Users and user groups in PortsLock are searched on this list from the top down. To change the order of users and user groups on the permissions list, use the Move Up and Move Down buttons at the top right side of the Permissions tab.

•	Add or edit the rule. You should specify the rules that will be used to filter all packets for the user or user group. Different rules can be set separately for incoming and outgoing traffic.

To add either an incoming or outgoing rule, press the Rule button. To edit a rule, either double-click it or select it and press the Edit button. More...

You can arrange the rules in the order that best suits your needs. Don't forget that rules are processed from the top of the list to the bottom. To change the order of rules, use the Move Up and Move Down buttons at the top, right side of the Permissions tab.

Please note that rules take effect immediately as they are added to the list.


Auditing
Permissions

Use the Auditing tab to manage audit rules. Audit rules are responsible for packet auditing. This means that by using audit rules you can audit a user's access to the network.

To audit a user's network activities, you need to define a set of audit rules for PortsLock so it can decide if information about a packet should be logged or not. To determine if a packet should be logged, PortsLock looks through its set of audit rules for a rule that matches the user that owns the packet and the contents of this packet's header. Once a match is found, the rule is applied. Only the first match counts, as the rules are searched in order.

There is not much difference between setting up audit and security rules so read this section before defining audit rules.

You can audit two types of packets:

•	Allowed – all packets that were permitted by PortsLock, i.e. packets were routed to their destination.

•	Denied – all packets that were blocked by PortsLock, i.e. packets were refused because of the matched security rule.

To enable logging for one or both of these packet types, check Audit Allowed and/or Audit Denied at the bottom of the Auditing tab.

Please note that until either Audit Allowed or Audit Denied is checked, logging is disabled in spite of defined audit rules.

PortsLock uses the standard event logging subsystem to log a packet's information. It is extremely useful for system administrators because they can use any event log reading software to view the audit log. You can use the standard Event Viewer as well as PortsLock's built-in Audit Log Viewer.


Add/Edit Rule

Use this dialog to either add or edit the rule.

First, you have to describe the packet you wish to be filtered by the rule.

One of the main packet's description parameters is its protocol. Select the protocol from the Protocol combo box at the top, left side of the dialog. If you select the Other protocol then you have to enter its protocol's number in the editbox.

The next step of describing the packet is defining its source (local endpoint) and destination (remote endpoint).

For each rule, set a source IP address. It can be specified as:

•	Any Address – any IP address.

•	Host – a particular IP address.

•	Network/Mask – an entire sub-network.

•	Network/Range – an IP address range.

Also, for TCP and UDP protocols it is necessary to set a source port. Possible options are:

•	Any – any port.

•	Equal to – a port that is identical to the defined value.

•	Greater than – all ports that are greater than the defined value.

•	Less than – all ports that are less than the defined value.

•	Not Equal to – all ports that are different from the defined value.

•	Between – all ports that are between the two defined values.

•	Not Between – all ports that are outside of the two defined values.

Typical settings for a packet's source are: "Any host All ports".

In exactly the same way as defining a packet's source you have to define its destination (remote endpoint). Set a destination IP address and port. There is no difference in the process of defining a packet's source and destination, so all parameters have the same meanings.

There remains the final step of setting up a rule - defining its time interval. In some cases, it may be useful to apply particular rules during office hours and different criteria for after hour access.

You can define an interval when a selected rule will Permit (for security rules) or is Active (for audit rules) and when this rule becomes Deny (for security rules) or Inactive (for audit rules). It means that the same rule can invert its type of action depending on the time of day and day of the week. Hence, there are three action types for rules:

•	Permit or Active

•	Deny or Inactive

•	Time-dependent

Using special time control you can define a time when the rule will act as a Permit or Active rule and when it will act as a Deny or Inactive rule. Time control appears at the bottom of the dialog. Use the left mouse button and select the allowed time. To select a denied time, use the right mouse button. You can also use the keyboard to set times, the arrow keys for navigation and the spacebar to toggle an allowed/denied time.

Please note that the rule takes effect immediately as it is added to the list.


DNS Name To IP Address

You can use this dialog to get an IP address from the DNS name.


Monitoring

Use the Monitoring tab to monitor TCP/IP network activity in real-time. It shows you which process is associated with each connection endpoint, making it easy to determine what application and user are responsible for specific connections and activity.

Each line (message) in the monitoring list represents a different event and the information that PortsLock Manager shows for the event.

The columns in the monitoring list are defined as follows:

•	Date/Time – the date and the time when this event was received by the PortsLock Driver.

•	Process – the name and identifier of the process that owns the endpoint.

•	Request – the request code (TDI_CONNECT, TDI_SEND, etc.) that has been sent to the TCP/IP driver.

•	Local Address – the protocol (TCP, UDP, ICMP, etc.) of the endpoint and the local IP address/port-pair of the endpoint.

•	Remote Address – shows the remote IP address/port pair of the endpoint, if applicable.

•	Status – the result code (STATUS_SUCCESS, STATUS_PENDING, etc.) of the processed request.

•	User – the name of the user that owns the endpoint.

•	Device Name – the name of the TCP/IP's device (Device\Tcp, Device\Udp, Device\RawIp, Device\Ip, etc.) that should receive the request.

•	Other – other request-specific information for the event, such as the number of bytes sent or received, connection flags, and so on.

To toggle the display of resolved names, click Resolve Addresses. If Resolve Addresses is checked, PortsLock Manager tries to resolve IP addresses and ports to their name (DNS) versions, otherwise it shows their numeric representation.

If you wish to see more detailed information about an event, double-click on its record. For more information about request and status codes, please see Microsoft's documentation for device driver developers - Device Driver Kit (DDK).

By default, the monitoring list scrolls so that it always shows the most recent event. To disable auto-scrolling, uncheck the Keep Last Message in View item from the Monitoring menu.

You can limit the number of records the monitoring list retains by setting the maximum number of messages with Set Message Count from the Monitoring menu.

To clear all records from the monitoring list, select Clear All Messages from the Monitoring menu. Please note that once records are erased, they cannot be recovered.

To save all the records currently in the monitoring list to a text file, select Save from the Monitoring menu. PortsLock Manager then copies all the currently available events to the file that you specify. You can save either a brief or detailed log.

PortsLock Manager can automatically refresh the contents of the monitoring list. To change the refresh rate use Update Speed from the Monitoring menu. To completely disable automatic refreshing, select the Paused menu item. At any time you can refresh the monitoring list manually by pressing the Refresh button on the Monitoring tab.

If the Always Active menu item is checked, then PortsLock Manager refreshes the monitoring list even if the Monitoring tab is not active (i.e. the Permissions or Auditing tab is selected).


About

Displays the PortsLock version and your registration information.

Please include this information when reporting any problems to SmartLine's technical support service.


Enter Network Password

The "Enter Network Password" dialog appears when you attempt to connect to a computer, but the domain controller (DC) does not recognize the user account you have used to log on. This often occurs when you are logged on as the administrator of a local computer and attempt to access domain resources. To access the domain resources, you must provide a valid user name and password that the domain recognizes.

•	Connect As: - provides a space for you to type the account name for another user account. User accounts are a domain name followed by a backslash (\) and the user name, e.g. D1\John.

•	Password: - provides a space for you to type the password for the user account name entered in the Connect As: box.

Type your domain and user name in the format as described above, then press the OK button. If you do not know your domain or user name, contact your system administrator.

If you press the Cancel button, you may not be able to connect to a computer.


Audit Log Viewer

The columns in the audit log viewer are defined as follows:

•	Type – the class of an event, either Success for allowed packets or Failure for denied packets.

•	Date/Time – the date and the time when this event was received by the logging service.

•	Local Address – the local IP address of the endpoint.

•	Local Port – the local port of the endpoint, if applicable.

•	Remote Address – the remote IP address of the endpoint, if applicable.

•	Remote Port – the remote port of the endpoint, if applicable.

•	Protocol – the protocol (TCP, UDP, ICMP, etc.) of the endpoint.

•	Action – the network activity type. This can be Connect, Listen, Accept, Disconnect, Send, Receive, and so on.

•	User – the name of the user that owns the endpoint.

•	PID – the identifier of the process that owns the endpoint.

•	Process – fully qualified path to the process executable file. In some cases, the process name may be displayed instead of the path.

To toggle the display of resolved names, click Resolve Addresses. If Resolve Addresses is checked, PortsLock Manager tries to resolve IP addresses and ports to their name (DNS) versions, otherwise it shows their numeric representation.

Please note that PortsLock uses the standard event logging subsystem to log a packet's information.

To define a maximum log size and what Windows NT/2000/XP should do if the audit log becomes full, use the Settings button. PortsLock Manager will show a dialog where you can change any parameter for the audit log.

If you wish to archive the audit log, use the Save button. You will need to select a file name where it will be saved.

To clear all events from the audit log, press the Clear button.


PortsLock Log Settings

Use this dialog to view and change parameters of the audit log.

Maximum Log Size - specifies the maximum size of a log file (in kilobytes).

Event Log Wrapping - specifies what Windows NT/2000/XP should do when an event log is full (when Maximum Log Size is reached). These can be:

•	Overwrite Events as Needed - the system will overwrite old events if the Maximum Log Size is reached

•	Overwrite Events Older than - specifies that records that are newer than this value will not be overwritten (specified in days)

•	Do Not Overwrite Events (Clear Log Manually) - the system will not overwrite old events if the Maximum Log Size is reached and you will need to clear events manually.

If you wish to reset current settings to the default values, use the Default button.

To apply all changes and close the dialog, click on the OK button.


IP Address To DNS Name

Resolves IP addresses and ports to their name (DNS) versions.


Batch Processing

Batch Processing is one of the most powerful and useful functions of PortsLock. Usually, midsize and large networks contain many computers that should be configured equally. Using Batch Processing network administrators can set security and audit rules for every computer in the network very quickly.

First, you need to select the computers that you want to include in the batch processing. To add computers to the list, press the Add button. This opens a dialog with the computer tree where you can select any computer that is available on your network. More...

You can also load computers from an external file. Press the Load button and select a file that contains the list of computers. Two file formats are supported - text file (.txt) and Comma Separated Values (.csv). A text file must contain computer names separated by tabs. Computer names in a .csv file must be separated by commas or semicolons. To save a computer listing to an external file, press the Save button. Select the type of the file - .txt or .csv.

You then define the rules (security and/or audit) to be applied to the selected computers. For more information, read the Permissions and Auditing sections.

If you want to define only security rules and do not want to change existing audit rules or vice versa, you have to check the appropriate Ignore checkbox on the Permissions or Auditing tab:

•	If Ignore is checked on the Permissions tab then security rules will not be changed for selected computers.

•	If Ignore is checked on the Auditing tab then audit rules will not be changed for selected computers.

•	If Ignore is checked on both tabs then neither security nor audit rules will be changed for selected computers.

Also, if Audit Allowed and/or Audit Denied checkboxes on the Auditing tab are in the intermediate (grayed) state it means that the appropriate audit parameters will not be changed for selected computers.

To start batch processing, press the OK button. You can abort processing at any time.


Set Message Count

You can use this dialog to limit the number of records the monitoring list retains.

The number you specify determines the maximum number of records that PortsLock Manager will maintain in its buffer at any given time. After a defined number of lines have accumulated, the oldest records become unavailable.


Select Computers

Use this dialog to select the computers that you want to include in the batch processing.

Double click on the computer name in the computer tree to add this computer or type the computer's name manually and press the OK button to include selected computers to the list.