Re: Disabling telnet on Linux iptables firewall
- From: Michael Heiming <michael+USENET@xxxxxxxxxxxxxx>
- Date: Sun, 29 Oct 2006 18:18:34 +0100
In comp.os.linux.security Moe Trin <ibuprofin@xxxxxxxxxxxxxxxxxxxxxx>:
On Sat, 28 Oct 2006, in the Usenet newsgroup comp.os.linux.security, in article
<pan.2006.10.28.19.55.19.780733@xxxxxxxxx>, C. J. Clegg wrote:
On my Fedora Core 2 server,
Why are you using such an old release? FC2 was declared "unsupported"
at downloads.fedoralegacy.org in April, and there have been no updates
released since the end of March. FC6 was released this past week. Consider
updating to that.
Full ack!
[..]
I would like to be able to limit all outgoing traffic to http, ssh, and
email, nothing else.
Two choices - first is to get rid of the GUI, and write the firewall rules
yourself. There is a large amount of documentation available, starting
with the official HOWTOs, as well as Rusty Russell's "unofficial" howtos
available from http://www.iptables.org/documentation/HOWTO/. Depending
on your skill level, this may or may not be a viable option. Remember that
the 'telnet' client takes a port number as an optional parameter, and thus
can telnet _to_ any port number on the remote - whether or not there is a
server there (won't connect if there isn't, but that doesn't stop the
attempt).
Alternatively you can enter iptables rules manually and store them
with 'iptables-save' on RH and associated to restore them on
reboot. The OP should check the docs, I have never used this, but
wrote rules manual.
The second choice is to either remove or disable the undesired clients.
Disabling them is likely the better choice - use the 'which' command to
find the binary, and then 'chmod 644' that:
[compton ~]$ which telnet
/usr/bin/telnet
[compton ~]$ su -c /bin/chmod 644 /usr/bin/telnet
$ ll /usr/bin/telnet
-rw-r--r-- 1 root root 68064 Jun 14 2005 /usr/bin/telnet
$ /lib/ld-linux.so.2 /usr/bin/telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Hopefully they are dump enough? Changing perms to "750" might do
more, even if likely to not survive the next upgrade of the
package. Though it wouldn't prevent users from using something
else or there own client.
In your list of allowed traffic, you don't mention 'ftp' but that is needed
to keep your system up to dates. Admittedly, this is going to be quite
difficult for FC2, but you should be aware of your responsibility.
Upgrading would be a good idea, the OP might not ever have
installed a single patch?
--
Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
mail: echo zvpunry@xxxxxxxxxx | perl -pe 'y/a-z/n-za-m/'
#bofh excuse 278: The Dilithium Crystals need to be rotated.
.
- Follow-Ups:
- Re: Disabling telnet on Linux iptables firewall
- From: Moe Trin
- Re: Disabling telnet on Linux iptables firewall
- References:
- Disabling telnet on Linux iptables firewall
- From: C. J. Clegg
- Re: Disabling telnet on Linux iptables firewall
- From: Moe Trin
- Disabling telnet on Linux iptables firewall
- Prev by Date: Re: Disabling telnet on Linux iptables firewall
- Next by Date: Re: Disabling telnet on Linux iptables firewall
- Previous by thread: Re: Disabling telnet on Linux iptables firewall
- Next by thread: Re: Disabling telnet on Linux iptables firewall
- Index(es):
Relevant Pages
|
