RE: Securing port 23

They could buy another firewall and place it between the network and the iSeries. An expensive way but would do the job. I think there is a way to setup packet filtering on the I http://www.ibmsystemsmag.com/ibmi/november03/internet/8470p1.aspx but have never done it , We own nSafe and it does this at the exit point level and was much easier to setup than the packet filtering.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Trevor Perry
Sent: Wednesday, August 25, 2010 7:49 AM
To: Midrange Systems Technical Discussion
Subject: Re: Securing port 23

Thanks to everyone for the ideas.. I think an exit program is what I need. I was really wondering if there were any other ways on the i that I could configure telnet any more securely. Or, if there were a firewall means to prevent port 23 from being used except by certain mac addresses or Ips.

The question of why and how was not what I was asking. But, since you asked, the ~why~ is a complicated mix of interpretation of PCI regulations and misunderstanding of the exposure. It does seem that the 'regulator' in this case did not understand the i, or that the firewall is way too open - however, I am not privy to that information. Nor do I know the ~how~.

And, this is not one user, but a particular configuration of a tool that does not support SSL telnet.

To take this to the next level, where do I find the documentation on telnet exit programs?

Trevor


On 8/25/10 12:57 AM, "John Earl" <john.earl@xxxxxxxxxxxxxx> wrote:

Shut down Port 23? Exactly how did they do that? If they used the
port blocking (I'm sure I am mis-mangling the name) then you won't get
non-ssl telnet through that port.

A Telnet Exit program can limit access to known good user profiles and
known good IP addresses, but if your firewall is doing NAT (likely),
I'm not sure either approach would buy you much.

The real question is why allow one user to bypass SSL, are you sure
there is not a way to have that user connect securely?

jte






On Aug 24, 2010, at 6:13 PM, Trevor Perry wrote:

I have a customer who has turned off port 23 and only uses SSL. We
have a requirement where we must use port 23 for unsecured telnet.
How can I ensure that opening port 23 does not expose telnet beyond
their DMZ/firewall?

Thanks!
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

--John Earl
President and CEO
Patrick Townsend Security Solutions
"The Encryption Company"

Olympia, WA | www.patownsend.com
Office: 360-357-8971 Ext 118

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.