Re: Securing port 23

[Trevor Perry <trevor@xxxxxxxxxx>]

Thanks to everyone for the ideas.. I think an exit program is what I need. I
was really wondering if there were any other ways on the i that I could
configure telnet any more securely. Or, if there were a firewall means to
prevent port 23 from being used except by certain mac addresses or Ips.

The question of why and how was not what I was asking. But, since you asked,
the ~why~ is a complicated mix of interpretation of PCI regulations and
misunderstanding of the exposure. It does seem that the 'regulator' in this
case did not understand the i, or that the firewall is way too open -
however, I am not privy to that information. Nor do I know the ~how~.

And, this is not one user, but a particular configuration of a tool that
does not support SSL telnet.

To take this to the next level, where do I find the documentation on telnet
exit programs?

Trevor


On 8/25/10 12:57 AM, "John Earl" <john.earl@xxxxxxxxxxxxxx> wrote:

> Shut down Port 23?  Exactly how did they do that?  If they used the
> port blocking (I'm sure I am mis-mangling the name) then you won't get
> non-ssl telnet through that port.
>
> A Telnet Exit program can limit access to known good user profiles and
> known good IP addresses, but if your firewall is doing NAT (likely),
> I'm not sure either approach would buy you much.
>
> The real question is why allow one user to bypass SSL, are you sure
> there is not a way to have that user connect securely?
>
> jte
>
>
>
>
>
>
> On Aug 24, 2010, at 6:13 PM, Trevor Perry wrote:
>
> > I have a customer who has turned off port 23 and only uses SSL. We
> > have a
> > requirement where we must use port 23 for unsecured telnet. How can
> > I ensure
> > that opening port 23 does not expose telnet beyond their DMZ/firewall?
> >
> > Thanks!
> > -- 
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L)
> > mailing list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
>
> --John Earl
> President and CEO
> Patrick Townsend Security Solutions
> "The Encryption Company"
>
> Olympia, WA | www.patownsend.com
> Office: 360-357-8971 Ext 118