Re: blocking remote telnet

Hi Jim,

maybe a local signed on user which does a telnet to 127.0.0.1
(localhost)?

-h


-----Ursprüngliche Nachricht-----
Von: Jim Franz [mailto:franz400@xxxxxxxxxxxx]
Gesendet: Mittwoch, 6. Juni 2007 04:54
An: security400@xxxxxxxxxxxx
Betreff: [Security400] blocking remote telnet


Customer's network admin swears firewall blocks port 23 (telnet, both
tcp&udp).
I tested remotely from windows, and telnet appears blocked.
But I have a couple pages of someone remotely trying to guess a password
for "root" and "admin" with existing virtual device names like
qpadev0001.
My TCP Service table says telnet is 23.
No ssl configured, but telnet-ssl is port 992.
Is there another service or port to block ???
Netstat is showing several services listening that I don't recognize.
Any reference to all the services and what starts them?
jim franz