🚀 go-pugleaf

In <1992Aug27.174729.1@vcp1.vcp.monash.edu.au> daniel@vcp1.vcp.monash.edu.au writes:


>We are in the process of being connected to the network.  Most connected
>computers will be PC's used for mail and telnet and ftp. 
>We have one Iris 4D which it would be really useful to have connected.
>Our head of department is very concerned about security with regards
>to academic/industrial espionage.

What do you mean by the network ? Your local network or the internet ?
If you're connecting to the internet, your access will be through a
router e.g. a CISCO. These have very sophisticated abilities to filter
packets such that e.g.
incoming requests to port25 (SMTP) are allowed to addresses X,Y & Z.
incoming requests to ports 23, 20 are disallowed
etc.
This should easily allow you to be as secure as you like.

>I thought that the best way to make the Iris secure and still allow network
>access would be to disable telnetd and ftpd, leaving inetd and smtpd working
>for mail to be available.  This would allow telnet and ftp *from* our Iris,
>but not *to*.

If you're worried about internal security, rather than disabling inetd as
some have suggested, you can just turn of the relevant services in inetd.conf
as you suggest.

>Can anyone comment on the security of this measure.  Is there any likelihood
>at all of an intruder when there is no telnetd or ftpd operating?

Basically you're secure (mod backdoors/bugs in the programs you're still
running e.g. sendmail bugs :-). Just run netstat -a and look what's 
istening. Nobody can connect to what's not running !

Tim
-- 
Tim Wright, Sequent Computer Systems Ltd.,        |  Email: timw@lonsqnt.co.uk
Customer Services, Allied Dunbar House,           |   or    timw@sequent.com
Chilsey Green Rd., Chertsey, Surrey, UK, KT16 9HB |  Phone: +44-932-568900
"I've got a set of teeth that druids could worship at" - Cat, Red Dwarf