🚀 go-pugleaf

In article <1992Aug27.174729.1@vcp1.vcp.monash.edu.au> daniel@vcp1.vcp.monash.edu.au writes:
>
>
>I thought that the best way to make the Iris secure and still allow network
>access would be to disable telnetd and ftpd, leaving inetd and smtpd working
>for mail to be available.  This would allow telnet and ftp *from* our Iris,
>but not *to*.
>
With inetd gone, no one would be able to telnet *to* your machine..
I think its telnetd you would need to disable along with the ftpd


Guy
gtvega@seabass.st.usm.edu
Eagles Nest BBS

>
>

In article <1992Aug27.174729.1@vcp1.vcp.monash.edu.au> daniel@vcp1.vcp.monash.edu.au writes:
> I thought that the best way to make the Iris secure and still allow network
> access would be to disable telnetd and ftpd, leaving inetd and smtpd working
> for mail to be available.  This would allow telnet and ftp *from* our Iris,
> but not *to*.

  Just nuke inetd -- this kills off most of your networking services.
(Outgoing) ftp and mail still work fine.

> Can anyone comment on the security of this measure.  Is there any likelihood
> at all of an intruder when there is no telnetd or ftpd operating?

  Yes.  Any service that you run can be used to get in.  Typically,
though, you only really have to watch for things like windowing systems,
yellow-pages or rpc-like services, NFS, home grown daemons or anything
that gets started (and stays running, obviously) in your rc files (or
whatever the iris uses, can't remember if it's sysV or not WRT that)
etc.

 -- d

In <1992Aug27.174729.1@vcp1.vcp.monash.edu.au> daniel@vcp1.vcp.monash.edu.au writes:


>We are in the process of being connected to the network.  Most connected
>computers will be PC's used for mail and telnet and ftp. 
>We have one Iris 4D which it would be really useful to have connected.
>Our head of department is very concerned about security with regards
>to academic/industrial espionage.

What do you mean by the network ? Your local network or the internet ?
If you're connecting to the internet, your access will be through a
router e.g. a CISCO. These have very sophisticated abilities to filter
packets such that e.g.
incoming requests to port25 (SMTP) are allowed to addresses X,Y & Z.
incoming requests to ports 23, 20 are disallowed
etc.
This should easily allow you to be as secure as you like.

>I thought that the best way to make the Iris secure and still allow network
>access would be to disable telnetd and ftpd, leaving inetd and smtpd working
>for mail to be available.  This would allow telnet and ftp *from* our Iris,
>but not *to*.

If you're worried about internal security, rather than disabling inetd as
some have suggested, you can just turn of the relevant services in inetd.conf
as you suggest.

>Can anyone comment on the security of this measure.  Is there any likelihood
>at all of an intruder when there is no telnetd or ftpd operating?

Basically you're secure (mod backdoors/bugs in the programs you're still
running e.g. sendmail bugs :-). Just run netstat -a and look what's 
istening. Nobody can connect to what's not running !

Tim
-- 
Tim Wright, Sequent Computer Systems Ltd.,        |  Email: timw@lonsqnt.co.uk
Customer Services, Allied Dunbar House,           |   or    timw@sequent.com
Chilsey Green Rd., Chertsey, Surrey, UK, KT16 9HB |  Phone: +44-932-568900
"I've got a set of teeth that druids could worship at" - Cat, Red Dwarf