Snort mailing list archives

blocking outbound ports


From: Agile Aspect <agile.aspect () gmail com>
Date: Wed, 14 Jul 2010 15:18:59 -0700

Hi - is it possible to block

    ssh/sftp

applications from accessing open outbound ports?

For instance, suppose the outbound port 995 is open for POP/SSL on the
company LAN.

I then go home and configure the SSH server on home Linux machine to
run on port 995.

Then I return to the company LAN and attempt to use sftp to transfer
files the company LAN to my machine at home.

Can I block this attempt with Snort?

The OS would be Solaris 10 running IP FIltering, Squid, and Snort.

Only 1 inbound port would be open, namely, HTTPS, and 5 outbound
ports, namely, HTTP,HTTPS, SMTPS, IMAPS and POP3S.

Any help would be greatly appreciated.

-- Agile

-- 
      Enjoy global warming while it lasts.

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: