Snort mailing list archives
Re: blocking outbound ports
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 14 Jul 2010 18:40:27 -0400
Agile Aspect said:
Hi - is it possible to block ssh/sftp applications from accessing open outbound ports? For instance, suppose the outbound port 995 is open for POP/SSL on the company LAN. I then go home and configure the SSH server on home Linux machine to run on port 995. Then I return to the company LAN and attempt to use sftp to transfer files the company LAN to my machine at home. Can I block this attempt with Snort?
If you were running Snort in "inline" mode, and you wrote a rule to detect the SSH banner on a non-standard port, yes you could do this. You'd have to install Snort in --enable-inline mode first though, that's your first step. ------------------------------------------------------------------------------ This SF.net email is sponsored by Sprint What will you do first with EVO, the first 4G phone? Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- blocking outbound ports Agile Aspect (Jul 14)
- Re: blocking outbound ports Joel Esler (Jul 14)