RE: what is the good way against reverse telnet?

["Matthew Jenkins" <Matthew.Jenkins () tmctechnologies com>]

Use iptables to block telnet traffic between interfaces, unless you need reverse telnet.  Use the same source and 
destination of your interfaces.

i.e. if your interface IP is 200.200.200.200:

/sbin/iptables -A INPUT -m tcp -p tcp --dport 23 --destination 200.200.200.200 --source 200.200.200.200 -j DROP

You would need to do this for each interface IP on the box.

Matt

Matthew Jenkins
Senior Network Specialist
TMC Technologies, Inc.
304.368.1862 ext 26
AOL: MLJenkinsCom  Yahoo: mljenkins  ICQ: 8116624  MSN
Visit us online at www.tmctechnologies.com

-----Original Message-----
From: Monty Ree [mailto:chulmin2 () hotmail com] 
Sent: Sunday, January 30, 2005 8:54 PM
To: security-basics () securityfocus com
Subject: what is the good way against reverse telnet?

Hello, all.

I have operated firewalled linux webhosting server.
But only input traffic is secured and outbound traffic is totally opened by 
firewall.

So some attacker attacked these servers using reverse telnet.
So is there any method in order to protect against reverse telnet?
Any method or solutions without prohibitting outbound traffic?

Thanks in advance.

_________________________________________________________________
전세계인이 함께하는 웹 메일 서비스인 MSN Hotmail을 만나 보세요.    
http://loginnet.passport.com/login.srf?id=2&svc=mail&cbid=24325&msppjph=1&lc=1042