Re: blocking outbound ports

[Joel Esler <jesler () sourcefire com>]

Agile Aspect said:
> Hi - is it possible to block
>
>     ssh/sftp
>
> applications from accessing open outbound ports?
>
> For instance, suppose the outbound port 995 is open for POP/SSL on the
> company LAN.
>
> I then go home and configure the SSH server on home Linux machine to
> run on port 995.
>
> Then I return to the company LAN and attempt to use sftp to transfer
> files the company LAN to my machine at home.
>
> Can I block this attempt with Snort?

If you were running Snort in "inline" mode, and you wrote a rule to
detect the SSH banner on a non-standard port, yes you could do this.

You'd have to install Snort in --enable-inline mode first though, that's
your first step.

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users